@verdaccio/store 9.0.0-next-9.41 → 9.0.0-next-9.43

package/build/storage.d.ts

@@ -1,6 +1,7 @@
 import { PassThrough, Readable } from 'node:stream';
 import type { searchUtils } from '@verdaccio/core';
 import type { ISyncUplinksOptions, ProxyInstanceList, ProxySearchParams } from '@verdaccio/proxy';
+import type { AttestationsResponse, RegistryKey } from '@verdaccio/proxy';
 import type { RequestOptions } from '@verdaccio/url';
 import type { AbbreviatedManifest, Config, Logger, Manifest, MergeTags, Token, TokenFilter, UnPublishManifest, Version } from '@verdaccio/types';
 import type { UpdateManifestOptions } from '.';
@@ -17,6 +18,7 @@ declare class Storage {
     readonly config: Config;
     readonly logger: Logger;
     readonly uplinks: ProxyInstanceList;
+    private registryKeysCache?;
     private searchService;
     private stageStorage;
     constructor(config: Config, logger: Logger);
@@ -127,6 +129,15 @@ declare class Storage {
      * @param tags list of dist-tags
      */
     mergeTagsNext(name: string, tags: MergeTags, requestOptions?: RequestOptions): Promise<Manifest>;
+    /** Signing keys of every uplink merged by keyid, for `GET /-/npm/v1/keys`; null when none has keys. */
+    getRegistryKeys(): Promise<RegistryKey[] | null>;
+    /**
+     * Attestations of a version, asked to the uplink recorded for it in `_distfiles` or, when
+     * unknown, to the uplinks that proxy the package in order. Null when
+     * none has them; the last lookup error is thrown when no uplink could answer.
+     */
+    getAttestations(name: string, version: string): Promise<AttestationsResponse | null>;
+    private uplinkOfVersion;
     /**
      * Resolve the uplink to fetch a distfile url from, or null when the fetch
      * must be refused.

package/build/storage.js

@@ -23,6 +23,7 @@ _verdaccio_search = require_runtime.__toESM(_verdaccio_search);
 let _verdaccio_tarball = require("@verdaccio/tarball");
 //#region src/storage.ts
 var debug$1 = (0, debug.default)("verdaccio:storage");
+var REGISTRY_KEYS_TTL = 36e5;
 var noSuchFile = "ENOENT";
 var resourceNotAvailable = "EAGAIN";
 var PROTO_NAME = "__proto__";
@@ -32,6 +33,7 @@ var Storage = class {
 	config;
 	logger;
 	uplinks;
+	registryKeysCache;
 	searchService;
 	stageStorage = null;
 	constructor(config, logger) {
@@ -697,6 +699,68 @@ var Storage = class {
 			return newData;
 		});
 	}
+	/** Signing keys of every uplink merged by keyid, for `GET /-/npm/v1/keys`; null when none has keys. */
+	async getRegistryKeys() {
+		if (this.registryKeysCache && this.registryKeysCache.expires > Date.now()) return this.registryKeysCache.keys;
+		const byKeyId = /* @__PURE__ */ new Map();
+		let complete = true;
+		let lastError;
+		for (const uplinkName of Object.keys(this.uplinks)) try {
+			for (const key of await this.uplinks[uplinkName].getRegistryKeys() ?? []) {
+				const known = byKeyId.get(key.keyid);
+				if (known && known.key !== key.key) this.logger.warn({
+					uplinkName,
+					keyid: key.keyid
+				}, "uplink @{uplinkName} publishes a different key for @{keyid}, ignored");
+				else if (!known) byKeyId.set(key.keyid, key);
+			}
+		} catch (err) {
+			complete = false;
+			lastError = err;
+			this.logger.warn({
+				uplinkName,
+				err: err.message
+			}, "signing keys of uplink @{uplinkName} unavailable: @{err}");
+		}
+		if (byKeyId.size === 0 && lastError) throw lastError;
+		const keys = byKeyId.size === 0 ? null : [...byKeyId.values()];
+		if (complete) this.registryKeysCache = {
+			keys,
+			expires: Date.now() + REGISTRY_KEYS_TTL
+		};
+		return keys;
+	}
+	/**
+	* Attestations of a version, asked to the uplink recorded for it in `_distfiles` or, when
+	* unknown, to the uplinks that proxy the package in order. Null when
+	* none has them; the last lookup error is thrown when no uplink could answer.
+	*/
+	async getAttestations(name, version) {
+		const cached = await this.getPackagelocalByName(name);
+		const source = cached ? this.uplinkOfVersion(cached, version) : void 0;
+		const candidates = source ? [source] : Object.keys(this.uplinks).filter((uplinkName) => (0, _verdaccio_config.hasProxyTo)(name, uplinkName, this.config.packages));
+		let lastError;
+		for (const uplinkName of candidates) try {
+			const attestations = await this.uplinks[uplinkName].getAttestations(name, version);
+			if (attestations) return attestations;
+			lastError = void 0;
+		} catch (err) {
+			lastError = err;
+			this.logger.warn({
+				name,
+				version,
+				uplinkName,
+				err: err.message
+			}, "attestations of @{name}@@{version} unavailable on uplink @{uplinkName}: @{err}");
+		}
+		if (lastError) throw lastError;
+		return null;
+	}
+	uplinkOfVersion(manifest, version) {
+		const tarball = manifest.versions?.[version]?.dist?.tarball;
+		const registry = typeof tarball === "string" ? manifest._distfiles?.[_verdaccio_core.tarballUtils.extractTarballFromUrl(tarball)]?.registry : void 0;
+		return registry && this.uplinks[registry] && (0, _verdaccio_config.hasProxyTo)(manifest.name, registry, this.config.packages) ? registry : void 0;
+	}
 	/**
 	* Resolve the uplink to fetch a distfile url from, or null when the fetch
 	* must be refused.
@@ -1449,7 +1513,7 @@ var Storage = class {
 						url: version.dist.tarball,
 						sha: version.dist.shasum
 					};
-					const upLink = version[Symbol.for("__verdaccio_uplink")];
+					const upLink = version[Symbol.for("__verdaccio_uplink")] ?? uplinkName;
 					if ((0, lodash_es.isNil)(upLink) === false) this.updateUplinkToRemoteProtocol(hash, upLink);
 				}
 			}