@vltpkg/package-info 1.0.0-rc.25 → 1.0.0-rc.26

package/dist/index.js

@@ -9,7 +9,7 @@ import { asPackument, isIntegrity } from '@vltpkg/types';
 import ssri from 'ssri';
 import { Monorepo } from '@vltpkg/workspaces';
 import { XDG } from '@vltpkg/xdg';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { mkdir, readFile, rm, stat, symlink, unlink, writeFile, } from 'node:fs/promises';
 import { basename, dirname, resolve as pathResolve, relative, } from 'node:path';
 import { create as tarC } from 'tar';
@@ -67,7 +67,11 @@ export class PackageInfoClient {
             spec = Spec.parse(spec, this.options);
         const { from = this.#projectRoot, integrity, resolved } = options;
         const f = spec.final;
-        const r = integrity && resolved ?
+        // Track whether integrity/resolved came from the caller (e.g. lockfile)
+        // vs freshly resolved. We only verify tarball integrity on net-new
+        // installs (fresh resolution), not when replaying from lockfile.
+        const fromLockfile = !!(integrity && resolved);
+        const r = fromLockfile ?
             { resolved, integrity, spec }
             : await this.resolve(spec, options);
         switch (f.type) {
@@ -114,8 +118,28 @@ export class PackageInfoClient {
                     response.checkIntegrity({ spec, url: resolved })) {
                     this.#trustedIntegrities.set(r.resolved, response.integrity);
                 }
+                const buf = response.buffer();
+                // Verify tarball integrity against the manifest's dist.integrity.
+                // This is a supply-chain security measure: the registry may not
+                // validate integrity, so we do it client-side on every fresh
+                // download. Skip when integrity came from lockfile/cache (it was
+                // already verified on first install).
+                if (r.integrity && !fromLockfile) {
+                    const hash = createHash('sha512');
+                    hash.update(buf);
+                    const computed = `sha512-${hash.digest('base64')}`;
+                    if (computed !== r.integrity) {
+                        throw error('Tarball integrity check failed', {
+                            code: 'EINTEGRITY',
+                            spec,
+                            url: r.resolved,
+                            wanted: r.integrity,
+                            found: computed,
+                        });
+                    }
+                }
                 try {
-                    await this.tarPool.unpack(response.buffer(), target);
+                    await this.tarPool.unpack(buf, target);
                 }
                 catch (er) {
                     throw this.#resolveError(spec, options, 'tar unpack failed', { cause: er });
@@ -292,7 +316,23 @@ export class PackageInfoClient {
                     response.checkIntegrity({ spec, url: tarball })) {
                     this.#trustedIntegrities.set(tarball, response.integrity);
                 }
-                return response.buffer();
+                const buf = response.buffer();
+                // Verify tarball integrity against the manifest's dist.integrity.
+                if (integrity) {
+                    const hash = createHash('sha512');
+                    hash.update(buf);
+                    const computed = `sha512-${hash.digest('base64')}`;
+                    if (computed !== integrity) {
+                        throw error('Tarball integrity check failed', {
+                            code: 'EINTEGRITY',
+                            spec,
+                            url: tarball,
+                            wanted: integrity,
+                            found: computed,
+                        });
+                    }
+                }
+                return buf;
             }
             case 'git': {
                 const { remoteURL, gitRemote, gitCommittish, gitSelectorParsed, } = f;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/package-info",
   "description": "Resolve and fetch package metadata and tarballs",
-  "version": "1.0.0-rc.25",
+  "version": "1.0.0-rc.26",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -9,19 +9,20 @@
   },
   "author": {
     "name": "vlt technology inc.",
-    "email": "support@vlt.sh"
+    "email": "support@vlt.sh",
+    "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.0-rc.25",
-    "@vltpkg/git": "1.0.0-rc.25",
-    "@vltpkg/package-json": "1.0.0-rc.25",
-    "@vltpkg/pick-manifest": "1.0.0-rc.25",
-    "@vltpkg/registry-client": "1.0.0-rc.25",
-    "@vltpkg/spec": "1.0.0-rc.25",
-    "@vltpkg/tar": "1.0.0-rc.25",
-    "@vltpkg/types": "1.0.0-rc.25",
-    "@vltpkg/workspaces": "1.0.0-rc.25",
-    "@vltpkg/xdg": "1.0.0-rc.25",
+    "@vltpkg/error-cause": "1.0.0-rc.26",
+    "@vltpkg/git": "1.0.0-rc.26",
+    "@vltpkg/package-json": "1.0.0-rc.26",
+    "@vltpkg/pick-manifest": "1.0.0-rc.26",
+    "@vltpkg/registry-client": "1.0.0-rc.26",
+    "@vltpkg/spec": "1.0.0-rc.26",
+    "@vltpkg/tar": "1.0.0-rc.26",
+    "@vltpkg/types": "1.0.0-rc.26",
+    "@vltpkg/workspaces": "1.0.0-rc.26",
+    "@vltpkg/xdg": "1.0.0-rc.26",
     "ssri": "^13.0.0",
     "tar": "^7.5.2"
   },
@@ -30,8 +31,8 @@
     "@types/node": "^22.19.2",
     "@types/pacote": "^11.1.8",
     "@vltpkg/benchmark": "0.0.0",
-    "@vltpkg/cache-unzip": "1.0.0-rc.25",
-    "@vltpkg/vlt-json": "1.0.0-rc.25",
+    "@vltpkg/cache-unzip": "1.0.0-rc.26",
+    "@vltpkg/vlt-json": "1.0.0-rc.26",
     "eslint": "^9.39.1",
     "pacote": "^21.0.4",
     "prettier": "^3.7.4",