@vltpkg/package-info 1.0.0-rc.25 → 1.0.0-rc.27

package/dist/index.d.ts

@@ -32,6 +32,13 @@ export type PackageInfoClientRequestOptions = PickManifestOptions & RegistryClie
 export type PackageInfoClientExtractOptions = PackageInfoClientRequestOptions & {
     integrity?: Integrity;
     resolved?: string;
+    /**
+     * When true, indicates that integrity + resolved came from a
+     * lockfile (i.e. they were already verified on first install).
+     * Skips the client-side tarball integrity check.
+     * Defaults to false — fresh installs always verify integrity.
+     */
+    fromLockfile?: boolean;
 };
 export declare class PackageInfoClient {
     #private;

package/dist/index.js

@@ -5,11 +5,11 @@ import { pickManifest } from '@vltpkg/pick-manifest';
 import { RegistryClient } from '@vltpkg/registry-client';
 import { Spec } from '@vltpkg/spec';
 import { Pool } from '@vltpkg/tar';
-import { asPackument, isIntegrity } from '@vltpkg/types';
+import { asPackument } from '@vltpkg/types';
 import ssri from 'ssri';
 import { Monorepo } from '@vltpkg/workspaces';
 import { XDG } from '@vltpkg/xdg';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { mkdir, readFile, rm, stat, symlink, unlink, writeFile, } from 'node:fs/promises';
 import { basename, dirname, resolve as pathResolve, relative, } from 'node:path';
 import { create as tarC } from 'tar';
@@ -65,9 +65,12 @@ export class PackageInfoClient {
     async extract(spec, target, options = {}) {
         if (typeof spec === 'string')
             spec = Spec.parse(spec, this.options);
-        const { from = this.#projectRoot, integrity, resolved } = options;
+        const { from = this.#projectRoot, integrity, resolved, fromLockfile = false, } = options;
         const f = spec.final;
-        const r = integrity && resolved ?
+        // If the caller already provides both integrity and resolved
+        // (from lockfile or prior resolution), skip re-resolving.
+        const alreadyResolved = !!(integrity && resolved);
+        const r = alreadyResolved ?
             { resolved, integrity, spec }
             : await this.resolve(spec, options);
         switch (f.type) {
@@ -98,24 +101,73 @@ export class PackageInfoClient {
                 // fallthrough if a remote tarball url present
             }
             case 'registry': {
-                const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
-                const response = await this.registryClient.request(r.resolved, {
-                    integrity: r.integrity,
-                    trustIntegrity,
-                });
-                if (response.statusCode !== 200) {
-                    throw this.#resolveError(spec, options, 'failed to fetch tarball', {
-                        url: r.resolved,
-                        response,
+                const fetchTarball = async (useCache) => {
+                    const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
+                    const response = await this.registryClient.request(r.resolved, {
+                        integrity: r.integrity,
+                        trustIntegrity,
+                        ...(useCache === false ? { useCache } : {}),
                     });
+                    if (response.statusCode !== 200) {
+                        throw this.#resolveError(spec, options, 'failed to fetch tarball', {
+                            url: r.resolved,
+                            response,
+                        });
+                    }
+                    // if it's not trusted already, but valid, start trusting
+                    if (!trustIntegrity &&
+                        response.checkIntegrity({ spec, url: resolved })) {
+                        this.#trustedIntegrities.set(r.resolved, response.integrity);
+                    }
+                    const buf = response.buffer();
+                    // Verify tarball integrity against the manifest's
+                    // dist.integrity. This is a supply-chain security measure:
+                    // the registry may not validate integrity, so we do it
+                    // client-side on every fresh download. Skip when integrity
+                    // came from lockfile/cache (it was already verified on
+                    // first install).
+                    /* c8 ignore start - defense-in-depth: registry client's
+                     * checkIntegrity() usually catches mismatches first since
+                     * it checks the same gzip bytes. This fires only when the
+                     * registry client check is skipped (trustIntegrity=true). */
+                    if (r.integrity && !fromLockfile) {
+                        const hash = createHash('sha512');
+                        hash.update(buf);
+                        const computed = `sha512-${hash.digest('base64')}`;
+                        if (computed !== r.integrity) {
+                            throw error('Tarball integrity check failed', {
+                                code: 'EINTEGRITY',
+                                spec,
+                                url: r.resolved,
+                                wanted: r.integrity,
+                                found: computed,
+                            });
+                        }
+                    }
+                    /* c8 ignore stop */
+                    return buf;
+                };
+                let buf;
+                try {
+                    buf = await fetchTarball();
                 }
-                // if it's not trusted already, but valid, start trusting
-                if (!trustIntegrity &&
-                    response.checkIntegrity({ spec, url: resolved })) {
-                    this.#trustedIntegrities.set(r.resolved, response.integrity);
+                catch (er) {
+                    // On EINTEGRITY, retry once bypassing cache. This handles
+                    // transient issues such as corrupted downloads or CDN
+                    // inconsistencies that cause the cached tarball to not
+                    // match the expected integrity hash.
+                    if (er instanceof Error &&
+                        'cause' in er &&
+                        er.cause
+                            ?.code === 'EINTEGRITY') {
+                        buf = await fetchTarball(false);
+                    }
+                    else {
+                        throw er;
+                    }
                 }
                 try {
-                    await this.tarPool.unpack(response.buffer(), target);
+                    await this.tarPool.unpack(buf, target);
                 }
                 catch (er) {
                     throw this.#resolveError(spec, options, 'tar unpack failed', { cause: er });
@@ -278,21 +330,56 @@ export class PackageInfoClient {
                 if (!tarball) {
                     throw this.#resolveError(spec, options, 'no tarball found in manifest.dist');
                 }
-                const trustIntegrity = this.#trustedIntegrities.get(tarball) === integrity;
-                const response = await this.registryClient.request(tarball, {
-                    ...options,
-                    integrity,
-                    trustIntegrity,
-                });
-                if (response.statusCode !== 200) {
-                    throw this.#resolveError(spec, options, 'failed to fetch tarball', { response, url: tarball });
+                const fetchTarball = async (useCache) => {
+                    const trustIntegrity = this.#trustedIntegrities.get(tarball) === integrity;
+                    const response = await this.registryClient.request(tarball, {
+                        ...options,
+                        integrity,
+                        trustIntegrity,
+                        ...(useCache === false ? { useCache } : {}),
+                    });
+                    if (response.statusCode !== 200) {
+                        throw this.#resolveError(spec, options, 'failed to fetch tarball', { response, url: tarball });
+                    }
+                    // if we don't already trust it, but it's valid, start
+                    // trusting it
+                    if (!trustIntegrity &&
+                        response.checkIntegrity({ spec, url: tarball })) {
+                        this.#trustedIntegrities.set(tarball, response.integrity);
+                    }
+                    const buf = response.buffer();
+                    // Verify tarball integrity against the manifest's
+                    // dist.integrity.
+                    /* c8 ignore start - defense-in-depth (see extract) */
+                    if (integrity) {
+                        const hash = createHash('sha512');
+                        hash.update(buf);
+                        const computed = `sha512-${hash.digest('base64')}`;
+                        if (computed !== integrity) {
+                            throw error('Tarball integrity check failed', {
+                                code: 'EINTEGRITY',
+                                spec,
+                                url: tarball,
+                                wanted: integrity,
+                                found: computed,
+                            });
+                        }
+                    }
+                    /* c8 ignore stop */
+                    return buf;
+                };
+                try {
+                    return await fetchTarball();
                 }
-                // if we don't already trust it, but it's valid, start trusting it
-                if (!trustIntegrity &&
-                    response.checkIntegrity({ spec, url: tarball })) {
-                    this.#trustedIntegrities.set(tarball, response.integrity);
+                catch (er) {
+                    if (er instanceof Error &&
+                        'cause' in er &&
+                        er.cause
+                            ?.code === 'EINTEGRITY') {
+                        return await fetchTarball(false);
+                    }
+                    throw er;
                 }
-                return response.buffer();
             }
             case 'git': {
                 const { remoteURL, gitRemote, gitCommittish, gitSelectorParsed, } = f;
@@ -392,15 +479,6 @@ export class PackageInfoClient {
                     : pickManifest(await this.packument(f, options), spec, options);
                 if (!mani)
                     throw this.#resolveError(spec, options);
-                const { integrity, tarball } = mani.dist ?? /* c8 ignore next */ {};
-                if (isIntegrity(integrity) && tarball) {
-                    const registryOrigin = new URL(String(f.registry)).origin;
-                    const tgzOrigin = new URL(tarball).origin;
-                    // if it comes from the same origin, trust the integrity
-                    if (tgzOrigin === registryOrigin) {
-                        this.#trustedIntegrities.set(tarball, integrity);
-                    }
-                }
                 // Cache the manifest data
                 if (cachePath) {
                     const json = JSON.stringify({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/package-info",
   "description": "Resolve and fetch package metadata and tarballs",
-  "version": "1.0.0-rc.25",
+  "version": "1.0.0-rc.27",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -9,19 +9,20 @@
   },
   "author": {
     "name": "vlt technology inc.",
-    "email": "support@vlt.sh"
+    "email": "support@vlt.sh",
+    "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.0-rc.25",
-    "@vltpkg/git": "1.0.0-rc.25",
-    "@vltpkg/package-json": "1.0.0-rc.25",
-    "@vltpkg/pick-manifest": "1.0.0-rc.25",
-    "@vltpkg/registry-client": "1.0.0-rc.25",
-    "@vltpkg/spec": "1.0.0-rc.25",
-    "@vltpkg/tar": "1.0.0-rc.25",
-    "@vltpkg/types": "1.0.0-rc.25",
-    "@vltpkg/workspaces": "1.0.0-rc.25",
-    "@vltpkg/xdg": "1.0.0-rc.25",
+    "@vltpkg/error-cause": "1.0.0-rc.27",
+    "@vltpkg/git": "1.0.0-rc.27",
+    "@vltpkg/package-json": "1.0.0-rc.27",
+    "@vltpkg/pick-manifest": "1.0.0-rc.27",
+    "@vltpkg/registry-client": "1.0.0-rc.27",
+    "@vltpkg/spec": "1.0.0-rc.27",
+    "@vltpkg/tar": "1.0.0-rc.27",
+    "@vltpkg/types": "1.0.0-rc.27",
+    "@vltpkg/workspaces": "1.0.0-rc.27",
+    "@vltpkg/xdg": "1.0.0-rc.27",
     "ssri": "^13.0.0",
     "tar": "^7.5.2"
   },
@@ -30,8 +31,8 @@
     "@types/node": "^22.19.2",
     "@types/pacote": "^11.1.8",
     "@vltpkg/benchmark": "0.0.0",
-    "@vltpkg/cache-unzip": "1.0.0-rc.25",
-    "@vltpkg/vlt-json": "1.0.0-rc.25",
+    "@vltpkg/cache-unzip": "1.0.0-rc.27",
+    "@vltpkg/vlt-json": "1.0.0-rc.27",
     "eslint": "^9.39.1",
     "pacote": "^21.0.4",
     "prettier": "^3.7.4",