@vltpkg/security-archive 1.3.8 → 1.4.0

package/dist/index.d.ts

@@ -3,19 +3,6 @@ import type { DepID } from '@vltpkg/dep-id';
 import type { PackageReportData, SecurityArchiveLike, SecurityArchiveRefreshOptions } from './types.ts';
 export * from './types.ts';
 export { npmRegistryURL, usesNpmRegistry } from './browser.ts';
-export type JSONItemResponse = {
-    namespace?: `@{string}`;
-    name: string;
-    version: string;
-    score: {
-        overall: number;
-        license: number;
-        maintenance: number;
-        quality: number;
-        supplyChain: number;
-        vulnerability: number;
-    };
-};
 export type DBReadEntry = {
     depID: string;
     now: number;

package/dist/index.js

@@ -9,7 +9,7 @@ import { asDepID, baseDepID } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
 import { userAgent } from '@vltpkg/user-agent';
 import { XDG } from '@vltpkg/xdg';
-import { asPackageReportData } from "./types.js";
+import { asPackageReportData, getItemScore } from "./types.js";
 import { __CODE_SPLIT_SCRIPT_NAME } from "./update-expired.js";
 import { usesNpmRegistry } from "./browser.js";
 export * from "./types.js";
@@ -270,30 +270,25 @@ export class SecurityArchive extends LRUCache {
             if (!line.trim())
                 continue;
             const data = JSON.parse(line + '}');
+            // skip the purlError and summary wrapper items the API may
+            // include in the stream, they do not describe a package
+            if (data._type)
+                continue;
             const scope = data.namespace ? `${data.namespace}/` : '';
             const name = `${scope}${data.name}`;
-            const node = this.#retrieveNodeByNameVersion(name, data.version);
+            const node = this.#retrieveNodeByNameVersion(name, String(data.version));
             if (node) {
+                const score = getItemScore(data);
+                // a package that socket.dev has not finished analyzing yet
+                // comes back without a score, leave it out of the archive so
+                // that it gets requested again on the next run
+                if (!score)
+                    continue;
                 const normalizedId = baseDepID(node.id);
-                fetchedDepIDs.add(baseDepID(node.id));
-                // Calculate average score from all score components
-                const scoreComponents = [
-                    data.score.license,
-                    data.score.maintenance,
-                    data.score.quality,
-                    data.score.supplyChain,
-                    data.score.vulnerability,
-                ];
-                const newAverageScore = Number((scoreComponents.reduce((sum, score) => sum + score, 0) /
-                    scoreComponents.length).toFixed(2));
-                // Add average score to the score object
-                const scoreWithNewAverage = {
-                    ...data.score,
-                    overall: newAverageScore,
-                };
+                fetchedDepIDs.add(normalizedId);
                 this.set(normalizedId, asPackageReportData({
                     ...data,
-                    score: scoreWithNewAverage,
+                    score,
                 }));
             }
             else {

package/dist/types.d.ts

@@ -89,3 +89,30 @@ export type PackageReportData = {
 };
 export declare const isPackageReportData: (o: unknown) => o is PackageReportData;
 export declare const asPackageReportData: (o: unknown) => PackageReportData;
+/**
+ * A single line of the NDJSON stream returned by the socket.dev
+ * batch purl API. Besides package artifacts, the stream can carry
+ * `purlError` and `summary` wrapper items, and a package that was
+ * published recently enough to not have been analyzed yet comes back
+ * as an artifact with no `score` object at all.
+ */
+export type JSONItemResponse = {
+    _type?: 'purlError' | 'summary';
+    namespace?: `@${string}`;
+    name?: string;
+    version?: string;
+    score?: {
+        overall?: number;
+        license: number;
+        maintenance: number;
+        quality: number;
+        supplyChain: number;
+        vulnerability: number;
+    };
+};
+/**
+ * Returns the score of a response item with its `overall` value
+ * recalculated as the average of the individual components, or
+ * `undefined` when the item is not a scored package artifact.
+ */
+export declare const getItemScore: (data: JSONItemResponse) => PackageScore | undefined;

package/dist/types.js

@@ -27,3 +27,23 @@ export const asPackageReportData = (o) => {
     }
     return o;
 };
+/**
+ * Returns the score of a response item with its `overall` value
+ * recalculated as the average of the individual components, or
+ * `undefined` when the item is not a scored package artifact.
+ */
+export const getItemScore = (data) => {
+    if (data._type || !data.score)
+        return undefined;
+    const { license, maintenance, quality, supplyChain, vulnerability, } = data.score;
+    const scoreComponents = [
+        license,
+        maintenance,
+        quality,
+        supplyChain,
+        vulnerability,
+    ];
+    const overall = Number((scoreComponents.reduce((sum, score) => sum + score, 0) /
+        scoreComponents.length).toFixed(2));
+    return { ...data.score, overall };
+};

package/dist/update-expired.js

@@ -6,7 +6,7 @@ import pRetry, { AbortError } from 'p-retry';
 import { asDepID, baseDepID } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
 import { userAgent } from '@vltpkg/user-agent';
-import { asPackageReportData } from "./types.js";
+import { asPackageReportData, getItemScore } from "./types.js";
 export const __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
 const SOCKET_API_V0_URL = 'https://api.socket.dev/v0/purl?alerts=true';
 const SOCKET_PUBLIC_API_TOKEN = 'sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api';
@@ -91,6 +91,10 @@ export const main = async (input = process.stdin) => {
         if (!line.trim())
             continue;
         const data = JSON.parse(line + '}');
+        // skip the purlError and summary wrapper items the API may
+        // include in the stream, they do not describe a package
+        if (data._type)
+            continue;
         const scope = data.namespace ? `${data.namespace}/` : '';
         const name = `${scope}${data.name}`;
         const key = `${name}@${data.version}`;
@@ -100,19 +104,15 @@ export const main = async (input = process.stdin) => {
             console.warn(`security-archive: failed to find entry for ${key} found in the response.`);
             continue;
         }
-        // Calculate average score from all score components
-        const scoreComponents = [
-            data.score.license,
-            data.score.maintenance,
-            data.score.quality,
-            data.score.supplyChain,
-            data.score.vulnerability,
-        ];
-        const newAverageScore = Number((scoreComponents.reduce((sum, score) => sum + score, 0) /
-            scoreComponents.length).toFixed(2));
+        const score = getItemScore(data);
+        // a package that socket.dev has not finished analyzing yet comes
+        // back without a score, keep the stale entry rather than replacing
+        // it with an invalid one
+        if (!score)
+            continue;
         const reportData = asPackageReportData({
             ...data,
-            score: { ...data.score, overall: newAverageScore },
+            score,
         });
         results.push({
             depID: baseDepID(asDepID(entry.depID)),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/security-archive",
   "description": "A database of security information of packages",
-  "version": "1.3.8",
+  "version": "1.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,12 +13,12 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.3.8",
-    "@vltpkg/error-cause": "1.3.8",
-    "@vltpkg/spec": "1.3.8",
-    "@vltpkg/types": "1.3.8",
-    "@vltpkg/user-agent": "1.3.8",
-    "@vltpkg/xdg": "1.3.8",
+    "@vltpkg/dep-id": "1.4.0",
+    "@vltpkg/error-cause": "1.4.0",
+    "@vltpkg/spec": "1.4.0",
+    "@vltpkg/types": "1.4.0",
+    "@vltpkg/user-agent": "1.4.0",
+    "@vltpkg/xdg": "1.4.0",
     "lru-cache": "^11.2.4",
     "p-retry": "^7.1.1"
   },