npq 2.3.1 → 2.4.0

package/.github/mergify.yml

@@ -0,0 +1,17 @@
+queue_rules:
+  - name: Snyk PRs Queue
+    conditions:
+      - "check-success ~= .*"
+      
+pull_request_rules:
+  - name: Automatic merge Snyk PRs on Status Checks passing
+    conditions:
+      - title~=^\[Snyk\]
+      - head~=^snyk-fix
+      - base=main
+    actions:
+      queue:
+        name: "Snyk PRs Queue"
+      label:
+        add:
+          - "auto-merge"

package/__tests__/__fixtures__/test.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('../../lib/marshalls/baseMarshall')
 const MARSHALL_NAME = 'test.marshall'
 
 class TestMarshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'A test marshall'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.mockCheck(currPkg, ctx, task))
     }, [])
@@ -22,7 +22,7 @@ class TestMarshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  mockCheck (pkg, ctx, task) {
+  mockCheck(pkg, ctx, task) {
     return this.validateSomething(pkg)
       .then(() => {
         const data = 'mock data check'
@@ -39,7 +39,7 @@ class TestMarshall extends BaseMarshall {
       })
   }
 
-  validateSomething (pkg) {
+  validateSomething(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve()
     } else {
@@ -47,7 +47,7 @@ class TestMarshall extends BaseMarshall {
     }
   }
 
-  validate (pkg) {
+  validate(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve('validation-result')
     } else {

package/__tests__/marshalls.tasks.test.js

@@ -2,7 +2,7 @@ const path = require('path')
 const marshalls = require('../lib/marshalls')
 
 const PackageRepoUtilsMock = class Fake {
-  getPackageInfo () {
+  getPackageInfo() {
     return Promise.resolve(true)
   }
 }

package/lib/cliCommons.js

@@ -1,6 +1,6 @@
 const npa = require('npm-package-arg')
 class cliCommons {
-  static getInstallCommand () {
+  static getInstallCommand() {
     return {
       command: 'install [package...]',
       aliases: [
@@ -31,7 +31,7 @@ class cliCommons {
     }
   }
 
-  static getOptions () {
+  static getOptions() {
     return {
       P: {
         alias: ['save-prod', 'peer'],

package/lib/helpers/packageRepoUtils.js

@@ -6,17 +6,17 @@ const NPM_REGISTRY = 'http://registry.npmjs.org'
 const NPM_REGISTRY_API = 'https://api.npmjs.org'
 
 class PackageRepoUtils {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.registryUrl = options.registryUrl ? options.registryUrl : NPM_REGISTRY
     this.registryApiUrl = options.registryApiUrl ? options.registryApiUrl : NPM_REGISTRY_API
     this.pkgInfoCache = {}
   }
 
-  formatPackageForUrl (pkg) {
+  formatPackageForUrl(pkg) {
     return pkg.replace(/\//g, '%2F')
   }
 
-  getPackageInfo (pkg) {
+  getPackageInfo(pkg) {
     if (this.pkgInfoCache[pkg]) {
       return Promise.resolve(this.pkgInfoCache[pkg])
     } else {
@@ -29,27 +29,27 @@ class PackageRepoUtils {
     }
   }
 
-  getLatestVersion (pkg) {
+  getLatestVersion(pkg) {
     return this.getPackageInfo(pkg).then((data) => {
       return data['dist-tags'] && data['dist-tags']['latest'] ? data['dist-tags']['latest'] : null
     })
   }
 
-  getDownloadInfo (pkg) {
+  getDownloadInfo(pkg) {
     return fetch(`${this.registryApiUrl}/downloads/point/last-month/${pkg}`)
       .then((response) => response.json())
       .then(({ downloads }) => downloads)
   }
 
-  getReadmeInfo (pkg) {
+  getReadmeInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ readme }) => readme)
   }
 
-  getLicenseInfo (pkg) {
+  getLicenseInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ license }) => license)
   }
 
-  parsePackageVersion (version) {
+  parsePackageVersion(version) {
     return semver.coerce(version)
   }
 }

package/lib/marshall.js

@@ -12,12 +12,12 @@ const MESSAGE_TYPE = {
 }
 
 class Marshall {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.pkgs = options ? options.pkgs : null
     this.packageRepoUtils = new PackageRepoUtils()
   }
 
-  process () {
+  process() {
     // nothing to do? move on
     if (!this.pkgs) {
       return Promise.resolve()
@@ -37,7 +37,7 @@ class Marshall {
     })
   }
 
-  createPackageVersionMaps (packages) {
+  createPackageVersionMaps(packages) {
     const packageVersionMapping = packages.reduce((prev, curr) => {
       const versionSymbolPosition = curr.lastIndexOf('@')
       const versionPosition =
@@ -57,7 +57,7 @@ class Marshall {
     return packageVersionMapping
   }
 
-  report (marshalls) {
+  report(marshalls) {
     const messages = this.collectPackageMessages(marshalls)
 
     if (!messages) {
@@ -81,7 +81,7 @@ class Marshall {
     return { error: true, data: messages }
   }
 
-  collectPackageMessages (marshalls) {
+  collectPackageMessages(marshalls) {
     const allPackageMessages = {}
     for (const key in marshalls) {
       this.prepareMessages(allPackageMessages, marshalls[key].errors)
@@ -91,7 +91,7 @@ class Marshall {
     return allPackageMessages
   }
 
-  prepareMessages (allPackageMessages, messages, isWarning) {
+  prepareMessages(allPackageMessages, messages, isWarning) {
     if (Array.isArray(messages) && messages.length > 0) {
       messages.forEach((msg) => {
         this.appendPackageMessage(allPackageMessages, msg.pkg, {
@@ -102,7 +102,7 @@ class Marshall {
     }
   }
 
-  appendPackageMessage (packages, packageName, packageMessage) {
+  appendPackageMessage(packages, packageName, packageMessage) {
     packages[packageName]
       ? packages[packageName].push(packageMessage)
       : (packages[packageName] = [packageMessage])

package/lib/marshalls/age.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'age'
 const PACKAGE_AGE_THRESHOLD = 22 // specified in days
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package maturity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       if (data && data.time && data.time.created) {
         const pkgCreatedDate = data.time.created

package/lib/marshalls/author.marshall.js

@@ -7,16 +7,16 @@ const Warning = require('../helpers/warning')
 const MARSHALL_NAME = 'author'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package author...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         data.versions && data['dist-tags'] && data.versions[data['dist-tags']['latest']]

package/lib/marshalls/baseMarshall.js

@@ -3,11 +3,11 @@
 const Warning = require('../helpers/warning')
 
 class BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     this.packageRepoUtils = options.packageRepoUtils
   }
 
-  init (ctx, task) {
+  init(ctx, task) {
     this.ctx = ctx
     this.task = task
 
@@ -19,7 +19,7 @@ class BaseMarshall {
     }
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -27,7 +27,7 @@ class BaseMarshall {
     return Promise.all(tasks)
   }
 
-  checkPackage (pkg, ctx, task) {
+  checkPackage(pkg, ctx, task) {
     return this.validate(pkg)
       .then((data) => {
         task.output = `querying ${pkg.packageString}...`
@@ -37,30 +37,23 @@ class BaseMarshall {
         return data
       })
       .catch((err) => {
-        if (err instanceof Warning) {
-          this.setMessage(
-            {
-              pkg: pkg.packageString,
-              message: err.message
-            },
-            true
-          )
-        } else {
-          this.setMessage({
+        this.setMessage(
+          {
             pkg: pkg.packageString,
             message: err.message
-          })
-        }
+          },
+          Boolean(err instanceof Warning)
+        )
       })
   }
 
-  isEnabled () {
+  isEnabled() {
     const isMarshallSilent = process.env[`MARSHALL_DISABLE_${this.name.toUpperCase()}`] || false
 
     return !isMarshallSilent
   }
 
-  setMessage (msg, isWarning) {
+  setMessage(msg, isWarning) {
     const messages = isWarning
       ? this.ctx.marshalls[this.name].warnings
       : this.ctx.marshalls[this.name].errors
@@ -71,7 +64,7 @@ class BaseMarshall {
     })
   }
 
-  handleMessages () {
+  handleMessages() {
     const errors = this.ctx.marshalls[this.name].errors
     const warnings = this.ctx.marshalls[this.name].warnings
     if ((errors && errors.length) || (warnings && warnings.length)) {

package/lib/marshalls/downloads.marshall.js

@@ -6,16 +6,16 @@ const MARSHALL_NAME = 'downloads'
 const DOWNLOAD_COUNT_THRESHOLD = 20 // threshold per month
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package download popularity'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getDownloadInfo(pkg.packageName).then((downloadCount) => {
       if (downloadCount < DOWNLOAD_COUNT_THRESHOLD) {
         throw new Error(

package/lib/marshalls/expiredDomains.marshall.js

@@ -6,16 +6,16 @@ const dns = require('dns').promises
 const MARSHALL_NAME = 'maintainers_expired_emails'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Detecting expired domains for authors account...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils
       .getPackageInfo(pkg.packageName)
       .then((data) => {

package/lib/marshalls/index.js

@@ -4,7 +4,7 @@ const Listr = require('listr')
 const glob = require('glob')
 
 class Marshalls {
-  static collectMarshalls () {
+  static collectMarshalls() {
     return new Promise((resolve, reject) => {
       glob(
         this.GLOB_MARSHALLS,
@@ -23,7 +23,7 @@ class Marshalls {
     })
   }
 
-  static buildMarshallTasks (marshalls, config) {
+  static buildMarshallTasks(marshalls, config) {
     if (!marshalls || !Array.isArray(marshalls) || marshalls.length === 0) {
       return Promise.reject(new Error('unable to collect marshalls, or no marshalls found'))
     }
@@ -46,7 +46,7 @@ class Marshalls {
     return new Listr(marshallTasks, { exitOnError: false, concurrent: true })
   }
 
-  static tasks (options) {
+  static tasks(options) {
     return Marshalls.warmUpPackagesCache(options)
       .then(() => Marshalls.collectMarshalls())
       .then((marshalls) => {
@@ -59,7 +59,7 @@ class Marshalls {
       })
   }
 
-  static warmUpPackagesCache (options) {
+  static warmUpPackagesCache(options) {
     const fetchPackagesInfoPromises = []
     options.pkgs.forEach((packageMeta) => {
       fetchPackagesInfoPromises.push(
@@ -70,7 +70,7 @@ class Marshalls {
     return Promise.all(fetchPackagesInfoPromises)
   }
 
-  static runTasks (tasks, options) {
+  static runTasks(tasks, options) {
     return tasks.run({
       pkgs: options.pkgs,
       marshalls: {}

package/lib/marshalls/license.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'license'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a LICENSE'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getLicenseInfo(pkg.packageName).then((licenseContents) => {
       if (!licenseContents || licenseContents === 'ERROR: No LICENSE data found!') {
         throw new Error('package has no LICENSE file available')

package/lib/marshalls/readme.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'readme'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking availability of a README'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getReadmeInfo(pkg.packageName).then((readmeContents) => {
       if (!readmeContents || readmeContents === 'ERROR: No README data found!') {
         throw new Error('package has no README file available')

package/lib/marshalls/repo.marshall.js

@@ -6,16 +6,16 @@ const URL = require('url').URL
 const MARSHALL_NAME = 'repo'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Identifying package repository...'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const lastVersionData =
         (data.versions &&

package/lib/marshalls/scripts.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('./baseMarshall')
 const MARSHALL_NAME = 'scripts'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'Checking package for pre/post install scripts'
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return this.packageRepoUtils.getPackageInfo(pkg.packageName).then((data) => {
       const packageVersion =
         pkg.packageVersion === 'latest'

package/lib/marshalls/signatures.marshall.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const pacote = require('pacote')
+
+const MARSHALL_NAME = 'signatures'
+
+class Marshall extends BaseMarshall {
+  constructor(options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title() {
+    return 'Verifying registry signatures for package'
+  }
+
+  validate(pkg) {
+    // @TODO currently we're hardcoding the official npm registry
+    // this should however allow for local proxies and other registries
+    return this.fetchRegistryKeys()
+      .then((keys) => {
+        return pacote.manifest(`${pkg.packageName}@${pkg.packageVersion}`, {
+          verifySignatures: true,
+          registry: 'https://registry.npmjs.org',
+
+          [`//registry.npmjs.org/:_keys`]: keys
+        })
+      })
+      .then((metadata) => {
+        return metadata
+      })
+  }
+
+  fetchRegistryKeys() {
+    const registryHost = 'https://registry.npmjs.org'
+    const registryKeysEndpoint = '/-/npm/v1/keys'
+
+    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
+    // eslint-disable-next-line no-undef
+    return fetch(registryKeysUrl)
+      .then((response) => {
+        return response.json()
+      })
+      .then((response) => {
+        const registryKeys = response.keys
+
+        return registryKeys.map((key) => ({
+          ...key,
+          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
+        }))
+      })
+      .then((keys) => {
+        return keys
+      })
+      .catch((error) => {
+        throw new Error(`error fetching registry keys: ${error.message}`)
+      })
+  }
+}
+
+module.exports = Marshall

package/lib/marshalls/snyk.marshall.js

@@ -14,18 +14,18 @@ const SNYK_API_TOKEN = process.env.SNYK_TOKEN
 const SNYK_CONFIG_FILE = '.config/configstore/snyk.json'
 
 class Marshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
 
     this.snykApiToken = this.getSnykToken()
   }
 
-  title () {
+  title() {
     return 'Checking for known vulnerabilities'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.checkPackage(currPkg, ctx, task))
     }, [])
@@ -33,7 +33,7 @@ class Marshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  validate (pkg) {
+  validate(pkg) {
     return Promise.resolve()
       .then(() => {
         if (!pkg.packageVersion || pkg.packageVersion === 'latest') {
@@ -60,7 +60,7 @@ class Marshall extends BaseMarshall {
       })
   }
 
-  getSnykVulnInfoUnauthenticated ({ packageName, packageVersion }) {
+  getSnykVulnInfoUnauthenticated({ packageName, packageVersion }) {
     const url = encodeURI(`${SNYK_TEST_URL}/${packageName}/${packageVersion}?type=json`)
 
     return fetch(url)
@@ -77,7 +77,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykVulnInfo ({ packageName, packageVersion } = {}) {
+  getSnykVulnInfo({ packageName, packageVersion } = {}) {
     if (!this.snykApiToken) {
       return this.getSnykVulnInfoUnauthenticated({ packageName, packageVersion })
     }
@@ -102,7 +102,7 @@ class Marshall extends BaseMarshall {
       .catch(() => false)
   }
 
-  getSnykToken () {
+  getSnykToken() {
     if (SNYK_API_TOKEN) {
       return SNYK_API_TOKEN
     }

package/lib/packageManager.js

@@ -5,12 +5,12 @@ const childProcess = require('child_process')
 const DEFAULT_PKGMGR = 'npm'
 
 class packageManager {
-  static process (packageManagerOption) {
+  static process(packageManagerOption) {
     const detectedPackageManager = packageManager.validatePackageManager(packageManagerOption)
     return packageManager.spawnPackageManager(detectedPackageManager)
   }
 
-  static spawnPackageManager (packageManagerOption) {
+  static spawnPackageManager(packageManagerOption) {
     let args = []
 
     args = args.concat(process.argv.slice(2)).filter((item) => {
@@ -32,7 +32,7 @@ class packageManager {
     return Promise.resolve(child)
   }
 
-  static validatePackageManager (packageManagerOption) {
+  static validatePackageManager(packageManagerOption) {
     if (!packageManagerOption) {
       packageManagerOption = packageManager.getDefaultPackageManager()
     }
@@ -44,7 +44,7 @@ class packageManager {
     return packageManagerOption
   }
 
-  static getDefaultPackageManager () {
+  static getDefaultPackageManager() {
     return DEFAULT_PKGMGR
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "marshall your npm/yarn package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -191,6 +191,7 @@
     "listr": "^0.14.0",
     "node-fetch": "^2.6.7",
     "npm-package-arg": "^10.1.0",
+    "pacote": "^17.0.4",
     "semver": "^7.3.8",
     "update-notifier": "^5",
     "validator": "13.7.0",