npq 2.3.1 → 2.4.1

package/.github/mergify.yml

@@ -0,0 +1,17 @@
+queue_rules:
+  - name: Snyk PRs Queue
+    conditions:
+      - "check-success ~= .*"
+      
+pull_request_rules:
+  - name: Automatic merge Snyk PRs on Status Checks passing
+    conditions:
+      - title~=^\[Snyk\]
+      - head~=^snyk-fix
+      - base=main
+    actions:
+      queue:
+        name: "Snyk PRs Queue"
+      label:
+        add:
+          - "auto-merge"

package/.github/workflows/main.yml

@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         platform: [ubuntu-latest]
-        node: ['12', '14', '16', '18']
+        node: ['18', '20']
     name: Node ${{ matrix.node }} (${{ matrix.platform }})
     runs-on: ${{ matrix.platform }}
     steps:
@@ -16,13 +16,13 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - name: install dependencies
-        run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
+        run: npm ci --ignore-engines --ignore-scripts
       - name: lint code
-        run: yarn run lint
+        run: npm run lint
         env:
           CI: true
       - name: run tests
-        run: yarn run test
+        run: npm run test
         env:
           CI: true
       - name: coverage
@@ -50,9 +50,9 @@ jobs:
         with:
           node-version: '18'
       - name: install dependencies
-        run: yarn install --frozen-lockfile --ignore-engines --ignore-scripts
+        run: npm ci --ignore-engines --ignore-scripts
       - name: release
-        run: yarn run semantic-release
+        run: npm run semantic-release
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           NPM_TOKEN: ${{secrets.NPM_TOKEN}}

package/lib/marshalls/baseMarshall.js

@@ -37,20 +37,13 @@ class BaseMarshall {
         return data
       })
       .catch((err) => {
-        if (err instanceof Warning) {
-          this.setMessage(
-            {
-              pkg: pkg.packageString,
-              message: err.message
-            },
-            true
-          )
-        } else {
-          this.setMessage({
+        this.setMessage(
+          {
             pkg: pkg.packageString,
             message: err.message
-          })
-        }
+          },
+          Boolean(err instanceof Warning)
+        )
       })
   }
 

package/lib/marshalls/signatures.marshall.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const pacote = require('pacote')
+
+const MARSHALL_NAME = 'signatures'
+
+class Marshall extends BaseMarshall {
+  constructor (options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title () {
+    return 'Verifying registry signatures for package'
+  }
+
+  validate (pkg) {
+    // @TODO currently we're hardcoding the official npm registry
+    // this should however allow for local proxies and other registries
+    return this.fetchRegistryKeys()
+      .then((keys) => {
+        return pacote.manifest(`${pkg.packageName}@${pkg.packageVersion}`, {
+          verifySignatures: true,
+          registry: 'https://registry.npmjs.org',
+
+          [`//registry.npmjs.org/:_keys`]: keys
+        })
+      })
+      .then((metadata) => {
+        return metadata
+      })
+  }
+
+  fetchRegistryKeys () {
+    const registryHost = 'https://registry.npmjs.org'
+    const registryKeysEndpoint = '/-/npm/v1/keys'
+
+    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
+    // eslint-disable-next-line no-undef
+    return fetch(registryKeysUrl)
+      .then((response) => {
+        return response.json()
+      })
+      .then((response) => {
+        const registryKeys = response.keys
+
+        return registryKeys.map((key) => ({
+          ...key,
+          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
+        }))
+      })
+      .then((keys) => {
+        return keys
+      })
+      .catch((error) => {
+        throw new Error(`error fetching registry keys: ${error.message}`)
+      })
+  }
+}
+
+module.exports = Marshall

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "npq",
-  "version": "2.3.1",
-  "description": "marshall your npm/yarn package installs with high quality and class 🎖",
+  "version": "2.4.1",
+  "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
     "npq-hero": "./bin/npq-hero.js"
   },
   "scripts": {
-    "lint": "standard --fix && eslint . --ignore-path .gitignore && yarn run lint:lockfile",
-    "lint:lockfile": "lockfile-lint --path yarn.lock --type yarn --validate-https --allowed-hosts npm yarn",
+    "lint": "standard --fix && eslint . --ignore-path .gitignore && npm run lint:lockfile",
+    "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm npm",
     "test": "jest",
     "test:watch": "jest --watch",
     "coverage:view": "opn coverage/lcov-report/index.html",
     "commit": "git-cz",
     "format": "prettier --config .prettierrc.js --write '**/*.js'",
-    "docs": "yarn run docs:code && yarn run docs:api",
+    "docs": "npm run docs:code && npm run docs:api",
     "docs:api": "doxdox *.js --layout bootstrap --output docs/index.html",
     "docs:code": "docco *.js --output docs/code",
     "semantic-release": "semantic-release",
@@ -44,8 +44,6 @@
     "@commitlint/config-angular": "^8.0.0",
     "commitizen": "^3.0.0",
     "cz-conventional-changelog": "^2.1.0",
-    "docco": "^0.7.0",
-    "doxdox": "^3.0.0",
     "eslint": "^5.0.0",
     "eslint-plugin-import": "^2.2.0",
     "eslint-plugin-node": "^8.0.0",
@@ -53,7 +51,7 @@
     "husky": "^3.0.0",
     "jest": "^24.9.0",
     "lint-staged": "^13.1.0",
-    "lockfile-lint": "^2.0.1",
+    "lockfile-lint": "^4.12.1",
     "opn-cli": "^4.0.0",
     "prettier": "^2.8.3",
     "semantic-release": "21.0.2",
@@ -99,10 +97,10 @@
     "hooks": {
       "commit-msg": "commitlint --env HUSKY_GIT_PARAMS",
       "pre-commit": "lint-staged",
-      "pre-push": "yarn run lint && yarn run test",
+      "pre-push": "npm run lint && npm run test",
       "post-commit": "git status",
       "post-checkout": "git status",
-      "post-merge": "yarn install"
+      "post-merge": "npm install"
     }
   },
   "commitlint": {
@@ -112,8 +110,8 @@
   },
   "lint-staged": {
     "**/*.js": [
-      "yarn run format",
-      "yarn run lint",
+      "npm run format",
+      "npm run lint",
       "git add"
     ]
   },
@@ -191,6 +189,7 @@
     "listr": "^0.14.0",
     "node-fetch": "^2.6.7",
     "npm-package-arg": "^10.1.0",
+    "pacote": "^17.0.4",
     "semver": "^7.3.8",
     "update-notifier": "^5",
     "validator": "13.7.0",