npq 2.4.1 → 2.5.0

package/README.md

@@ -99,6 +99,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the `snyk` npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
 | expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
+| signatures | Will compare the package's signature as it shows on the registry's pakument with the keys published on the npmjs.com registry 
 
 ### Disabling Marshalls
 

package/__tests__/marshalls.signatures.test.js

@@ -0,0 +1,136 @@
+jest.mock('pacote', () => {
+  return {
+    // manifest method should be a promise that resolves to a value:
+    manifest: jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0'
+      // Add other relevant properties
+    })
+  }
+})
+
+const SignaturesMarshall = require('../lib/marshalls/signatures.marshall')
+const pacote = require('pacote')
+
+describe('Signature test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    expect(testMarshall.title()).toEqual('Verifying registry signatures for package')
+  })
+
+  test('should successfully validate a package with correct signature', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await testMarshall.validate(pkg)
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+
+    // Assert that the pacote.manifest method is called with the correct arguments
+    expect(pacote.manifest).toHaveBeenCalledWith('packageName@1.0.0', {
+      verifySignatures: true,
+      registry: 'https://registry.npmjs.org',
+      '//registry.npmjs.org/:_keys': [
+        {
+          key: 'publicKey1',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey1\n-----END PUBLIC KEY-----'
+        },
+        {
+          key: 'publicKey2',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey2\n-----END PUBLIC KEY-----'
+        }
+      ]
+    })
+  })
+
+  test('should throw an error if keys dont match and manifest() throws an error', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+
+    // the manifest() method should throw an error
+    // in this jest mock to simulate a problem:
+    pacote.manifest = jest.fn().mockRejectedValue(new Error('mocked manifest error'))
+
+    const testMarshall = new SignaturesMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+})

package/lib/marshalls/provenance.marshall.js

@@ -0,0 +1,78 @@
+'use strict'
+
+const BaseMarshall = require('./baseMarshall')
+const pacote = require('pacote')
+
+const MARSHALL_NAME = 'provenance'
+
+class Marshall extends BaseMarshall {
+  constructor (options) {
+    super(options)
+    this.name = MARSHALL_NAME
+  }
+
+  title () {
+    return 'Verifying package provenance'
+  }
+
+  validate (pkg) {
+    const validationMetadata = {}
+
+    return this.packageRepoUtils
+      .getPackageInfo(pkg.packageName)
+      .then((packageInfo) => {
+        const packageName = packageInfo.name
+        const packageVersion =
+          pkg.packageVersion === 'latest'
+            ? packageInfo['dist-tags'] && packageInfo['dist-tags']['latest']
+            : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
+
+        validationMetadata.name = packageName
+        validationMetadata.version = packageVersion
+      })
+      .then(() => {
+        return this.fetchRegistryKeys()
+      })
+      .then((keys) => {
+        // @TODO currently we're hardcoding the official npm registry
+        // this should however allow for local proxies and other registries
+        return pacote.manifest(`${validationMetadata.name}@${validationMetadata.version}`, {
+          verifyAttestations: true,
+          registry: 'https://registry.npmjs.org',
+
+          [`//registry.npmjs.org/:_keys`]: keys
+        })
+      })
+      .then((metadata) => {
+        return metadata
+      })
+  }
+
+  fetchRegistryKeys () {
+    const registryHost = 'https://registry.npmjs.org'
+    const registryKeysEndpoint = '/-/npm/v1/keys'
+
+    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
+    // eslint-disable-next-line no-undef
+    return fetch(registryKeysUrl)
+      .then((response) => {
+        return response.json()
+      })
+      .then((response) => {
+        const registryKeys = response.keys
+
+        return registryKeys.map((key) => ({
+          ...key,
+          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
+        }))
+      })
+      .then((keys) => {
+        return keys
+      })
+      .catch((error) => {
+        throw new Error(`error fetching registry keys: ${error.message}`)
+      })
+  }
+}
+
+module.exports = Marshall

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",