npq 2.5.1 → 2.5.3

package/__tests__/marshalls.provenance.test.js

@@ -0,0 +1,209 @@
+jest.mock('pacote')
+jest.mock('node-fetch')
+
+const fetch = require('node-fetch')
+
+const ProvenanceMarshall = require('../lib/marshalls/provenance.marshall')
+const pacote = require('pacote')
+
+describe('Provenance test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    expect(testMarshall.title()).toEqual('Verifying package provenance')
+  })
+
+  test('should successfully validate a package with verified attestations', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0',
+      _attestations: {
+        url: 'https://registry.npmjs.org/-/npm/v1/attestations/pacote@17.0.4',
+        provenance: { predicateType: 'https://slsa.dev/provenance/v1' }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await testMarshall.validate(pkg)
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+
+    // Assert that the pacote.manifest method is called with the correct arguments
+    expect(pacote.manifest).toHaveBeenCalledWith('packageName@1.0.0', {
+      verifyAttestations: true,
+      registry: 'https://registry.npmjs.org',
+      '//registry.npmjs.org/:_keys': [
+        {
+          key: 'publicKey1',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey1\n-----END PUBLIC KEY-----'
+        },
+        {
+          key: 'publicKey2',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey2\n-----END PUBLIC KEY-----'
+        }
+      ]
+    })
+  })
+
+  test('should throw an error if attestation verification fails and manifest() throws an error', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // the manifest() method should throw an error
+    // in this jest mock to simulate a problem:
+    pacote.manifest = jest.fn().mockRejectedValue(new Error('mocked manifest error'))
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+
+  test('should throw a warning if attestations cant be found for the package', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0'
+    })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow(
+      'the package was published without any attestations. Proceed with care.'
+    )
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+})

package/__tests__/marshalls.signatures.test.js

@@ -9,6 +9,10 @@ jest.mock('pacote', () => {
   }
 })
 
+jest.mock('node-fetch')
+
+const fetch = require('node-fetch')
+
 const SignaturesMarshall = require('../lib/marshalls/signatures.marshall')
 const pacote = require('pacote')
 
@@ -46,7 +50,7 @@ describe('Signature test suites', () => {
         ]
       })
     }
-    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
 
     const testMarshall = new SignaturesMarshall({
       packageRepoUtils: {
@@ -103,7 +107,7 @@ describe('Signature test suites', () => {
         ]
       })
     }
-    global.fetch = jest.fn().mockResolvedValue(mockResponse)
+    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
 
     // the manifest() method should throw an error
     // in this jest mock to simulate a problem:

package/lib/marshalls/provenance.marshall.js

@@ -1,7 +1,9 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const fetch = require('node-fetch')
 const pacote = require('pacote')
+const Warning = require('../helpers/warning')
 
 const MARSHALL_NAME = 'provenance'
 
@@ -44,7 +46,15 @@ class Marshall extends BaseMarshall {
         })
       })
       .then((metadata) => {
-        return metadata
+        if (!metadata || !metadata._attestations) {
+          throw new Warning(
+            'the package was published without any attestations. Proceed with care.'
+          )
+        }
+
+        const attestations = metadata._attestations
+
+        return attestations
       })
   }
 

package/lib/marshalls/signatures.marshall.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const BaseMarshall = require('./baseMarshall')
+const fetch = require('node-fetch')
 const pacote = require('pacote')
 
 const MARSHALL_NAME = 'signatures'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",