npq 2.5.2 → 3.0.0

package/.github/workflows/main.yml

@@ -52,7 +52,7 @@ jobs:
       - name: install dependencies
         run: npm ci --ignore-engines --ignore-scripts
       - name: release
-        run: npm run semantic-release
+        run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           NPM_TOKEN: ${{secrets.NPM_TOKEN}}

package/.husky/commit-msg

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npx commitlint --edit $1

package/.husky/post-merge

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npm install

package/.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npx lint-staged

package/.husky/pre-push

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npm run lint && npm run test

package/__tests__/__fixtures__/test.marshall.js

@@ -5,16 +5,16 @@ const BaseMarshall = require('../../lib/marshalls/baseMarshall')
 const MARSHALL_NAME = 'test.marshall'
 
 class TestMarshall extends BaseMarshall {
-  constructor (options) {
+  constructor(options) {
     super(options)
     this.name = MARSHALL_NAME
   }
 
-  title () {
+  title() {
     return 'A test marshall'
   }
 
-  run (ctx, task) {
+  run(ctx, task) {
     const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
       return prevPkg.concat(this.mockCheck(currPkg, ctx, task))
     }, [])
@@ -22,7 +22,7 @@ class TestMarshall extends BaseMarshall {
     return Promise.all(tasks)
   }
 
-  mockCheck (pkg, ctx, task) {
+  mockCheck(pkg, ctx, task) {
     return this.validateSomething(pkg)
       .then(() => {
         const data = 'mock data check'
@@ -33,13 +33,13 @@ class TestMarshall extends BaseMarshall {
       })
       .catch((err) => {
         this.setMessage({
-          pkg: pkg,
+          pkg,
           message: err.message
         })
       })
   }
 
-  validateSomething (pkg) {
+  validateSomething(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve()
     } else {
@@ -47,7 +47,7 @@ class TestMarshall extends BaseMarshall {
     }
   }
 
-  validate (pkg) {
+  validate(pkg) {
     if (pkg === 'express' || pkg === 'semver') {
       return Promise.resolve('validation-result')
     } else {

package/__tests__/marshalls.classMethods.test.js

@@ -2,15 +2,15 @@ beforeEach(() => {
   jest.resetModules()
 })
 
+jest.mock('glob', () => {
+  return {
+    glob: jest.fn().mockResolvedValue(['file1', 'file2'])
+  }
+})
+
 test('collecting marshalls resolves with files array', async () => {
   const marshalls = require('../lib/marshalls')
 
-  jest.mock('glob', () => {
-    return jest.fn((pattern, options, callback) => {
-      return callback(null, ['file1', 'file2'])
-    })
-  })
-
   const marshallFiles = await marshalls.collectMarshalls()
   expect(marshallFiles).toEqual(['file1', 'file2'])
 })
@@ -19,9 +19,9 @@ test('collecting marshalls resolves with error if unable to process files', () =
   const marshalls = require('../lib/marshalls')
 
   jest.mock('glob', () => {
-    return jest.fn((pattern, options, callback) => {
-      return callback(new Error('some error'), null)
-    })
+    return {
+      glob: jest.fn().mockRejectedValue(new Error('error'))
+    }
   })
 
   expect(marshalls.collectMarshalls()).rejects.toEqual(expect.any(Error))

package/__tests__/marshalls.provenance.test.js

@@ -0,0 +1,206 @@
+jest.mock('pacote')
+
+const ProvenanceMarshall = require('../lib/marshalls/provenance.marshall')
+const pacote = require('pacote')
+
+describe('Provenance test suites', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetAllMocks()
+  })
+
+  test('has the right title', async () => {
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve(pkgInfo)
+          })
+        }
+      }
+    })
+
+    expect(testMarshall.title()).toEqual('Verifying package provenance')
+  })
+
+  test('should successfully validate a package with verified attestations', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0',
+      _attestations: {
+        url: 'https://registry.npmjs.org/-/npm/v1/attestations/pacote@17.0.4',
+        provenance: { predicateType: 'https://slsa.dev/provenance/v1' }
+      }
+    })
+
+    // Call the validate method with a package object
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await testMarshall.validate(pkg)
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+
+    // Assert that the pacote.manifest method is called with the correct arguments
+    expect(pacote.manifest).toHaveBeenCalledWith('packageName@1.0.0', {
+      verifyAttestations: true,
+      registry: 'https://registry.npmjs.org',
+      '//registry.npmjs.org/:_keys': [
+        {
+          key: 'publicKey1',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey1\n-----END PUBLIC KEY-----'
+        },
+        {
+          key: 'publicKey2',
+          pemkey: '-----BEGIN PUBLIC KEY-----\npublicKey2\n-----END PUBLIC KEY-----'
+        }
+      ]
+    })
+  })
+
+  test('should throw an error if attestation verification fails and manifest() throws an error', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    // the manifest() method should throw an error
+    // in this jest mock to simulate a problem:
+    pacote.manifest = jest.fn().mockRejectedValue(new Error('mocked manifest error'))
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow('mocked manifest error')
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+
+  test('should throw a warning if attestations cant be found for the package', async () => {
+    // Mock the response from fetch
+    const mockResponse = {
+      json: jest.fn().mockResolvedValue({
+        keys: [
+          {
+            key: 'publicKey1'
+          },
+          {
+            key: 'publicKey2'
+          }
+        ]
+      })
+    }
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve(mockResponse))
+
+    const pkg = {
+      packageName: 'packageName',
+      packageVersion: '1.0.0'
+    }
+
+    pacote.manifest = jest.fn().mockResolvedValue({
+      name: 'packageName',
+      version: '1.0.0'
+    })
+
+    const testMarshall = new ProvenanceMarshall({
+      packageRepoUtils: {
+        getPackageInfo: (pkgInfo) => {
+          return new Promise((resolve) => {
+            resolve({
+              name: pkg.packageName,
+              version: pkg.packageVersion
+            })
+          })
+        },
+        parsePackageVersion: (pkgVersion) => {
+          return {
+            version: pkgVersion
+          }
+        }
+      }
+    })
+
+    // We assert that the validate method didn't throw an error,
+    // because the keys match the signature
+    await expect(testMarshall.validate(pkg)).rejects.toThrow(
+      'the package was published without any attestations. Proceed with care.'
+    )
+
+    // Assert that the fetch method is called with the correct URL
+    // eslint-disable-next-line no-undef
+    expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/-/npm/v1/keys')
+  })
+})

package/__tests__/marshalls.repo.test.js

@@ -1,7 +1,4 @@
 const RepoMarshall = require('../lib/marshalls/repo.marshall')
-const fetch = require('node-fetch')
-
-jest.mock('node-fetch')
 
 const testMarshall = new RepoMarshall({
   packageRepoUtils: {
@@ -81,7 +78,7 @@ describe('Repo test suites', () => {
   })
 
   test('throws the right error when the repository url does not exist', async () => {
-    fetch.mockImplementationOnce(() => Promise.reject(new Error('error')))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.reject(new Error('error')))
 
     await expect(testMarshall.validate(fullPkgData)).rejects.toThrow(
       'no valid repository is associated with the package'
@@ -89,7 +86,7 @@ describe('Repo test suites', () => {
   })
 
   test('throws the right error when the repository url is unreachable', async () => {
-    fetch.mockImplementationOnce(() => Promise.reject(new Error('error')))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.reject(new Error('error')))
 
     fullPkgData.packageName.versions['1.0.0'].repository.url =
       'https://dsfsdfsdfs.abcdeugwecwekjasda.com/'
@@ -99,7 +96,7 @@ describe('Repo test suites', () => {
   })
 
   test('throws the right error when the homepage url does not exist', async () => {
-    fetch.mockImplementationOnce(() => Promise.reject(new Error('error')))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.reject(new Error('error')))
 
     const pkgData = {
       packageName: {
@@ -121,7 +118,7 @@ describe('Repo test suites', () => {
   })
 
   test('does not throw any errors if the url exists', async () => {
-    fetch.mockImplementationOnce(() => Promise.resolve('success'))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve('success'))
 
     fullPkgData.packageName.versions['1.0.0'].repository.url = 'https://google.com'
     await expect(testMarshall.validate(fullPkgData)).resolves.toEqual(expect.anything())

package/__tests__/marshalls.signatures.test.js

@@ -9,10 +9,6 @@ jest.mock('pacote', () => {
   }
 })
 
-jest.mock('node-fetch')
-
-const fetch = require('node-fetch')
-
 const SignaturesMarshall = require('../lib/marshalls/signatures.marshall')
 const pacote = require('pacote')
 
@@ -50,7 +46,7 @@ describe('Signature test suites', () => {
         ]
       })
     }
-    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve(mockResponse))
 
     const testMarshall = new SignaturesMarshall({
       packageRepoUtils: {
@@ -107,7 +103,7 @@ describe('Signature test suites', () => {
         ]
       })
     }
-    fetch.mockImplementationOnce(() => Promise.resolve(mockResponse))
+    global.fetch = jest.fn().mockImplementationOnce(() => Promise.resolve(mockResponse))
 
     // the manifest() method should throw an error
     // in this jest mock to simulate a problem:

package/__tests__/marshalls.tasks.test.js

@@ -2,7 +2,7 @@ const path = require('path')
 const marshalls = require('../lib/marshalls')
 
 const PackageRepoUtilsMock = class Fake {
-  getPackageInfo () {
+  getPackageInfo() {
     return Promise.resolve(true)
   }
 }
@@ -53,6 +53,6 @@ test('running marshall tasks fails', async () => {
 
   await expect(marshalls.tasks(config)).rejects.toMatchObject({
     message: 'Something went wrong',
-    context: context
+    context
   })
 })

package/__tests__/packageManager.test.js

@@ -1,5 +1,5 @@
 const packageManager = require('../lib/packageManager')
-// eslint-disable-next-line security/detect-child-process
+
 const childProcess = require('child_process')
 
 jest.mock('child_process', () => {

package/__tests__/packageRepoUtils.test.js

@@ -1,8 +1,6 @@
 const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-const fetch = require('node-fetch')
 
-jest.mock('node-fetch')
-fetch.mockImplementation(() =>
+global.fetch = jest.fn().mockImplementation(() =>
   Promise.resolve({
     json: () => require('./mocks/registryPackageOk.mock.json')
   })
@@ -64,7 +62,7 @@ test('repo utils retrieves package README information', async () => {
 
 test('repo utils retrieves package latest version as null if not exists', async () => {
   const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-  fetch.mockReturnValue(
+  global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       json: () => require('./mocks/registryPackageUnpublished.mock.json')
     })
@@ -78,7 +76,7 @@ test('repo utils retrieves package latest version as null if not exists', async
 
 test('repo utils retrieves package download count', async () => {
   const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-  fetch.mockReturnValue(
+  global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       json: () => ({
         downloads: 1950,
@@ -97,7 +95,7 @@ test('repo utils retrieves package download count', async () => {
 
 test('repo utils retrieves package README information even when not available', async () => {
   const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-  fetch.mockReturnValue(
+  global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       json: () => require('./mocks/registryPackageUnpublished.mock.json')
     })
@@ -111,7 +109,7 @@ test('repo utils retrieves package README information even when not available',
 
 test('repo utils retrieves package LICENSE information', async () => {
   const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-  fetch.mockReturnValue(
+  global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       json: () => require('./mocks/registryPackageOk.mock.json')
     })
@@ -125,7 +123,7 @@ test('repo utils retrieves package LICENSE information', async () => {
 
 test('repo utils parses package version', async () => {
   const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
-  fetch.mockReturnValue(
+  global.fetch = jest.fn().mockImplementation(() =>
     Promise.resolve({
       json: () => require('./mocks/registryPackageOk.mock.json')
     })

package/lib/cliCommons.js

@@ -1,6 +1,6 @@
 const npa = require('npm-package-arg')
 class cliCommons {
-  static getInstallCommand () {
+  static getInstallCommand() {
     return {
       command: 'install [package...]',
       aliases: [
@@ -31,7 +31,7 @@ class cliCommons {
     }
   }
 
-  static getOptions () {
+  static getOptions() {
     return {
       P: {
         alias: ['save-prod', 'peer'],

package/lib/helpers/cliSupportHandler.js

@@ -1,18 +1,14 @@
 'use strict'
 
-const chalk = require('chalk')
+const color = require('kleur')
 // eslint-disable-next-line security/detect-child-process
 const childProcess = require('child_process')
 const semver = require('semver')
-const updateNotifier = require('update-notifier')
-const pkg = require('../../package.json')
 
 const DEFAULT_PKGMGR = process.env.NPQ_PKG_MGR || 'npm'
 
 const nodeVersion = process.versions.node
 
-updateNotifier({ pkg }).notify()
-
 module.exports.isEnvSupport = function () {
   if (!semver.satisfies(nodeVersion, '>=7.6.0')) {
     return false
@@ -23,7 +19,7 @@ module.exports.isEnvSupport = function () {
 
 module.exports.noSupportError = function (failFast) {
   // eslint-disable-next-line no-console
-  console.error(chalk.red('error:'), 'npq suppressed due to old node version')
+  console.error(color.red('error:'), 'npq suppressed due to old node version')
 
   if (failFast === true) {
     process.exit(-1)

package/lib/helpers/packageRepoUtils.js

@@ -1,22 +1,21 @@
 'use strict'
 
-const fetch = require('node-fetch')
 const semver = require('semver')
 const NPM_REGISTRY = 'http://registry.npmjs.org'
 const NPM_REGISTRY_API = 'https://api.npmjs.org'
 
 class PackageRepoUtils {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.registryUrl = options.registryUrl ? options.registryUrl : NPM_REGISTRY
     this.registryApiUrl = options.registryApiUrl ? options.registryApiUrl : NPM_REGISTRY_API
     this.pkgInfoCache = {}
   }
 
-  formatPackageForUrl (pkg) {
+  formatPackageForUrl(pkg) {
     return pkg.replace(/\//g, '%2F')
   }
 
-  getPackageInfo (pkg) {
+  getPackageInfo(pkg) {
     if (this.pkgInfoCache[pkg]) {
       return Promise.resolve(this.pkgInfoCache[pkg])
     } else {
@@ -29,27 +28,27 @@ class PackageRepoUtils {
     }
   }
 
-  getLatestVersion (pkg) {
+  getLatestVersion(pkg) {
     return this.getPackageInfo(pkg).then((data) => {
-      return data['dist-tags'] && data['dist-tags']['latest'] ? data['dist-tags']['latest'] : null
+      return data['dist-tags'] && data['dist-tags'].latest ? data['dist-tags'].latest : null
     })
   }
 
-  getDownloadInfo (pkg) {
+  getDownloadInfo(pkg) {
     return fetch(`${this.registryApiUrl}/downloads/point/last-month/${pkg}`)
       .then((response) => response.json())
       .then(({ downloads }) => downloads)
   }
 
-  getReadmeInfo (pkg) {
+  getReadmeInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ readme }) => readme)
   }
 
-  getLicenseInfo (pkg) {
+  getLicenseInfo(pkg) {
     return this.getPackageInfo(pkg).then(({ license }) => license)
   }
 
-  parsePackageVersion (version) {
+  parsePackageVersion(version) {
     return semver.coerce(version)
   }
 }

package/lib/marshall.js

@@ -1,7 +1,7 @@
 /* eslint-disable no-console */
 'use strict'
 
-const chalk = require('chalk')
+const color = require('kleur')
 
 const Marshalls = require('./marshalls')
 const PackageRepoUtils = require('./helpers/packageRepoUtils')
@@ -12,12 +12,12 @@ const MESSAGE_TYPE = {
 }
 
 class Marshall {
-  constructor (options = {}) {
+  constructor(options = {}) {
     this.pkgs = options ? options.pkgs : null
     this.packageRepoUtils = new PackageRepoUtils()
   }
 
-  process () {
+  process() {
     // nothing to do? move on
     if (!this.pkgs) {
       return Promise.resolve()
@@ -37,7 +37,7 @@ class Marshall {
     })
   }
 
-  createPackageVersionMaps (packages) {
+  createPackageVersionMaps(packages) {
     const packageVersionMapping = packages.reduce((prev, curr) => {
       const versionSymbolPosition = curr.lastIndexOf('@')
       const versionPosition =
@@ -57,7 +57,7 @@ class Marshall {
     return packageVersionMapping
   }
 
-  report (marshalls) {
+  report(marshalls) {
     const messages = this.collectPackageMessages(marshalls)
 
     if (!messages) {
@@ -67,13 +67,13 @@ class Marshall {
     console.log('Detected possible issues with the following packages:')
     for (const packageName in messages) {
       const packageMessages = messages[packageName]
-      console.log(`  [${chalk.red(packageName)}]`)
+      console.log(`  [${color.red(packageName)}]`)
 
       packageMessages.forEach((message) => {
         if (message.type === MESSAGE_TYPE.ERROR) {
-          console.log(`    - ${chalk.red(message.text)}`)
+          console.log(`    - ${color.red(message.text)}`)
         } else {
-          console.log(`    - ${chalk.yellow(message.text)}`)
+          console.log(`    - ${color.yellow(message.text)}`)
         }
       })
     }
@@ -81,7 +81,7 @@ class Marshall {
     return { error: true, data: messages }
   }
 
-  collectPackageMessages (marshalls) {
+  collectPackageMessages(marshalls) {
     const allPackageMessages = {}
     for (const key in marshalls) {
       this.prepareMessages(allPackageMessages, marshalls[key].errors)
@@ -91,7 +91,7 @@ class Marshall {
     return allPackageMessages
   }
 
-  prepareMessages (allPackageMessages, messages, isWarning) {
+  prepareMessages(allPackageMessages, messages, isWarning) {
     if (Array.isArray(messages) && messages.length > 0) {
       messages.forEach((msg) => {
         this.appendPackageMessage(allPackageMessages, msg.pkg, {
@@ -102,7 +102,7 @@ class Marshall {
     }
   }
 
-  appendPackageMessage (packages, packageName, packageMessage) {
+  appendPackageMessage(packages, packageName, packageMessage) {
     packages[packageName]
       ? packages[packageName].push(packageMessage)
       : (packages[packageName] = [packageMessage])