npq 3.13.3 → 3.13.5

package/lib/marshalls/index.js

@@ -27,6 +27,11 @@ class Marshalls {
       const Marshall = require(curr)
       const marshall = new Marshall(config)
 
+      // Skip this marshall if it's disabled via environment variable
+      if (!marshall.isEnabled()) {
+        return prev
+      }
+
       return prev.concat({
         title: marshall.title(),
         categoryId: marshall.categoryId,

package/lib/marshalls/provenance.marshall.js

@@ -27,12 +27,15 @@ class Marshall extends BaseMarshall {
 
     return this.packageRepoUtils
       .getPackageInfo(pkg.packageName)
-      .then((packageInfo) => {
+      .then(async (packageInfo) => {
         const packageName = packageInfo.name
-        const packageVersion =
-          pkg.packageVersion === 'latest'
-            ? packageInfo['dist-tags'] && packageInfo['dist-tags'].latest
-            : this.packageRepoUtils.parsePackageVersion(pkg.packageVersion).version
+
+        // Use the resolvePackageVersion method to handle version ranges properly
+        const packageVersion = await this.resolvePackageVersion(
+          pkg.packageName,
+          pkg.packageVersion,
+          packageInfo
+        )
 
         validationMetadata.name = packageName
         validationMetadata.version = packageVersion
@@ -41,14 +44,15 @@ class Marshall extends BaseMarshall {
         if (!validationMetadata.version) {
           throw new Error('Unable to find version or dist-tag for package')
         }
+
+        return validationMetadata
       })
-      .then(() => {
-        return this.fetchRegistryKeys()
-      })
-      .then((keys) => {
-        return npmRegistry
-          .getManifest(`${validationMetadata.name}@${validationMetadata.version}`)
-          .then((manifest) => npmRegistry.verifyAttestations(manifest, keys))
+      .then((validationMetadata) => {
+        return this.fetchRegistryKeys().then((keys) => {
+          return npmRegistry
+            .getManifest(`${validationMetadata.name}@${validationMetadata.version}`)
+            .then((manifest) => npmRegistry.verifyAttestations(manifest, keys))
+        })
       })
       .then((metadata) => {
         if (!metadata || !metadata._attestations) {

package/lib/marshalls/signatures.marshall.js

@@ -25,11 +25,30 @@ class Marshall extends BaseMarshall {
       registry: 'https://registry.npmjs.org'
     })
 
-    return this.fetchRegistryKeys()
-      .then((keys) => {
-        return npmRegistry
-          .getManifest(`${pkg.packageName}@${pkg.packageVersion}`)
-          .then((manifest) => npmRegistry.verifySignatures(manifest, keys))
+    return this.packageRepoUtils
+      .getPackageInfo(pkg.packageName)
+      .then(async (packageInfo) => {
+        // Resolve version range to specific version
+        const resolvedVersion = await this.resolvePackageVersion(
+          pkg.packageName,
+          pkg.packageVersion,
+          packageInfo
+        )
+
+        if (!resolvedVersion) {
+          throw new Error(
+            `Unable to resolve version ${pkg.packageVersion} for package ${pkg.packageName}`
+          )
+        }
+
+        return { packageInfo, resolvedVersion }
+      })
+      .then(({ resolvedVersion }) => {
+        return this.fetchRegistryKeys().then((keys) => {
+          return npmRegistry
+            .getManifest(`${pkg.packageName}@${resolvedVersion}`)
+            .then((manifest) => npmRegistry.verifySignatures(manifest, keys))
+        })
       })
       .then((metadata) => {
         return metadata

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.13.3",
+  "version": "3.13.5",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",