npq 3.17.0 → 3.18.0

package/README.md

@@ -139,7 +139,7 @@ Note: `npq` by default will offload all commands and their arguments to the `npm
 | license | Will show a warning if a package has been found without a license field | Checks the latest version for a license
 | expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain
 | signatures | Will compare the package's signature as it shows on the registry's pakument with the keys published on the npmjs.com registry
-| provenance | Will verify the package's attestations of provenance metadata for the published package
+| provenance | Will verify the package's attestations of provenance metadata for the published package, and **error** on [provenance regression](docs/feature/provenance.md) (an older semver had registry provenance metadata but the version you install does not)
 | version-maturity | Will show a warning if the specific version being installed was published less than 7 days ago | Helps identify recently published versions that may not have been reviewed by the community yet
 | newBin | Will show a warning if the package version being installed introduces a new command-line binary (via the `bin` field in `package.json`) that was not present in its previous version. | Helps identify potentially unexpected new executables being added to your `node_modules/.bin/` directory.
 | typosquatting | Will show a warning if the package name is similar to a popular package name, which could indicate a potential typosquatting attack. | Helps identify packages that may be trying to trick users into installing them by mimicking popular package names.

package/lib/marshalls/provenance.marshall.js

@@ -1,6 +1,6 @@
 'use strict'
 
-// const semver = require('semver')
+const semver = require('semver')
 const BaseMarshall = require('./baseMarshall')
 const NpmRegistry = require('../helpers/npmRegistry')
 const Warning = require('../helpers/warning')
@@ -8,6 +8,62 @@ const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'provenance'
 
+/**
+ * Newest semver older than installedVersion whose packument entry includes dist.attestations.
+ * Uses only packageInfo already returned by getPackageInfo (no extra HTTP).
+ */
+function findNewestPriorVersionWithDistAttestations(packageInfo, installedVersion) {
+  if (!packageInfo?.versions || !semver.valid(installedVersion)) {
+    return null
+  }
+
+  const older = Object.keys(packageInfo.versions)
+    .filter((v) => semver.valid(v) && semver.lt(v, installedVersion))
+    .sort(semver.rcompare)
+
+  for (const v of older) {
+    if (packageInfo.versions[v]?.dist?.attestations) {
+      return v
+    }
+  }
+
+  return null
+}
+
+/**
+ * Whether this error means the resolved version did not yield verifiable provenance,
+ * as opposed to infrastructure failures (manifest fetch, keys, attestations URL fetch).
+ */
+function shouldConsiderProvenanceRegression(error) {
+  const msg = error && typeof error.message === 'string' ? error.message : ''
+  if (!msg) {
+    return false
+  }
+
+  if (msg.includes('Package has no attestations to verify')) {
+    return true
+  }
+
+  // Malformed checkpoint (#329) is handled in validate() before this runs.
+  if (error.code === 'EATTESTATIONVERIFY') {
+    return true
+  }
+
+  if (
+    error.code === 'EMISSINGSIGNATUREKEY' ||
+    error.code === 'EEXPIREDSIGNATUREKEY' ||
+    error.code === 'EATTESTATIONSUBJECT'
+  ) {
+    return true
+  }
+
+  if (msg.includes('failed to verify attestation')) {
+    return true
+  }
+
+  return false
+}
+
 class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
@@ -19,6 +75,19 @@ class Marshall extends BaseMarshall {
     return 'Verifying package provenance'
   }
 
+  throwIfProvenanceRegression(validationMetadata) {
+    const prior = findNewestPriorVersionWithDistAttestations(
+      validationMetadata.packageInfo,
+      validationMetadata.version
+    )
+
+    if (prior) {
+      throw new Error(
+        `Provenance regression detected: published version ${prior} includes npm provenance metadata, but ${validationMetadata.name}@${validationMetadata.version} does not (or it could not be verified).`
+      )
+    }
+  }
+
   validate(pkg) {
     const validationMetadata = {}
     const npmRegistry = new NpmRegistry({
@@ -56,6 +125,7 @@ class Marshall extends BaseMarshall {
       })
       .then((metadata) => {
         if (!metadata || !metadata._attestations) {
+          this.throwIfProvenanceRegression(validationMetadata)
           throw new Warning('the package was published without any attestations')
         }
 
@@ -67,114 +137,42 @@ class Marshall extends BaseMarshall {
         // See: https://github.com/lirantal/npq/issues/329
         if (error.code === 'EATTESTATIONVERIFY' && error.message.includes('malformed checkpoint')) {
           return []
-        } else {
-          if (error.message.includes('Package has no attestations to verify')) {
-            throw new Warning(
-              `Unable to verify provenance: the package was published without any attestations`
-            )
-          } else {
-            this.debug(
-              '\nUnable to verify provenance for package %s@%s: %s',
-              validationMetadata.name,
-              validationMetadata.version,
-              error.message
-            )
-            throw new Warning(`Unable to verify provenance`)
-          }
         }
-      })
-  }
-
-  /*
-  async checkProvenanceRegression(validationMetadata) {
-    const { packageInfo, name, version } = validationMetadata
-    
-    if (!packageInfo || !packageInfo.versions) {
-      return // Cannot check regression without version information
-    }
-
-    const allVersions = Object.keys(packageInfo.versions)
-    const validVersions = allVersions.filter(v => semver.valid(v))
-    
-    if (validVersions.length === 0) {
-      return // No valid versions to compare
-    }
 
-    // Get all versions older than the target version
-    const olderVersions = validVersions
-      .filter(v => semver.lt(v, version))
-      .sort(semver.rcompare) // Sort descending, newest first
-
-    if (olderVersions.length === 0) {
-      return // No older versions to check
-    }
-
-    // Check if any older versions had provenance
-    let hasProvenanceRegressionDetected = false
-    const versionWithProvenance = []
-
-    // NOTE: Going back all versions and fetching their manifest to check provenance
-    // is going to be very slow. We can limit this function to go back just 2-3 versions
-    // and then stop there
-    for (const olderVersion of olderVersions) {
-      try {
-        const keys = await this.fetchRegistryKeys()
-        const metadata = await pacote.manifest(`${name}@${olderVersion}`, {
-          verifyAttestations: true,
-          registry: 'https://registry.npmjs.org',
-          '//registry.npmjs.org/:_keys': keys
-        })
-
-        if (metadata && metadata._attestations) {
-          versionWithProvenance.push(olderVersion)
-          hasProvenanceRegressionDetected = true
+        if (
+          error instanceof Error &&
+          error.message === 'Unable to find version or dist-tag for package'
+        ) {
+          throw error
         }
-      } catch (error) {
-        // Ignore errors for older versions as they might not have provenance
-        // We only care if they successfully had provenance before
-        continue
-      }
-    }
-
-    // If older versions had provenance, check if current version lacks it
-    if (hasProvenanceRegressionDetected) {
-      try {
-        const keys = await this.fetchRegistryKeys()
-        const currentMetadata = await pacote.manifest(`${name}@${version}`, {
-          verifyAttestations: true,
-          registry: 'https://registry.npmjs.org',
-          '//registry.npmjs.org/:_keys': keys
-        })
 
-        if (!currentMetadata || !currentMetadata._attestations) {
-          const latestVersionWithProvenance = versionWithProvenance[0] // First is the newest
-          throw new Error(
-            `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
-          )
-        }
-      } catch (error) {
-        // If it's our custom error, re-throw it
-        if (error.message.includes('Provenance regression detected')) {
+        if (
+          error instanceof Warning &&
+          (error.message.includes('Error fetching registry keys') ||
+            error.message === 'the package was published without any attestations')
+        ) {
           throw error
         }
-        
-        // If it's a verification error, the current version lacks valid provenance
-        if (error.code === 'EATTESTATIONVERIFY' || error.message.includes('attestations')) {
-          const latestVersionWithProvenance = versionWithProvenance[0]
-          throw new Error(
-            `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
+
+        if (shouldConsiderProvenanceRegression(error)) {
+          this.throwIfProvenanceRegression(validationMetadata)
+        }
+
+        if (error.message.includes('Package has no attestations to verify')) {
+          throw new Warning(
+            `Unable to verify provenance: the package was published without any attestations`
           )
         }
-        
-        // For other errors, treat as if current version lacks provenance
-        const latestVersionWithProvenance = versionWithProvenance[0]
-        throw new Error(
-          `Provenance regression detected: Previous version ${latestVersionWithProvenance} had provenance attestations, but version ${version} does not. This represents a security downgrade.`
+
+        this.debug(
+          '\nUnable to verify provenance for package %s@%s: %s',
+          validationMetadata.name,
+          validationMetadata.version,
+          error.message
         )
-      }
-    }
+        throw new Warning(`Unable to verify provenance`)
+      })
   }
-  */
 
   fetchRegistryKeys() {
     const registryHost = 'https://registry.npmjs.org'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.17.0",
+  "version": "3.18.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",