npq 3.20.0 → 3.21.1

package/lib/helpers/registryErrors.js

@@ -0,0 +1,32 @@
+'use strict'
+
+function sanitizeRegistryUrl(value) {
+  try {
+    const url = new URL(value)
+    url.username = ''
+    url.password = ''
+    url.search = ''
+    url.hash = ''
+    return url.toString()
+  } catch {
+    return 'configured registry'
+  }
+}
+
+class RegistryError extends Error {
+  constructor(
+    message,
+    { registry = null, code = 'EREGISTRY', statusCode = null, cause = null } = {}
+  ) {
+    const sanitizedRegistry = registry ? sanitizeRegistryUrl(registry) : null
+    super(sanitizedRegistry ? `${message} (${sanitizedRegistry})` : message, {
+      cause: cause || undefined
+    })
+    this.name = 'RegistryError'
+    this.code = code
+    this.statusCode = statusCode
+    this.registry = sanitizedRegistry
+  }
+}
+
+module.exports = { RegistryError, sanitizeRegistryUrl }

package/lib/helpers/reportResults.js

@@ -108,6 +108,7 @@ function reportResults(marshallResults, { plain = false } = {}) {
 
   let countErrors = 0
   let countWarnings = 0
+  let countNotEvaluated = 0
   let countPackages = results.length
 
   results.forEach((result, index) => {
@@ -219,11 +220,33 @@ function reportResults(marshallResults, { plain = false } = {}) {
       })
     }
 
+    if (result.notEvaluated && result.notEvaluated.length > 0) {
+      result.notEvaluated.forEach((entryArray) => {
+        countNotEvaluated += entryArray.length
+        entryArray.forEach((entry) => {
+          const topicRich = styleText(
+            ['cyan'],
+            entry.categoryFriendlyName.padEnd(maxTextLength, ' ')
+          )
+          const iconRich = styleText(['cyan'], '○')
+          const wrappedMessage = wrapTextWithIndent(
+            entry.message,
+            maxMessageWidth,
+            indentString
+          )
+          resultsForPrettyPrint +=
+            `\n ${prefixRich} ${iconRich} ${topicRich} ${separatorRich} ${wrappedMessage} `
+          resultsForPlainTextPrint +=
+            `\n  NOT EVALUATED: ${entry.categoryFriendlyName} - ${entry.message}`
+        })
+      })
+    }
+
     // Close rich formatting box
     resultsForPrettyPrint += `\n ${styleText(['dim'], '└─')}`
   })
 
-  const maxTextLength = 'Total packages:'.length
+  const maxTextLength = 'Total not evaluated:'.length
 
   // Rich formatting summary
   summaryForPrettyPrint += `\n\n${styleText(['bold'], 'Summary:')}\n`
@@ -239,6 +262,10 @@ function reportResults(marshallResults, { plain = false } = {}) {
     ['yellow', 'bold'],
     String(countWarnings)
   )}`
+  summaryForPrettyPrint += `\n - ${'Total not evaluated:'.padEnd(maxTextLength, ' ')} ${styleText(
+    ['cyan'],
+    String(countNotEvaluated)
+  )}`
   summaryForPrettyPrint += `\n`
 
   // Plain text summary
@@ -246,11 +273,13 @@ function reportResults(marshallResults, { plain = false } = {}) {
   summaryForPlainTextPrint += `\n - Total packages: ${countPackages}`
   summaryForPlainTextPrint += `\n - Total errors: ${countErrors}`
   summaryForPlainTextPrint += `\n - Total warnings: ${countWarnings}`
+  summaryForPlainTextPrint += `\n - Total not evaluated: ${countNotEvaluated}`
   summaryForPlainTextPrint += `\n`
 
   return {
     countErrors,
     countWarnings,
+    countNotEvaluated,
     resultsForPrettyPrint,
     resultsForJSON,
     resultsForPlainTextPrint,
@@ -267,7 +296,8 @@ function marshallResultsToIssuesPerPackage(results) {
     const issues = {
       pkg,
       errors: [],
-      warnings: []
+      warnings: [],
+      notEvaluated: []
     }
     for (const marshall of allMarshallResultsList) {
       for (const value of Object.values(marshall)) {
@@ -294,9 +324,22 @@ function marshallResultsToIssuesPerPackage(results) {
 
           issues.warnings.push(marshallWarnings)
         }
+        if (value.notEvaluated && value.notEvaluated.length > 0) {
+          const skippedChecks = value.notEvaluated.map((entry) => ({
+            marshall: value.marshall,
+            categoryId: value.categoryId,
+            categoryFriendlyName: marshallCategories[value.categoryId].title,
+            ...entry
+          }))
+          issues.notEvaluated.push(skippedChecks)
+        }
       }
     }
-    if (issues.errors.length > 0 || issues.warnings.length > 0) {
+    if (
+      issues.errors.length > 0 ||
+      issues.warnings.length > 0 ||
+      issues.notEvaluated.length > 0
+    ) {
       issuesPerPackage.push(issues)
     }
   }

package/lib/marshall.js

@@ -3,12 +3,20 @@
 // const util = require('node:util')
 const Marshalls = require('./marshalls')
 const PackageRepoUtils = require('./helpers/packageRepoUtils')
+const RegistryClient = require('./helpers/registryClient')
 // const { marshallCategories } = require('./marshalls/constants')
 
 class Marshall {
   constructor(options = {}) {
-    this.pkgs = options ? options.pkgs : null
-    this.packageRepoUtils = new PackageRepoUtils()
+    options = options || {}
+    this.pkgs = options.pkgs || null
+    this.registryClient =
+      options.registryClient ||
+      options.packageRepoUtils?.registryClient ||
+      RegistryClient.public()
+    this.packageRepoUtils =
+      options.packageRepoUtils ||
+      new PackageRepoUtils({ registryClient: this.registryClient })
     this.progressManager = options.progressManager || null
     this.promiseThrottleHelper = options.promiseThrottleHelper || null
   }
@@ -56,7 +64,8 @@ class Marshall {
     const allPackages = Array.isArray(pkg) ? pkg : [pkg]
     const config = {
       pkgs: this.createPackageVersionMaps(allPackages),
-      packageRepoUtils: packageRepoUtils
+      packageRepoUtils: packageRepoUtils,
+      registryClient: this.registryClient
     }
     return Marshalls.tasks(config, this.progressManager)
   }

package/lib/marshalls/baseMarshall.js

@@ -2,6 +2,8 @@
 
 const semver = require('semver')
 const util = require('node:util')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const Warning = require('../helpers/warning')
 const { marshallCategories } = require('./constants')
 
@@ -9,6 +11,7 @@ class BaseMarshall {
   constructor(options) {
     this.debug = util.debuglog('npq')
     this.packageRepoUtils = options.packageRepoUtils
+    this.registryClient = options.registryClient
     this.categoryId = marshallCategories.PackageHealth.id
   }
 
@@ -19,6 +22,7 @@ class BaseMarshall {
       status: null,
       errors: [],
       warnings: [],
+      notEvaluated: [],
       data: {},
       marshall: this.name,
       categoryId: this.categoryId
@@ -42,13 +46,22 @@ class BaseMarshall {
         return data
       })
       .catch((err) => {
-        this.setMessage(
-          {
-            pkg: pkg.packageString,
-            message: err.message
-          },
-          Boolean(err instanceof Warning)
-        )
+        if (err instanceof RegistryError) {
+          throw err
+        }
+
+        const message = {
+          pkg: pkg.packageString,
+          message: err.message
+        }
+
+        if (err instanceof NotEvaluated) {
+          this.setNotEvaluated(message)
+          return undefined
+        }
+
+        this.setMessage(message, Boolean(err instanceof Warning))
+        return undefined
       })
   }
 
@@ -69,6 +82,13 @@ class BaseMarshall {
     })
   }
 
+  setNotEvaluated(msg) {
+    this.ctx.marshalls[this.name].notEvaluated.push({
+      pkg: msg.pkg,
+      message: msg.message
+    })
+  }
+
   /**
    * Resolves a package version string to an actual semver version
    * Handles dist-tags (latest, beta, etc.) and direct semver versions

package/lib/marshalls/expiredDomains.marshall.js

@@ -2,6 +2,7 @@
 
 const BaseMarshall = require('./baseMarshall')
 const { marshallCategories } = require('./constants')
+const NotEvaluated = require('../helpers/notEvaluated')
 const { Resolver } = require('dns/promises')
 
 const dns = new Resolver()
@@ -28,6 +29,10 @@ class Marshall extends BaseMarshall {
 
         const maintainersAccounts = lastVersionData && lastVersionData.maintainers
 
+        if (!Array.isArray(maintainersAccounts) || maintainersAccounts.length === 0) {
+          throw new NotEvaluated('no maintainers information available for the package')
+        }
+
         const testEmails = []
         for (const maintainerInfo of maintainersAccounts) {
           const maintainerEmail = maintainerInfo.email
@@ -38,6 +43,10 @@ class Marshall extends BaseMarshall {
         return Promise.all(testEmails)
       })
       .catch((error) => {
+        if (error instanceof NotEvaluated) {
+          throw error
+        }
+
         const emailHostname = error.hostname ? error.hostname : '<unknown>'
         this.debug('\nDetected error resolving domain for maintainer e-mail: %s', emailHostname)
         throw new Error(

package/lib/marshalls/index.js

@@ -2,6 +2,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
+const { RegistryError } = require('../helpers/registryErrors')
 
 class Marshalls {
   static async collectMarshalls() {
@@ -20,7 +21,8 @@ class Marshalls {
     }
 
     const config = {
-      packageRepoUtils: options.packageRepoUtils
+      packageRepoUtils: options.packageRepoUtils,
+      registryClient: options.registryClient
     }
 
     const marshallTasks = marshalls.reduce((prev, curr) => {
@@ -96,6 +98,7 @@ class Marshalls {
               status: null,
               errors: [{ pkg: options.pkgs[index].packageName, message: 'Package not found' }],
               warnings: [],
+              notEvaluated: [],
               data: {},
               categoryId: 'PackageHealth'
             }
@@ -119,7 +122,8 @@ class Marshalls {
     const packagesToProcess = options.pkgs
     if (packagesToProcess.length > 0) {
       const marshallTasks = await Marshalls.buildMarshallTasks(marshalls, {
-        packageRepoUtils: options.packageRepoUtils
+        packageRepoUtils: options.packageRepoUtils,
+        registryClient: options.registryClient
       })
 
       for (const marshall of marshallTasks) {
@@ -130,6 +134,9 @@ class Marshalls {
           })
           marshallResults.push(res.marshalls)
         } catch (error) {
+          if (error instanceof RegistryError) {
+            throw error
+          }
           console.error(`Error running task ${marshall.title}:`, error)
         }
       }

package/lib/marshalls/provenance.marshall.js

@@ -4,6 +4,8 @@ const semver = require('semver')
 const BaseMarshall = require('./baseMarshall')
 const NpmRegistry = require('../helpers/npmRegistry')
 const Warning = require('../helpers/warning')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'provenance'
@@ -88,115 +90,80 @@ class Marshall extends BaseMarshall {
     }
   }
 
-  validate(pkg) {
+  async validate(pkg) {
     const validationMetadata = {}
-    const npmRegistry = new NpmRegistry({
-      registry: 'https://registry.npmjs.org'
-    })
-
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then(async (packageInfo) => {
-        const packageName = packageInfo.name
-
-        // Use the resolvePackageVersion method to handle version ranges properly
-        const packageVersion = await this.resolvePackageVersion(
-          pkg.packageName,
-          pkg.packageVersion,
-          packageInfo
-        )
+    const verifier = new NpmRegistry()
+
+    try {
+      const packageInfo = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+      validationMetadata.name = packageInfo.name
+      validationMetadata.version = await this.resolvePackageVersion(
+        pkg.packageName,
+        pkg.packageVersion,
+        packageInfo
+      )
+      validationMetadata.packageInfo = packageInfo
 
-        validationMetadata.name = packageName
-        validationMetadata.version = packageVersion
-        validationMetadata.packageInfo = packageInfo
-
-        if (!validationMetadata.version) {
-          throw new Error('Unable to find version or dist-tag for package')
-        }
-
-        return validationMetadata
-      })
-      .then((validationMetadata) => {
-        return this.fetchRegistryKeys().then((keys) => {
-          return npmRegistry
-            .getManifest(`${validationMetadata.name}@${validationMetadata.version}`)
-            .then((manifest) => npmRegistry.verifyAttestations(manifest, keys))
-        })
-      })
-      .then((metadata) => {
-        if (!metadata || !metadata._attestations) {
-          this.throwIfProvenanceRegression(validationMetadata)
-          throw new Warning('the package was published without any attestations')
-        }
-
-        const attestations = metadata._attestations
-        return attestations
-      })
-      .catch((error) => {
-        // We can ignore this type of error, false positive
-        // See: https://github.com/lirantal/npq/issues/329
-        if (error.code === 'EATTESTATIONVERIFY' && error.message.includes('malformed checkpoint')) {
-          return []
-        }
-
-        if (
-          error instanceof Error &&
-          error.message === 'Unable to find version or dist-tag for package'
-        ) {
-          throw error
-        }
-
-        if (
-          error instanceof Warning &&
-          (error.message.includes('Error fetching registry keys') ||
-            error.message === 'the package was published without any attestations')
-        ) {
-          throw error
-        }
-
-        if (shouldConsiderProvenanceRegression(error)) {
-          this.throwIfProvenanceRegression(validationMetadata)
-        }
-
-        if (error.message.includes('Package has no attestations to verify')) {
-          throw new Warning(
-            `Unable to verify provenance: the package was published without any attestations`
-          )
-        }
-
-        this.debug(
-          '\nUnable to verify provenance for package %s@%s: %s',
-          validationMetadata.name,
-          validationMetadata.version,
-          error.message
+      if (!validationMetadata.version) {
+        throw new Error('Unable to find version or dist-tag for package')
+      }
+
+      const manifest = await this.registryClient.getManifest(
+        `${pkg.packageName}@${validationMetadata.version}`,
+        packageInfo
+      )
+      let metadata
+      if (!manifest.dist || !manifest.dist.attestations) {
+        metadata = await verifier.verifyAttestations(manifest, [], null)
+      } else {
+        const [keys, attestations] = await Promise.all([
+          this.registryClient.getRegistryKeys(pkg.packageName),
+          this.registryClient.getAttestations(pkg.packageName, manifest)
+        ])
+        metadata = await verifier.verifyAttestations(manifest, keys, attestations)
+      }
+
+      if (!metadata || !metadata._attestations) {
+        this.throwIfProvenanceRegression(validationMetadata)
+        throw new Warning('the package was published without any attestations')
+      }
+      return metadata._attestations
+    } catch (error) {
+      if (error instanceof NotEvaluated || error instanceof RegistryError) {
+        throw error
+      }
+      if (error.code === 'EATTESTATIONVERIFY' && error.message.includes('malformed checkpoint')) {
+        return []
+      }
+      if (
+        error instanceof Error &&
+        error.message === 'Unable to find version or dist-tag for package'
+      ) {
+        throw error
+      }
+      if (
+        error instanceof Warning &&
+        error.message === 'the package was published without any attestations'
+      ) {
+        throw error
+      }
+      if (shouldConsiderProvenanceRegression(error)) {
+        this.throwIfProvenanceRegression(validationMetadata)
+      }
+      if (error.message.includes('Package has no attestations to verify')) {
+        throw new Warning(
+          'Unable to verify provenance: the package was published without any attestations'
         )
-        throw new Warning(`Unable to verify provenance`)
-      })
-  }
+      }
 
-  fetchRegistryKeys() {
-    const registryHost = 'https://registry.npmjs.org'
-    const registryKeysEndpoint = '/-/npm/v1/keys'
-
-    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
-    return fetch(registryKeysUrl)
-      .then((response) => {
-        return response.json()
-      })
-      .then((response) => {
-        const registryKeys = response.keys
-
-        return registryKeys.map((key) => ({
-          ...key,
-          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
-        }))
-      })
-      .then((keys) => {
-        return keys
-      })
-      .catch((error) => {
-        throw new Warning(`Error fetching registry keys: ${error.message}`)
-      })
+      this.debug(
+        '\nUnable to verify provenance for package %s@%s: %s',
+        validationMetadata.name,
+        validationMetadata.version,
+        error.message
+      )
+      throw new Warning('Unable to verify provenance')
+    }
   }
 }
 

package/lib/marshalls/signatures.marshall.js

@@ -3,12 +3,12 @@
 const BaseMarshall = require('./baseMarshall')
 const Warning = require('../helpers/warning')
 const NpmRegistry = require('../helpers/npmRegistry')
+const NotEvaluated = require('../helpers/notEvaluated')
+const { RegistryError } = require('../helpers/registryErrors')
 const { marshallCategories } = require('./constants')
 
 const MARSHALL_NAME = 'signatures'
 
-let registryKeysCache = null
-
 class Marshall extends BaseMarshall {
   constructor(options) {
     super(options)
@@ -20,83 +20,44 @@ class Marshall extends BaseMarshall {
     return 'Verifying registry signatures for package'
   }
 
-  validate(pkg) {
-    const npmRegistry = new NpmRegistry({
-      registry: 'https://registry.npmjs.org'
-    })
-
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then(async (packageInfo) => {
-        // Resolve version range to specific version
-        const resolvedVersion = await this.resolvePackageVersion(
-          pkg.packageName,
-          pkg.packageVersion,
-          packageInfo
-        )
+  async validate(pkg) {
+    const verifier = new NpmRegistry()
 
-        if (!resolvedVersion) {
-          throw new Error(
-            `Unable to resolve version ${pkg.packageVersion} for package ${pkg.packageName}`
-          )
-        }
+    try {
+      const packageInfo = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+      const resolvedVersion = await this.resolvePackageVersion(
+        pkg.packageName,
+        pkg.packageVersion,
+        packageInfo
+      )
 
-        return { packageInfo, resolvedVersion }
-      })
-      .then(({ resolvedVersion }) => {
-        return this.fetchRegistryKeys().then((keys) => {
-          return npmRegistry
-            .getManifest(`${pkg.packageName}@${resolvedVersion}`)
-            .then((manifest) => npmRegistry.verifySignatures(manifest, keys))
-        })
-      })
-      .then((metadata) => {
-        return metadata
-      })
-      .catch((error) => {
-        // Handle specific error cases
-        if (
-          error.message &&
-          error.message.includes('but the corresponding public key has expired')
-        ) {
-          // if the error is about an expired key, we throw a warning
-          // instead of an error, so that the process can continue
-          throw new Warning(`Package is signed with an expired key`)
-        }
-
-        throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
-      })
-  }
+      if (!resolvedVersion) {
+        throw new Error(
+          `Unable to resolve version ${pkg.packageVersion} for package ${pkg.packageName}`
+        )
+      }
 
-  fetchRegistryKeys() {
-    if (registryKeysCache) {
-      return Promise.resolve(registryKeysCache)
+      const manifest = await this.registryClient.getManifest(
+        `${pkg.packageName}@${resolvedVersion}`,
+        packageInfo
+      )
+      if (!manifest.dist || !manifest.dist.signatures) {
+        return await verifier.verifySignatures(manifest, [])
+      }
+      const keys = await this.registryClient.getRegistryKeys(pkg.packageName)
+      return await verifier.verifySignatures(manifest, keys)
+    } catch (error) {
+      if (error instanceof NotEvaluated || error instanceof RegistryError) {
+        throw error
+      }
+      if (
+        error.message &&
+        error.message.includes('but the corresponding public key has expired')
+      ) {
+        throw new Warning('Package is signed with an expired key')
+      }
+      throw new Warning(`Unable to verify package signature on registry: ${error.message}`)
     }
-
-    const registryHost = 'https://registry.npmjs.org'
-    const registryKeysEndpoint = '/-/npm/v1/keys'
-
-    const registryKeysUrl = `${registryHost}${registryKeysEndpoint}`
-    return fetch(registryKeysUrl)
-      .then((response) => {
-        return response.json()
-      })
-      .then((response) => {
-        const registryKeys = response.keys
-
-        return registryKeys.map((key) => ({
-          ...key,
-          pemkey: `-----BEGIN PUBLIC KEY-----\n${key.key}\n-----END PUBLIC KEY-----`
-        }))
-      })
-      .then((keys) => {
-        // save it in the cached singleton object
-        registryKeysCache = keys
-        return keys
-      })
-      .catch((error) => {
-        throw new Warning(`Error fetching registry keys: ${error.message}`)
-      })
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.20.0",
+  "version": "3.21.1",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -43,7 +43,9 @@
     "access": "public"
   },
   "dependencies": {
+    "@npmcli/config": "^10.10.0",
     "npm-package-arg": "^13.0.2",
+    "npm-registry-fetch": "^19.1.1",
     "semver": "^7.7.4",
     "sigstore": "^4.1.0",
     "ssri": "^13.0.1"