pacote 15.1.2 → 15.2.0

package/README.md

@@ -175,6 +175,9 @@ resolved, and other properties, as they are determined.
 * `verifyAttestations` A boolean that will make pacote verify Sigstore
     attestations, if present. There must be a configured `_keys` entry in the
     config that is scoped to the registry the manifest is being fetched from.
+* `tufCache` Where to store metadata/target files when retrieving the package
+  attestation key material via TUF. Defaults to the same cache directory that
+  npm will use by default, based on platform and environment.
 
 ### Advanced API
 

package/lib/dir.js

@@ -1,6 +1,6 @@
 const Fetcher = require('./fetcher.js')
 const FileFetcher = require('./file.js')
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 const tarCreateOptions = require('./util/tar-create-options.js')
 const packlist = require('npm-packlist')
 const tar = require('tar')

package/lib/fetcher.js

@@ -18,7 +18,7 @@ const removeTrailingSlashes = require('./util/trailing-slashes.js')
 const getContents = require('@npmcli/installed-package-contents')
 const readPackageJsonFast = require('read-package-json-fast')
 const readPackageJson = promisify(require('read-package-json'))
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 
 const cacheDir = require('./util/cache-dir.js')
 
@@ -61,7 +61,8 @@ class FetcherBase {
     // by adding/modifying the integrity value.
     this.opts = { ...opts }
 
-    this.cache = opts.cache || cacheDir()
+    this.cache = opts.cache || cacheDir().cacache
+    this.tufCache = opts.tufCache || cacheDir().tufcache
     this.resolved = opts.resolved || null
 
     // default to caching/verifying with sha512, that's what we usually have

package/lib/git.js

@@ -6,7 +6,7 @@ const hashre = /^[a-f0-9]{40}$/
 const git = require('@npmcli/git')
 const pickManifest = require('npm-pick-manifest')
 const npa = require('npm-package-arg')
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 const cacache = require('cacache')
 const log = require('proc-log')
 const npm = require('./util/npm.js')

package/lib/registry.js

@@ -295,7 +295,10 @@ class RegistryFetcher extends Fetcher {
               //
               // Publish attestations are signed with a keyid so we need to
               // specify a public key from the keys endpoint: `registry-host.tld/-/npm/v1/keys`
-              const options = { keySelector: publicKey ? () => publicKey.pemkey : undefined }
+              const options = {
+                tufCachePath: this.tufCache,
+                keySelector: publicKey ? () => publicKey.pemkey : undefined,
+              }
               await sigstore.verify(bundle, null, options)
             } catch (e) {
               throw Object.assign(new Error(

package/lib/remote.js

@@ -3,7 +3,7 @@ const FileFetcher = require('./file.js')
 const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const pacoteVersion = require('../package.json').version
 const fetch = require('npm-registry-fetch')
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 
 const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches')
 const _headers = Symbol('_headers')

package/lib/util/cache-dir.js

@@ -8,5 +8,8 @@ module.exports = (fakePlatform = false) => {
   const platform = fakePlatform || process.platform
   const cacheExtra = platform === 'win32' ? 'npm-cache' : '.npm'
   const cacheRoot = (platform === 'win32' && process.env.LOCALAPPDATA) || home
-  return resolve(cacheRoot, cacheExtra, '_cacache')
+  return {
+    cacache: resolve(cacheRoot, cacheExtra, '_cacache'),
+    tufcache: resolve(cacheRoot, cacheExtra, '_tuf'),
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "15.1.2",
+  "version": "15.2.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -50,7 +50,7 @@
     "@npmcli/run-script": "^6.0.0",
     "cacache": "^17.0.0",
     "fs-minipass": "^3.0.0",
-    "minipass": "^4.0.0",
+    "minipass": "^5.0.0",
     "npm-package-arg": "^10.0.0",
     "npm-packlist": "^7.0.0",
     "npm-pick-manifest": "^8.0.0",