pacote 15.1.3 → 16.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -0
- package/lib/fetcher.js +2 -1
- package/lib/registry.js +4 -1
- package/lib/util/cache-dir.js +4 -1
- package/package.json +12 -6
package/README.md
CHANGED
|
@@ -175,6 +175,9 @@ resolved, and other properties, as they are determined.
|
|
|
175
175
|
* `verifyAttestations` A boolean that will make pacote verify Sigstore
|
|
176
176
|
attestations, if present. There must be a configured `_keys` entry in the
|
|
177
177
|
config that is scoped to the registry the manifest is being fetched from.
|
|
178
|
+
* `tufCache` Where to store metadata/target files when retrieving the package
|
|
179
|
+
attestation key material via TUF. Defaults to the same cache directory that
|
|
180
|
+
npm will use by default, based on platform and environment.
|
|
178
181
|
|
|
179
182
|
### Advanced API
|
|
180
183
|
|
package/lib/fetcher.js
CHANGED
|
@@ -61,7 +61,8 @@ class FetcherBase {
|
|
|
61
61
|
// by adding/modifying the integrity value.
|
|
62
62
|
this.opts = { ...opts }
|
|
63
63
|
|
|
64
|
-
this.cache = opts.cache || cacheDir()
|
|
64
|
+
this.cache = opts.cache || cacheDir().cacache
|
|
65
|
+
this.tufCache = opts.tufCache || cacheDir().tufcache
|
|
65
66
|
this.resolved = opts.resolved || null
|
|
66
67
|
|
|
67
68
|
// default to caching/verifying with sha512, that's what we usually have
|
package/lib/registry.js
CHANGED
|
@@ -295,7 +295,10 @@ class RegistryFetcher extends Fetcher {
|
|
|
295
295
|
//
|
|
296
296
|
// Publish attestations are signed with a keyid so we need to
|
|
297
297
|
// specify a public key from the keys endpoint: `registry-host.tld/-/npm/v1/keys`
|
|
298
|
-
const options = {
|
|
298
|
+
const options = {
|
|
299
|
+
tufCachePath: this.tufCache,
|
|
300
|
+
keySelector: publicKey ? () => publicKey.pemkey : undefined,
|
|
301
|
+
}
|
|
299
302
|
await sigstore.verify(bundle, null, options)
|
|
300
303
|
} catch (e) {
|
|
301
304
|
throw Object.assign(new Error(
|
package/lib/util/cache-dir.js
CHANGED
|
@@ -8,5 +8,8 @@ module.exports = (fakePlatform = false) => {
|
|
|
8
8
|
const platform = fakePlatform || process.platform
|
|
9
9
|
const cacheExtra = platform === 'win32' ? 'npm-cache' : '.npm'
|
|
10
10
|
const cacheRoot = (platform === 'win32' && process.env.LOCALAPPDATA) || home
|
|
11
|
-
return
|
|
11
|
+
return {
|
|
12
|
+
cacache: resolve(cacheRoot, cacheExtra, '_cacache'),
|
|
13
|
+
tufcache: resolve(cacheRoot, cacheExtra, '_tuf'),
|
|
14
|
+
}
|
|
12
15
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pacote",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "16.0.0",
|
|
4
4
|
"description": "JavaScript package downloader",
|
|
5
5
|
"author": "GitHub Inc.",
|
|
6
6
|
"bin": {
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
"devDependencies": {
|
|
28
28
|
"@npmcli/arborist": "^6.0.0 || ^6.0.0-pre.0",
|
|
29
29
|
"@npmcli/eslint-config": "^4.0.0",
|
|
30
|
-
"@npmcli/template-oss": "4.
|
|
30
|
+
"@npmcli/template-oss": "4.18.0",
|
|
31
31
|
"hosted-git-info": "^6.0.0",
|
|
32
32
|
"mutate-fs": "^2.1.1",
|
|
33
33
|
"nock": "^13.2.4",
|
|
@@ -50,11 +50,11 @@
|
|
|
50
50
|
"@npmcli/run-script": "^6.0.0",
|
|
51
51
|
"cacache": "^17.0.0",
|
|
52
52
|
"fs-minipass": "^3.0.0",
|
|
53
|
-
"minipass": "^
|
|
53
|
+
"minipass": "^7.0.2",
|
|
54
54
|
"npm-package-arg": "^10.0.0",
|
|
55
55
|
"npm-packlist": "^7.0.0",
|
|
56
56
|
"npm-pick-manifest": "^8.0.0",
|
|
57
|
-
"npm-registry-fetch": "^
|
|
57
|
+
"npm-registry-fetch": "^15.0.0",
|
|
58
58
|
"proc-log": "^3.0.0",
|
|
59
59
|
"promise-retry": "^2.0.1",
|
|
60
60
|
"read-package-json": "^6.0.0",
|
|
@@ -64,7 +64,7 @@
|
|
|
64
64
|
"tar": "^6.1.11"
|
|
65
65
|
},
|
|
66
66
|
"engines": {
|
|
67
|
-
"node": "^
|
|
67
|
+
"node": "^16.13.0 || >=18.0.0"
|
|
68
68
|
},
|
|
69
69
|
"repository": {
|
|
70
70
|
"type": "git",
|
|
@@ -72,7 +72,13 @@
|
|
|
72
72
|
},
|
|
73
73
|
"templateOSS": {
|
|
74
74
|
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
|
|
75
|
-
"
|
|
75
|
+
"ciVersions": [
|
|
76
|
+
"16.13.0",
|
|
77
|
+
"16.x",
|
|
78
|
+
"18.0.0",
|
|
79
|
+
"18.x"
|
|
80
|
+
],
|
|
81
|
+
"version": "4.18.0",
|
|
76
82
|
"windowsCI": false,
|
|
77
83
|
"publish": "true"
|
|
78
84
|
}
|