pacote 17.0.4 → 17.0.6

package/lib/registry.js

@@ -14,6 +14,10 @@ const sigstore = require('sigstore')
 const corgiDoc = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'
 const fullDoc = 'application/json'
 
+// Some really old packages have no time field in their packument so we need a
+// cutoff date.
+const MISSING_TIME_CUTOFF = '2015-01-01T00:00:00.000Z'
+
 const fetch = require('npm-registry-fetch')
 
 const _headers = Symbol('_headers')
@@ -115,6 +119,13 @@ class RegistryFetcher extends Fetcher {
       return this.package
     }
 
+    // When verifying signatures, we need to fetch the full/uncompressed
+    // packument to get publish time as this is not included in the
+    // corgi/compressed packument.
+    if (this.opts.verifySignatures) {
+      this.fullMetadata = true
+    }
+
     const packument = await this.packument()
     let mani = await pickManifest(packument, this.spec.fetchSpec, {
       ...this.opts,
@@ -124,6 +135,12 @@ class RegistryFetcher extends Fetcher {
     mani = rpj.normalize(mani)
     /* XXX add ETARGET and E403 revalidation of cached packuments here */
 
+    // add _time from packument if fetched with fullMetadata
+    const time = packument.time?.[mani.version]
+    if (time) {
+      mani._time = time
+    }
+
     // add _resolved and _integrity from dist object
     const { dist } = mani
     if (dist) {
@@ -171,8 +188,10 @@ class RegistryFetcher extends Fetcher {
                   'but no corresponding public key can be found'
               ), { code: 'EMISSINGSIGNATUREKEY' })
             }
-            const validPublicKey =
-              !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
+
+            const publishedTime = Date.parse(mani._time || MISSING_TIME_CUTOFF)
+            const validPublicKey = !publicKey.expires ||
+              publishedTime < Date.parse(publicKey.expires)
             if (!validPublicKey) {
               throw Object.assign(new Error(
                   `${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
@@ -254,8 +273,13 @@ class RegistryFetcher extends Fetcher {
                 ), { code: 'EMISSINGSIGNATUREKEY' })
               }
 
-              const validPublicKey =
-                !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
+              const integratedTime = new Date(
+                Number(
+                  bundle.verificationMaterial.tlogEntries[0].integratedTime
+                ) * 1000
+              )
+              const validPublicKey = !publicKey.expires ||
+                (integratedTime < Date.parse(publicKey.expires))
               if (!validPublicKey) {
                 throw Object.assign(new Error(
                   `${mani._id} has attestations with keyid: ${keyid} ` +
@@ -297,6 +321,7 @@ class RegistryFetcher extends Fetcher {
               // specify a public key from the keys endpoint: `registry-host.tld/-/npm/v1/keys`
               const options = {
                 tufCachePath: this.tufCache,
+                tufForceCache: true,
                 keySelector: publicKey ? () => publicKey.pemkey : undefined,
               }
               await sigstore.verify(bundle, options)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "17.0.4",
+  "version": "17.0.6",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -11,7 +11,7 @@
   "scripts": {
     "test": "tap",
     "snap": "tap",
-    "lint": "eslint \"**/*.js\"",
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
     "postlint": "template-oss-check",
     "lintfix": "npm run lint -- --fix",
     "posttest": "npm run lint",
@@ -25,9 +25,9 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/arborist": "^6.0.0 || ^6.0.0-pre.0",
+    "@npmcli/arborist": "^7.1.0",
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.18.0",
+    "@npmcli/template-oss": "4.21.3",
     "hosted-git-info": "^7.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
@@ -59,7 +59,7 @@
     "promise-retry": "^2.0.1",
     "read-package-json": "^7.0.0",
     "read-package-json-fast": "^3.0.0",
-    "sigstore": "^2.0.0",
+    "sigstore": "^2.2.0",
     "ssri": "^10.0.0",
     "tar": "^6.1.11"
   },
@@ -72,13 +72,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "ciVersions": [
-      "16.14.0",
-      "16.x",
-      "18.0.0",
-      "18.x"
-    ],
-    "version": "4.18.0",
+    "version": "4.21.3",
     "windowsCI": false,
     "publish": "true"
   }