pacote 9.5.4 → 9.5.8

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="9.5.8"></a>
+## [9.5.8](https://github.com/npm/pacote/compare/v9.5.7...v9.5.8) (2019-08-20)
+
+
+
+<a name="9.5.7"></a>
+## [9.5.7](https://github.com/npm/pacote/compare/v9.5.6...v9.5.7) (2019-08-19)
+
+
+### Bug Fixes
+
+* do not try to chown if not running as root ([bbc5da3](https://github.com/npm/pacote/commit/bbc5da3))
+
+
+
+<a name="9.5.6"></a>
+## [9.5.6](https://github.com/npm/pacote/compare/v9.5.5...v9.5.6) (2019-08-15)
+
+
+### Bug Fixes
+
+* **extract:** chown properly when more than one directory is made ([5161828](https://github.com/npm/pacote/commit/5161828))
+
+
+
+<a name="9.5.5"></a>
+## [9.5.5](https://github.com/npm/pacote/compare/v9.5.4...v9.5.5) (2019-08-12)
+
+
+### Bug Fixes
+
+* don't pass uid/gid to cacache ([0a0c73c](https://github.com/npm/pacote/commit/0a0c73c))
+* Infer owner of all unpacked files ([f12e7ef](https://github.com/npm/pacote/commit/f12e7ef))
+* invalid arg detection in extract() ([b4dc363](https://github.com/npm/pacote/commit/b4dc363)), closes [#5](https://github.com/npm/pacote/issues/5) [#6](https://github.com/npm/pacote/issues/6)
+
+
+
 <a name="9.5.4"></a>
 ## [9.5.4](https://github.com/npm/pacote/compare/v9.5.3...v9.5.4) (2019-07-16)
 

package/LICENSE

@@ -1,5 +1,5 @@
 The MIT License (MIT)
-Copyright (c) 2017 Kat Marchán
+Copyright (c) Kat Marchán, npm, Inc., and Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/extract.js

@@ -10,41 +10,60 @@ const optCheck = require('./lib/util/opt-check.js')
 const path = require('path')
 const rimraf = BB.promisify(require('rimraf'))
 const withTarballStream = require('./lib/with-tarball-stream.js')
+const inferOwner = require('infer-owner')
+const chown = BB.promisify(require('chownr'))
 
 const truncateAsync = BB.promisify(fs.truncate)
 const readFileAsync = BB.promisify(fs.readFile)
 const appendFileAsync = BB.promisify(fs.appendFile)
 
+// you used to call me on my...
+const selfOwner = process.getuid ? {
+  uid: process.getuid(),
+  gid: process.getgid()
+} : {
+  uid: undefined,
+  gid: undefined
+}
+
 module.exports = extract
 function extract (spec, dest, opts) {
   opts = optCheck(opts)
   spec = npa(spec, opts.where)
+  if (spec.type === 'git' && !opts.cache) {
+    throw new TypeError('Extracting git packages requires a cache folder')
+  }
+  if (typeof dest !== 'string') {
+    throw new TypeError('Extract requires a destination')
+  }
   const startTime = Date.now()
-
-  return withTarballStream(spec, opts, stream => {
-    return tryExtract(spec, stream, dest, opts)
-  })
-    .then(() => {
-      if (!opts.resolved) {
-        const pjson = path.join(dest, 'package.json')
-        return readFileAsync(pjson, 'utf8')
-          .then(str => truncateAsync(pjson)
-            .then(() => appendFileAsync(pjson, str.replace(
-              /}\s*$/,
-              `\n,"_resolved": ${
-                JSON.stringify(opts.resolved || '')
-              }\n,"_integrity": ${
-                JSON.stringify(opts.integrity || '')
-              }\n,"_from": ${
-                JSON.stringify(spec.toString())
-              }\n}`
-            ))))
-      }
+  return inferOwner(dest).then(({ uid, gid }) => {
+    opts = opts.concat({ uid, gid })
+    return withTarballStream(spec, opts, stream => {
+      return tryExtract(spec, stream, dest, opts)
     })
-    .then(() => opts.log.silly(
-      'extract',
-      `${spec} extracted to ${dest} (${Date.now() - startTime}ms)`
-    ))
+      .then(() => {
+        if (!opts.resolved) {
+          const pjson = path.join(dest, 'package.json')
+          return readFileAsync(pjson, 'utf8')
+            .then(str => truncateAsync(pjson)
+              .then(() => appendFileAsync(pjson, str.replace(
+                /}\s*$/,
+                `\n,"_resolved": ${
+                  JSON.stringify(opts.resolved || '')
+                }\n,"_integrity": ${
+                  JSON.stringify(opts.integrity || '')
+                }\n,"_from": ${
+                  JSON.stringify(spec.toString())
+                }\n}`
+              ))))
+        }
+      })
+      .then(() => opts.log.silly(
+        'extract',
+        `${spec} extracted to ${dest} (${Date.now() - startTime}ms)`
+      ))
+  })
 }
 
 function tryExtract (spec, tarStream, dest, opts) {
@@ -53,6 +72,15 @@ function tryExtract (spec, tarStream, dest, opts) {
 
     rimraf(dest)
       .then(() => mkdirp(dest))
+      .then((made) => {
+        // respect the current ownership of unpack targets
+        // but don't try to chown if we're not root.
+        if (selfOwner.uid === 0 &&
+            typeof selfOwner.gid === 'number' &&
+            selfOwner.uid !== opts.uid && selfOwner.gid !== opts.gid) {
+          return chown(made || dest, opts.uid, opts.gid)
+        }
+      })
       .then(() => {
         const xtractor = extractStream(spec, dest, opts)
         xtractor.on('error', reject)

package/lib/fetchers/file.js

@@ -60,8 +60,6 @@ Fetcher.impl(fetchFile, {
           : (pipe(
             fs.createReadStream(src),
             cacache.put.stream(opts.cache, `pacote:tarball:${src}`, {
-              uid: opts.uid,
-              gid: opts.gid,
               integrity: opts.integrity
             }).on('integrity', d => { integrity = d })
           ))

package/lib/fetchers/registry/manifest.js

@@ -27,7 +27,7 @@ function getManifest (spec, opts) {
         includeDeprecated: opts.includeDeprecated
       })
     } catch (err) {
-      if (err.code === 'ETARGET' && packument._cached && !opts.offline) {
+      if ((err.code === 'ETARGET' || err.code === 'E403') && packument._cached && !opts.offline) {
         opts.log.silly(
           'registry:manifest',
           `no matching version for ${spec.name}@${spec.fetchSpec} in the cache. Forcing revalidation.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "9.5.4",
+  "version": "9.5.8",
   "description": "JavaScript package downloader",
   "main": "index.js",
   "files": [
@@ -42,10 +42,12 @@
   "license": "MIT",
   "dependencies": {
     "bluebird": "^3.5.3",
-    "cacache": "^12.0.0",
+    "cacache": "^12.0.2",
+    "chownr": "^1.1.2",
     "figgy-pudding": "^3.5.1",
     "get-stream": "^4.1.0",
     "glob": "^7.1.3",
+    "infer-owner": "^1.0.4",
     "lru-cache": "^5.1.1",
     "make-fetch-happen": "^5.0.0",
     "minimatch": "^3.0.4",
@@ -55,7 +57,7 @@
     "normalize-package-data": "^2.4.0",
     "npm-package-arg": "^6.1.0",
     "npm-packlist": "^1.1.12",
-    "npm-pick-manifest": "^2.2.3",
+    "npm-pick-manifest": "^3.0.0",
     "npm-registry-fetch": "^4.0.0",
     "osenv": "^0.1.5",
     "promise-inflight": "^1.0.1",
@@ -65,7 +67,7 @@
     "safe-buffer": "^5.1.2",
     "semver": "^5.6.0",
     "ssri": "^6.0.1",
-    "tar": "^4.4.8",
+    "tar": "^4.4.10",
     "unique-filename": "^1.1.1",
     "which": "^1.3.1"
   },