pacote 9.5.8 → 9.5.12

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="9.5.12"></a>
+## [9.5.12](https://github.com/npm/pacote/compare/v9.5.11...v9.5.12) (2020-01-06)
+
+
+### Bug Fixes
+
+* **git:** Do not drop uid/gid when executing in root-owned directory ([d2f4176](https://github.com/npm/pacote/commit/d2f4176))
+
+
+
+<a name="9.5.11"></a>
+## [9.5.11](https://github.com/npm/pacote/compare/v9.5.10...v9.5.11) (2019-12-09)
+
+
+### Bug Fixes
+
+* sanitize and normalize package bin field ([6f229f7](https://github.com/npm/pacote/commit/6f229f7))
+
+
+
+<a name="9.5.10"></a>
+## [9.5.10](https://github.com/npm/pacote/compare/v9.5.9...v9.5.10) (2019-12-04)
+
+
+### Bug Fixes
+
+* Do not drop perms in git when not root ([5f33040](https://github.com/npm/pacote/commit/5f33040)), closes [#23](https://github.com/npm/pacote/issues/23)
+
+
+
+<a name="9.5.9"></a>
+## [9.5.9](https://github.com/npm/pacote/compare/v9.5.8...v9.5.9) (2019-10-29)
+
+
+### Bug Fixes
+
+* include peerDependenciesMeta in manifest ([7a400d3](https://github.com/npm/pacote/commit/7a400d3)), closes [/github.com/npm/cli/pull/224#issuecomment-547666807](https://github.com//github.com/npm/cli/pull/224/issues/issuecomment-547666807)
+
+
+
 <a name="9.5.8"></a>
 ## [9.5.8](https://github.com/npm/pacote/compare/v9.5.7...v9.5.8) (2019-08-20)
 

package/lib/fetchers/directory.js

@@ -9,6 +9,7 @@ const readJson = require('../util/read-json')
 const path = require('path')
 const pipe = BB.promisify(require('mississippi').pipe)
 const through = require('mississippi').through
+const normalizePackageBin = require('npm-normalize-package-bin')
 
 const readFileAsync = BB.promisify(require('fs').readFile)
 
@@ -63,7 +64,7 @@ Fetcher.impl(fetchDirectory, {
       } else {
         return pkg
       }
-    })
+    }).then(pkg => normalizePackageBin(pkg))
   },
 
   // As of npm@5, the npm installer doesn't pack + install directories: it just

package/lib/finalize-manifest.js

@@ -14,6 +14,7 @@ const pipe = BB.promisify(require('mississippi').pipe)
 const ssri = require('ssri')
 const tar = require('tar')
 const readJson = require('./util/read-json')
+const normalizePackageBin = require('npm-normalize-package-bin')
 
 // `finalizeManifest` takes as input the various kinds of manifests that
 // manifest handlers ('lib/fetchers/*.js#manifest()') return, and makes sure
@@ -83,6 +84,7 @@ function Manifest (pkg, fromTarball, fullMetadata) {
   this.os = pkg.os || fromTarball.os
   this.dependencies = pkg.dependencies || {}
   this.optionalDependencies = pkg.optionalDependencies || {}
+  this.peerDependenciesMeta = pkg.peerDependenciesMeta || {}
   this.devDependencies = pkg.devDependencies || {}
   const bundled = (
     pkg.bundledDependencies ||
@@ -104,17 +106,8 @@ function Manifest (pkg, fromTarball, fullMetadata) {
   this._shrinkwrap = pkg._shrinkwrap || fromTarball._shrinkwrap || null
   this.bin = pkg.bin || fromTarball.bin || null
 
-  if (this.bin && Array.isArray(this.bin)) {
-    // Code yanked from read-package-json.
-    const m = (pkg.directories && pkg.directories.bin) || '.'
-    this.bin = this.bin.reduce((acc, mf) => {
-      if (mf && mf.charAt(0) !== '.') {
-        const f = path.basename(mf)
-        acc[f] = path.join(m, mf)
-      }
-      return acc
-    }, {})
-  }
+  // turn arrays and strings into a legit object, strip out bad stuff
+  normalizePackageBin(this)
 
   this._id = null
 

package/lib/util/git.js

@@ -16,6 +16,7 @@ const promiseRetry = require('promise-retry')
 const uniqueFilename = require('unique-filename')
 const which = BB.promisify(require('which'))
 const semver = require('semver')
+const inferOwner = require('infer-owner')
 
 const GOOD_ENV_VARS = new Set([
   'GIT_ASKPASS',
@@ -181,10 +182,24 @@ function revs (repo, opts) {
   })
 }
 
+// infer the owner from the cwd git is operating in, if not the
+// process cwd, but only if we're root.
+// See: https://github.com/npm/cli/issues/624
+module.exports._cwdOwner = cwdOwner
+function cwdOwner (gitOpts, opts) {
+  const isRoot = process.getuid && process.getuid() === 0
+  if (!isRoot || !gitOpts.cwd) { return Promise.resolve() }
+
+  return BB.resolve(inferOwner(gitOpts.cwd).then(owner => {
+    gitOpts.uid = owner.uid
+    gitOpts.gid = owner.gid
+  }))
+}
+
 module.exports._exec = execGit
 function execGit (gitArgs, gitOpts, opts) {
   opts = optCheck(opts)
-  return checkGit(opts).then(gitPath => {
+  return BB.resolve(cwdOwner(gitOpts, opts).then(() => checkGit(opts).then(gitPath => {
     return promiseRetry((retry, number) => {
       if (number !== 1) {
         opts.log.silly('pacote', 'Retrying git command: ' + gitArgs.join(' ') + ' attempt # ' + number)
@@ -202,13 +217,13 @@ function execGit (gitArgs, gitOpts, opts) {
       maxTimeout: opts['fetch-retry-maxtimeout'],
       minTimeout: opts['fetch-retry-mintimeout']
     })
-  })
+  })))
 }
 
 module.exports._spawn = spawnGit
 function spawnGit (gitArgs, gitOpts, opts) {
   opts = optCheck(opts)
-  return checkGit(opts).then(gitPath => {
+  return BB.resolve(cwdOwner(gitOpts, opts).then(() => checkGit(opts).then(gitPath => {
     return promiseRetry((retry, number) => {
       if (number !== 1) {
         opts.log.silly('pacote', 'Retrying git command: ' + gitArgs.join(' ') + ' attempt # ' + number)
@@ -231,17 +246,20 @@ function spawnGit (gitArgs, gitOpts, opts) {
         return stdout
       })
     }, opts.retry)
-  })
+  })))
 }
 
+module.exports._mkOpts = mkOpts
 function mkOpts (_gitOpts, opts) {
   const gitOpts = {
     env: gitEnv()
   }
-  if (+opts.uid && !isNaN(opts.uid)) {
+  const isRoot = process.getuid && process.getuid() === 0
+  // don't change child process uid/gid if not root
+  if (+opts.uid && !isNaN(opts.uid) && isRoot) {
     gitOpts.uid = +opts.uid
   }
-  if (+opts.gid && !isNaN(opts.gid)) {
+  if (+opts.gid && !isNaN(opts.gid) && isRoot) {
     gitOpts.gid = +opts.gid
   }
   Object.assign(gitOpts, _gitOpts)

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "pacote",
-  "version": "9.5.8",
+  "version": "9.5.12",
   "description": "JavaScript package downloader",
+  "publishConfig": {
+    "tag": "v9-legacy"
+  },
   "main": "index.js",
   "files": [
     "*.js",
@@ -55,6 +58,7 @@
     "mississippi": "^3.0.0",
     "mkdirp": "^0.5.1",
     "normalize-package-data": "^2.4.0",
+    "npm-normalize-package-bin": "^1.0.0",
     "npm-package-arg": "^6.1.0",
     "npm-packlist": "^1.1.12",
     "npm-pick-manifest": "^3.0.0",