Skip to content

Commit a7334da

Browse files
imsnifarcanis
imsnif
authored and
arcanis
committed
feat(checksums): add integrity field with sha512 authentication to yarn.lock (#5042)
* test(fixtures): adjust yarn.lock and snapshots with integrity field as needed * test(integrity): adjust existing cases to integrity field authentication * test(fixtures): integrity field authentication cases * test(integrity): integration and unit tests for the lockfile integrity field * chore(deps): add ssri module * feat(checksums): add integrity field with sha512 authentication to yarn.lock * test(integrity): additional sri string options * fix(checksums): better error when algorithms are not supported * fix(checksums): proper error message for bad hash in node <= 6 * chore(integrity): fixed new flow issues * test(integrity): adjust additional test case * test(fixtures): additional integrity field authentication cases * fix(integrity): update integrity for offline-mirror cases * style(integrity): clarify conditional for flow * fix(integrity): throw sync error rather than rejecting it * Update yarn.lock with new integrity field * Upgrade ssri * Use the latest version of the SSRI package * Optimize integrity matching from lockfile a bit * Refactor digest support determination * test(error): fixed expected error wording * fix(checksum): fail validation on malformed hash or integrity * fix(test): verify integrity failure on malformed integrity string * test(fixtures): add install auth malformed integrity fixture * chore(deps): update dependency eslint-config-fb-strict to ^22.0.0 (#5570) **Summary** This Pull Request updates dependency eslint-config-fb-strict from ^20.1.0-delta.3 to ^22.0.0 **Test plan** `yarn lint` should pass. * chore(jest): Upgrade Jest flow types (#5573) **Summary** Follow up to #5569. **Test plan** `yarn lint` should pass without errors. * ci(appveyor): Fix AppVeyor tests (#5574) * ci(appveyor): Fix AppVeyor tests **Summary** Jest 22.4.x mocks the process object without a proper stub for `process.mainModule`. In our lifecycle code, we try to set `env.npm_execpath` when it is not defined by using `process.mainModule.filename`. When running tests on AppVeyor, we run Jest directly, thus we don't have `env.npm_execpath` set, triggering the `process.mainModule` code path which is also not set, causing tests to fail. **Test plan** AppVeyor builds should pass. * Fix tests * Add missing package cache * Bring --update-checksums back * Fix tests * Bring --update-checksums back * Fix Flow error * Fix error w/ updateChecksums * Update ssri semver in package.json * Stabilize TarballFetcher.fetch tests * Moar test fixes * test(update-checksums): make sure the flag works when integrity is malformed * fix(updateChecksums): minor issues and edge cases * Revert unrelated change ahead of 'imsnif/master' by 1 commit. * Slight refactor in lockfile parser * test(fixtures): update integrity and dep versions * fix(checksums): create integrity when importing from node_modules * test(fixtures): add integrity field to expected yarn.lock * Fixes error reporting * Fixes error reporting * Fixes tests
1 parent 94933a8 commit a7334da

File tree

170 files changed

+4865
-375
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

170 files changed

+4865
-375
lines changed

‎__tests__/__snapshots__/fetchers.js.snap‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎__tests__/commands/add.js‎

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,10 @@ test.concurrent('adding to the workspace root should preserve workspace packages
6565
expect(pkg.dependencies).toEqual({'left-pad': '1.1.3', 'max-safe-integer': '1.0.0'});
6666

6767
const lockfile = explodeLockfile(await fs.readFile(path.join(config.cwd, 'yarn.lock')));
68-
expect(lockfile).toHaveLength(15);
68+
expect(lockfile).toHaveLength(20);
6969
expect(lockfile.indexOf('[email protected]:')).toEqual(0);
70-
expect(lockfile.indexOf('[email protected]:')).toEqual(3);
71-
expect(lockfile.indexOf('[email protected]:')).toEqual(6);
70+
expect(lockfile.indexOf('[email protected]:')).toEqual(4);
71+
expect(lockfile.indexOf('[email protected]:')).toEqual(8);
7272
});
7373
});
7474

@@ -107,6 +107,28 @@ test.concurrent('adds any new package to the current workspace, but install from
107107
});
108108
});
109109

110+
test.concurrent('add creates an entry with a sha512 integrity field', () => {
111+
return runAdd(['[email protected]'], {}, 'add-integrity-sha512', async config => {
112+
const lockfile = explodeLockfile(await fs.readFile(path.join(config.cwd, 'yarn.lock')));
113+
expect(
114+
lockfile[3].indexOf(
115+
'integrity sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg==',
116+
),
117+
).toEqual(2);
118+
expect(lockfile[2].indexOf('#893312af69b2123def71f57889001671eeb2c853"')).toBeGreaterThan(0);
119+
// backwards compatibility
120+
});
121+
});
122+
123+
test.concurrent('add creates an entry with a sha1 integrity field when sha512 is unavailable', () => {
124+
return runAdd(['[email protected]'], {}, 'add-integrity-sha1', async config => {
125+
const lockfile = explodeLockfile(await fs.readFile(path.join(config.cwd, 'yarn.lock')));
126+
expect(lockfile[3].indexOf('integrity sha1-R6La9YHt5FQzTe5sYDbK4A2RLk0=')).toEqual(2);
127+
expect(lockfile[2].indexOf('#47a2daf581ede454334dee6c6036cae00d912e4d')).toBeGreaterThan(0);
128+
// backwards compatibility
129+
});
130+
});
131+
110132
test.concurrent('install with arg', async () => {
111133
await runAdd(['is-online'], {}, 'install-with-arg');
112134
});
@@ -288,7 +310,7 @@ test.concurrent('add should ignore cache', async () => {
288310

289311
const lockFileWritten = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
290312
const lockFileLines = explodeLockfile(lockFileWritten);
291-
expect(lockFileLines).toHaveLength(3);
313+
expect(lockFileLines).toHaveLength(4);
292314
expect(lockFileLines[0]).toEqual('[email protected]:');
293315
expect(lockFileLines[2]).toMatch(
294316
/resolved "https:\/\/registry\.yarnpkg\.com\/left-pad\/-\/left-pad-1\.1\.0\.tgz#[a-f0-9]+"/,
@@ -378,9 +400,9 @@ test.concurrent('install --initMirror should add init mirror deps from package.j
378400

379401
const lockFileContent = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
380402
const lockFileLines = explodeLockfile(lockFileContent);
381-
expect(lockFileLines).toHaveLength(8);
403+
expect(lockFileLines).toHaveLength(10);
382404
expect(lockFileLines[0].indexOf('mime-db@')).toEqual(0);
383-
expect(lockFileLines[3].indexOf('[email protected]')).toEqual(0);
405+
expect(lockFileLines[4].indexOf('[email protected]')).toEqual(0);
384406
});
385407
});
386408

@@ -410,7 +432,7 @@ test.concurrent('add with new dependency should be deterministic', async () => {
410432
const lockFileWritten = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
411433
const lockFileLines = explodeLockfile(lockFileWritten);
412434

413-
expect(lockFileLines).toHaveLength(11);
435+
expect(lockFileLines).toHaveLength(14);
414436
expect(lockFileLines.indexOf('mime-db@~1.0.1:')).toBeGreaterThanOrEqual(0);
415437
expect(lockFileLines.indexOf('[email protected]:')).toBeGreaterThanOrEqual(0);
416438
expect(lockFileLines.indexOf('[email protected]:')).toBeGreaterThanOrEqual(0);
@@ -449,7 +471,7 @@ test.concurrent('add with new dependency should be deterministic 2', async () =>
449471
const lockFileWritten = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
450472
const lockFileLines = explodeLockfile(lockFileWritten);
451473
// see why we don't cleanup lockfile https://github.com/yarnpkg/yarn/issues/79
452-
expect(lockFileLines).toHaveLength(11);
474+
expect(lockFileLines).toHaveLength(14);
453475

454476
const mirror = await fs.walk(path.join(config.cwd, mirrorPath));
455477
expect(mirror).toHaveLength(3);
@@ -556,7 +578,7 @@ test.concurrent('upgrade scenario', async () => {
556578

557579
const lockFileWritten = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
558580
const lockFileLines = explodeLockfile(lockFileWritten);
559-
expect(lockFileLines).toHaveLength(3);
581+
expect(lockFileLines).toHaveLength(4);
560582
expect(lockFileLines[0]).toEqual('[email protected]:');
561583
expect(lockFileLines[2]).toMatch(
562584
/resolved "https:\/\/registry\.yarnpkg\.com\/left-pad\/-\/left-pad-0\.0\.9\.tgz#[a-f0-9]+"/,
@@ -578,7 +600,7 @@ test.concurrent('upgrade scenario', async () => {
578600

579601
const lockFileWritten2 = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
580602
const lockFileLines2 = explodeLockfile(lockFileWritten2);
581-
expect(lockFileLines2).toHaveLength(3);
603+
expect(lockFileLines2).toHaveLength(4);
582604
expect(lockFileLines2[0]).toEqual('[email protected]:');
583605
expect(lockFileLines2[2]).toMatch(
584606
/resolved "https:\/\/registry\.yarnpkg\.com\/left-pad\/-\/left-pad-1.1.0.tgz#[a-f0-9]+"/,
@@ -613,8 +635,8 @@ test.concurrent('upgrade scenario 2 (with sub dependencies)', async () => {
613635
expect(lockFileLines[0]).toEqual('mime-db@~1.23.0:');
614636
expect(lockFileLines[2]).toMatch(/resolved "https:\/\/registry\.yarnpkg\.com\/mime-db\/-\/mime-db-/);
615637

616-
expect(lockFileLines[3]).toEqual('[email protected]:');
617-
expect(lockFileLines[5]).toMatch(
638+
expect(lockFileLines[4]).toEqual('[email protected]:');
639+
expect(lockFileLines[6]).toMatch(
618640
/resolved "https:\/\/registry\.yarnpkg\.com\/mime-types\/-\/mime-types-2\.1\.11\.tgz#[a-f0-9]+"/,
619641
);
620642

@@ -665,7 +687,7 @@ test.concurrent('downgrade scenario', async () => {
665687
const mirrorPath = 'mirror-for-offline';
666688
const lockFileWritten = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
667689
const lockFileLines = explodeLockfile(lockFileWritten);
668-
expect(lockFileLines).toHaveLength(3);
690+
expect(lockFileLines).toHaveLength(4);
669691
expect(lockFileLines[0]).toEqual('[email protected]:');
670692
expect(lockFileLines[2]).toMatch(
671693
/resolved "https:\/\/registry\.yarnpkg\.com\/left-pad\/-\/left-pad-1\.1\.0\.tgz#[a-f0-9]+"/,
@@ -686,7 +708,7 @@ test.concurrent('downgrade scenario', async () => {
686708

687709
const lockFileWritten2 = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
688710
const lockFileLines2 = explodeLockfile(lockFileWritten2);
689-
expect(lockFileLines2).toHaveLength(3);
711+
expect(lockFileLines2).toHaveLength(4);
690712
expect(lockFileLines2[0]).toEqual('[email protected]:');
691713
expect(lockFileLines2[2]).toMatch(
692714
/resolved "https:\/\/registry\.yarnpkg\.com\/left-pad\/-\/left-pad-0\.0\.9\.tgz#[a-f0-9]+"/,

‎__tests__/commands/install/__snapshots__/integration.js.snap‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,3 @@
11
// Jest Snapshot v1, https://goo.gl/fbAQLP
22

3-
exports[`don't install with file: protocol as default if target is valid semver: install-file-as-default-no-semver 1`] = `
4-
"{
5-
\\"author\\": \\"AJ ONeal <[email protected]> (http://coolaj86.info)\\",
6-
\\"name\\": \\"foo\\",
7-
\\"description\\": \\"A test module with no \`main\`, \`lib\`, or \`dependencies\` specified\\",
8-
\\"version\\": \\"1.0.0\\",
9-
\\"repository\\": {
10-
\\"type\\": \\"git\\",
11-
\\"url\\": \\"git://github.com/coolaj86/node-pakman.git\\"
12-
},
13-
\\"engines\\": {
14-
\\"node\\": \\">= v0.2\\"
15-
}
16-
}
17-
"
18-
`;
3+
exports[`install should authenticate integrity field with combined sha1 and sha512 checksums: integrity stable 1`] = `" integrity \\"sha1-iTMSr2myEj3vcfV4iQAWce6yyFM= sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg==\\""`;

0 commit comments

Comments
 (0)