Skip to content

Commit 20ef5a5

Browse files
wraithgarwraithgar
committed
1 parent 880ecb7 commit 20ef5a5

File tree

6 files changed

+19
-13
lines changed

6 files changed

+19
-13
lines changed

‎DEPENDENCIES.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -654,6 +654,7 @@ graph LR;
654654
npmcli-smoke-tests-->which;
655655
pacote-->cacache;
656656
pacote-->fs-minipass;
657+
pacote-->gar-promise-retry["@gar/promise-retry"];
657658
pacote-->minipass;
658659
pacote-->npm-package-arg;
659660
pacote-->npm-packlist;
@@ -665,7 +666,6 @@ graph LR;
665666
pacote-->npmcli-promise-spawn["@npmcli/promise-spawn"];
666667
pacote-->npmcli-run-script["@npmcli/run-script"];
667668
pacote-->proc-log;
668-
pacote-->promise-retry;
669669
pacote-->sigstore;
670670
pacote-->ssri;
671671
pacote-->tar;

‎node_modules/pacote/lib/fetcher.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ const cacache = require('cacache')
1010
const fsm = require('fs-minipass')
1111
const getContents = require('@npmcli/installed-package-contents')
1212
const npa = require('npm-package-arg')
13-
const retry = require('promise-retry')
13+
const { promiseRetry } = require('@gar/promise-retry')
1414
const ssri = require('ssri')
1515
const tar = require('tar')
1616
const { Minipass } = require('minipass')
@@ -319,7 +319,7 @@ class FetcherBase {
319319
this.spec
320320
}. Extracting by manifest.`)
321321
}
322-
return this.resolve().then(() => retry(tryAgain =>
322+
return this.resolve().then(() => promiseRetry(tryAgain =>
323323
streamHandler(this.#istream(this[_.tarballFromResolved]()))
324324
.catch(streamErr => {
325325
// Most likely data integrity. A cache ENOENT error is unlikely
@@ -502,6 +502,7 @@ FetcherBase.get = (rawSpec, opts = {}) => {
502502
case 'range':
503503
case 'tag':
504504
case 'alias':
505+
canUse({ allow: opts.allowRegistry, isRoot: opts._isRoot, allowType: 'registry', spec })
505506
return new RegistryFetcher(spec.subSpec || spec, opts)
506507

507508
case 'file':

‎node_modules/pacote/lib/registry.js‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ class RegistryFetcher extends Fetcher {
229229
if (this.opts.verifyAttestations) {
230230
// Always fetch attestations from the current registry host
231231
const attestationsPath = new URL(dist.attestations.url).pathname
232-
const attestationsUrl = removeTrailingSlashes(this.registry) + attestationsPath
232+
const attestationsUrl = new URL(attestationsPath, this.registry).href
233233
const res = await fetch(attestationsUrl, {
234234
...this.opts,
235235
// disable integrity check for attestations json payload, we check the
@@ -256,7 +256,10 @@ class RegistryFetcher extends Fetcher {
256256
const attestationKeyIds = bundles.map((b) => b.keyid).filter((k) => !!k)
257257
const attestationRegistryKeys = (this.registryKeys || [])
258258
.filter(key => attestationKeyIds.includes(key.keyid))
259-
if (!attestationRegistryKeys.length) {
259+
// Only require registry keys when there are keyed attestations.
260+
// Keyless (Sigstore/Fulcio) attestations embed their signing
261+
// certificate in the bundle and don't need registry keys.
262+
if (attestationKeyIds.length > 0 && !attestationRegistryKeys.length) {
260263
throw Object.assign(new Error(
261264
`${mani._id} has attestations but no corresponding public key(s) can be found`
262265
), { code: 'EMISSINGSIGNATUREKEY' })

‎node_modules/pacote/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "pacote",
3-
"version": "21.3.1",
3+
"version": "21.4.0",
44
"description": "JavaScript package downloader",
55
"author": "GitHub Inc.",
66
"bin": {
@@ -46,6 +46,7 @@
4646
"git"
4747
],
4848
"dependencies": {
49+
"@gar/promise-retry": "^1.0.0",
4950
"@npmcli/git": "^7.0.0",
5051
"@npmcli/installed-package-contents": "^4.0.0",
5152
"@npmcli/package-json": "^7.0.0",
@@ -59,7 +60,6 @@
5960
"npm-pick-manifest": "^11.0.1",
6061
"npm-registry-fetch": "^19.0.0",
6162
"proc-log": "^6.0.0",
62-
"promise-retry": "^2.0.1",
6363
"sigstore": "^4.0.0",
6464
"ssri": "^13.0.0",
6565
"tar": "^7.4.3"

‎package-lock.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@
133133
"npm-registry-fetch": "^19.1.1",
134134
"npm-user-validate": "^4.0.0",
135135
"p-map": "^7.0.4",
136-
"pacote": "^21.3.1",
136+
"pacote": "^21.4.0",
137137
"parse-conflict-json": "^5.0.1",
138138
"proc-log": "^6.1.0",
139139
"qrcode-terminal": "^0.12.0",
@@ -1181,6 +1181,7 @@
11811181
"version": "1.0.0",
11821182
"resolved": "https://registry.npmjs.org/@gar/promise-retry/-/promise-retry-1.0.0.tgz",
11831183
"integrity": "sha512-KcKKfklNXm3lop072VT58NnhnZYmMJmgKps9aqRT58tRDt939lnBT0frYR052xDpX6kdQB4AU05l/P3LU7dZxg==",
1184+
"inBundle": true,
11841185
"license": "MIT",
11851186
"dependencies": {
11861187
"retry": "^0.13.1"
@@ -1193,6 +1194,7 @@
11931194
"version": "0.13.1",
11941195
"resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
11951196
"integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
1197+
"inBundle": true,
11961198
"license": "MIT",
11971199
"engines": {
11981200
"node": ">= 4"
@@ -9103,12 +9105,13 @@
91039105
"license": "BlueOak-1.0.0"
91049106
},
91059107
"node_modules/pacote": {
9106-
"version": "21.3.1",
9107-
"resolved": "https://registry.npmjs.org/pacote/-/pacote-21.3.1.tgz",
9108-
"integrity": "sha512-O0EDXi85LF4AzdjG74GUwEArhdvawi/YOHcsW6IijKNj7wm8IvEWNF5GnfuxNpQ/ZpO3L37+v8hqdVh8GgWYhg==",
9108+
"version": "21.4.0",
9109+
"resolved": "https://registry.npmjs.org/pacote/-/pacote-21.4.0.tgz",
9110+
"integrity": "sha512-DR7mn7HUOomAX1BORnpYy678qVIidbvOojkBscqy27dRKN+s/hLeQT1MeYYrx1Cxh62jyKjiWiDV7RTTqB+ZEQ==",
91099111
"inBundle": true,
91109112
"license": "ISC",
91119113
"dependencies": {
9114+
"@gar/promise-retry": "^1.0.0",
91129115
"@npmcli/git": "^7.0.0",
91139116
"@npmcli/installed-package-contents": "^4.0.0",
91149117
"@npmcli/package-json": "^7.0.0",
@@ -9122,7 +9125,6 @@
91229125
"npm-pick-manifest": "^11.0.1",
91239126
"npm-registry-fetch": "^19.0.0",
91249127
"proc-log": "^6.0.0",
9125-
"promise-retry": "^2.0.1",
91269128
"sigstore": "^4.0.0",
91279129
"ssri": "^13.0.0",
91289130
"tar": "^7.4.3"

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@
101101
"npm-registry-fetch": "^19.1.1",
102102
"npm-user-validate": "^4.0.0",
103103
"p-map": "^7.0.4",
104-
"pacote": "^21.3.1",
104+
"pacote": "^21.4.0",
105105
"parse-conflict-json": "^5.0.1",
106106
"proc-log": "^6.1.0",
107107
"qrcode-terminal": "^0.12.0",

0 commit comments

Comments
 (0)