Skip to content

Commit ca84b22

Browse files
committed
BREAKING CHANGE: `bun.lockb` files are now included in the strict ignore list during packing
1 parent 4906f3d commit ca84b22

32 files changed

+2467
-40
lines changed

mock-registry/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
"json-stringify-safe": "^5.0.1",
5353
"nock": "^13.3.3",
5454
"npm-package-arg": "^12.0.0",
55-
"pacote": "^20.0.0",
55+
"pacote": "^21.0.0",
5656
"tap": "^16.3.8"
5757
}
5858
}

node_modules/.gitignore

+5-3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@
2222
!/@npmcli/installed-package-contents
2323
!/@npmcli/map-workspaces
2424
!/@npmcli/metavuln-calculator
25+
!/@npmcli/metavuln-calculator/node_modules/
26+
/@npmcli/metavuln-calculator/node_modules/*
27+
!/@npmcli/metavuln-calculator/node_modules/npm-packlist
28+
!/@npmcli/metavuln-calculator/node_modules/pacote
2529
!/@npmcli/name-from-folder
2630
!/@npmcli/node-gyp
2731
!/@npmcli/package-json
@@ -175,6 +179,7 @@
175179
!/npm-install-checks
176180
!/npm-normalize-package-bin
177181
!/npm-package-arg
182+
!/npm-packlist
178183
!/npm-pick-manifest
179184
!/npm-profile
180185
!/npm-registry-fetch
@@ -185,9 +190,6 @@
185190
!/p-map
186191
!/package-json-from-dist
187192
!/pacote
188-
!/pacote/node_modules/
189-
/pacote/node_modules/*
190-
!/pacote/node_modules/npm-packlist
191193
!/parse-conflict-json
192194
!/path-key
193195
!/path-scurry
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
The ISC License
2+
3+
Copyright (c) Isaac Z. Schlueter, Kat Marchán, npm, Inc., and Contributors
4+
5+
Permission to use, copy, modify, and/or distribute this software for any
6+
purpose with or without fee is hereby granted, provided that the above
7+
copyright notice and this permission notice appear in all copies.
8+
9+
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10+
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11+
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12+
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13+
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14+
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
15+
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
#!/usr/bin/env node
2+
3+
const run = conf => {
4+
const pacote = require('../')
5+
switch (conf._[0]) {
6+
case 'resolve':
7+
case 'manifest':
8+
case 'packument':
9+
if (conf._[0] === 'resolve' && conf.long) {
10+
return pacote.manifest(conf._[1], conf).then(mani => ({
11+
resolved: mani._resolved,
12+
integrity: mani._integrity,
13+
from: mani._from,
14+
}))
15+
}
16+
return pacote[conf._[0]](conf._[1], conf)
17+
18+
case 'tarball':
19+
if (!conf._[2] || conf._[2] === '-') {
20+
return pacote.tarball.stream(conf._[1], stream => {
21+
stream.pipe(
22+
conf.testStdout ||
23+
/* istanbul ignore next */
24+
process.stdout
25+
)
26+
// make sure it resolves something falsey
27+
return stream.promise().then(() => {
28+
return false
29+
})
30+
}, conf)
31+
} else {
32+
return pacote.tarball.file(conf._[1], conf._[2], conf)
33+
}
34+
35+
case 'extract':
36+
return pacote.extract(conf._[1], conf._[2], conf)
37+
38+
default: /* istanbul ignore next */ {
39+
throw new Error(`bad command: ${conf._[0]}`)
40+
}
41+
}
42+
}
43+
44+
const version = require('../package.json').version
45+
const usage = () =>
46+
`Pacote - The JavaScript Package Handler, v${version}
47+
48+
Usage:
49+
50+
pacote resolve <spec>
51+
Resolve a specifier and output the fully resolved target
52+
Returns integrity and from if '--long' flag is set.
53+
54+
pacote manifest <spec>
55+
Fetch a manifest and print to stdout
56+
57+
pacote packument <spec>
58+
Fetch a full packument and print to stdout
59+
60+
pacote tarball <spec> [<filename>]
61+
Fetch a package tarball and save to <filename>
62+
If <filename> is missing or '-', the tarball will be streamed to stdout.
63+
64+
pacote extract <spec> <folder>
65+
Extract a package to the destination folder.
66+
67+
Configuration values all match the names of configs passed to npm, or
68+
options passed to Pacote. Additional flags for this executable:
69+
70+
--long Print an object from 'resolve', including integrity and spec.
71+
--json Print result objects as JSON rather than node's default.
72+
(This is the default if stdout is not a TTY.)
73+
--help -h Print this helpful text.
74+
75+
For example '--cache=/path/to/folder' will use that folder as the cache.
76+
`
77+
78+
const shouldJSON = (conf, result) =>
79+
conf.json ||
80+
!process.stdout.isTTY &&
81+
conf.json === undefined &&
82+
result &&
83+
typeof result === 'object'
84+
85+
const pretty = (conf, result) =>
86+
shouldJSON(conf, result) ? JSON.stringify(result, 0, 2) : result
87+
88+
let addedLogListener = false
89+
const main = args => {
90+
const conf = parse(args)
91+
if (conf.help || conf.h) {
92+
return console.log(usage())
93+
}
94+
95+
if (!addedLogListener) {
96+
process.on('log', console.error)
97+
addedLogListener = true
98+
}
99+
100+
try {
101+
return run(conf)
102+
.then(result => result && console.log(pretty(conf, result)))
103+
.catch(er => {
104+
console.error(er)
105+
process.exit(1)
106+
})
107+
} catch (er) {
108+
console.error(er.message)
109+
console.error(usage())
110+
}
111+
}
112+
113+
const parseArg = arg => {
114+
const split = arg.slice(2).split('=')
115+
const k = split.shift()
116+
const v = split.join('=')
117+
const no = /^no-/.test(k) && !v
118+
const key = (no ? k.slice(3) : k)
119+
.replace(/^tag$/, 'defaultTag')
120+
.replace(/-([a-z])/g, (_, c) => c.toUpperCase())
121+
const value = v ? v.replace(/^~/, process.env.HOME) : !no
122+
return { key, value }
123+
}
124+
125+
const parse = args => {
126+
const conf = {
127+
_: [],
128+
cache: process.env.HOME + '/.npm/_cacache',
129+
}
130+
let dashdash = false
131+
args.forEach(arg => {
132+
if (dashdash) {
133+
conf._.push(arg)
134+
} else if (arg === '--') {
135+
dashdash = true
136+
} else if (arg === '-h') {
137+
conf.help = true
138+
} else if (/^--/.test(arg)) {
139+
const { key, value } = parseArg(arg)
140+
conf[key] = value
141+
} else {
142+
conf._.push(arg)
143+
}
144+
})
145+
return conf
146+
}
147+
148+
if (module === require.main) {
149+
main(process.argv.slice(2))
150+
} else {
151+
module.exports = {
152+
main,
153+
run,
154+
usage,
155+
parseArg,
156+
parse,
157+
}
158+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
const { resolve } = require('node:path')
2+
const packlist = require('npm-packlist')
3+
const runScript = require('@npmcli/run-script')
4+
const tar = require('tar')
5+
const { Minipass } = require('minipass')
6+
const Fetcher = require('./fetcher.js')
7+
const FileFetcher = require('./file.js')
8+
const _ = require('./util/protected.js')
9+
const tarCreateOptions = require('./util/tar-create-options.js')
10+
11+
class DirFetcher extends Fetcher {
12+
constructor (spec, opts) {
13+
super(spec, opts)
14+
// just the fully resolved filename
15+
this.resolved = this.spec.fetchSpec
16+
17+
this.tree = opts.tree || null
18+
this.Arborist = opts.Arborist || null
19+
}
20+
21+
// exposes tarCreateOptions as public API
22+
static tarCreateOptions (manifest) {
23+
return tarCreateOptions(manifest)
24+
}
25+
26+
get types () {
27+
return ['directory']
28+
}
29+
30+
#prepareDir () {
31+
return this.manifest().then(mani => {
32+
if (!mani.scripts || !mani.scripts.prepare) {
33+
return
34+
}
35+
if (this.opts.ignoreScripts) {
36+
return
37+
}
38+
39+
// we *only* run prepare.
40+
// pre/post-pack is run by the npm CLI for publish and pack,
41+
// but this function is *also* run when installing git deps
42+
const stdio = this.opts.foregroundScripts ? 'inherit' : 'pipe'
43+
44+
return runScript({
45+
// this || undefined is because runScript will be unhappy with the default null value
46+
scriptShell: this.opts.scriptShell || undefined,
47+
pkg: mani,
48+
event: 'prepare',
49+
path: this.resolved,
50+
stdio,
51+
env: {
52+
npm_package_resolved: this.resolved,
53+
npm_package_integrity: this.integrity,
54+
npm_package_json: resolve(this.resolved, 'package.json'),
55+
},
56+
})
57+
})
58+
}
59+
60+
[_.tarballFromResolved] () {
61+
if (!this.tree && !this.Arborist) {
62+
throw new Error('DirFetcher requires either a tree or an Arborist constructor to pack')
63+
}
64+
65+
const stream = new Minipass()
66+
stream.resolved = this.resolved
67+
stream.integrity = this.integrity
68+
69+
const { prefix, workspaces } = this.opts
70+
71+
// run the prepare script, get the list of files, and tar it up
72+
// pipe to the stream, and proxy errors the chain.
73+
this.#prepareDir()
74+
.then(async () => {
75+
if (!this.tree) {
76+
const arb = new this.Arborist({ path: this.resolved })
77+
this.tree = await arb.loadActual()
78+
}
79+
return packlist(this.tree, { path: this.resolved, prefix, workspaces })
80+
})
81+
.then(files => tar.c(tarCreateOptions(this.package), files)
82+
.on('error', er => stream.emit('error', er)).pipe(stream))
83+
.catch(er => stream.emit('error', er))
84+
return stream
85+
}
86+
87+
manifest () {
88+
if (this.package) {
89+
return Promise.resolve(this.package)
90+
}
91+
92+
return this[_.readPackageJson](this.resolved)
93+
.then(mani => this.package = {
94+
...mani,
95+
_integrity: this.integrity && String(this.integrity),
96+
_resolved: this.resolved,
97+
_from: this.from,
98+
})
99+
}
100+
101+
packument () {
102+
return FileFetcher.prototype.packument.apply(this)
103+
}
104+
}
105+
module.exports = DirFetcher

0 commit comments

Comments
 (0)