* fix(security): harden build-approval artifact identities on v10
Port of pnpm/pnpm#12294 (commit bf1b731ee6) to release/10.
Package-name entries in onlyBuiltDependencies (and allowBuilds) no longer
approve lifecycle scripts for artifacts whose identity a name cannot pin:
git, git-hosted tarball, direct tarball, and local directory dependencies.
To approve such an artifact explicitly, use its peer-suffix-free lockfile
depPath as the key — the GIT_DEP_PREPARE_NOT_ALLOWED hint, pnpm
ignored-builds, and pnpm approve-builds print exactly that key.
- AllowBuild policy functions identify packages by DepPath instead of
caller-supplied name/version. Identity trust is derived from the depPath
shape: a registry-style depPath (name@semver) is a trusted identity.
- The trust is sound because lockfile entries are structurally checked
wherever they are materialized into fetchable resolutions
(pkgSnapshotToResolution) and before rebuild runs scripts: a
registry-style key backed by a git, directory, or git-hosted tarball
resolution is rejected with ERR_PNPM_RESOLUTION_SHAPE_MISMATCH.
- preparePackage requires a pkgResolutionId and gates on the synthesized
name@<resolution id> depPath; scp-style git URLs are normalized to
ssh:// form in resolution ids and the git fetcher reuses
createGitHostedPkgId from the resolver.
- isGitHostedTarballUrl matches case-insensitively and is shared from
@pnpm/lockfile.utils; new removePeersSuffix() in @pnpm/dependency-path
and allowBuildKeyFromIgnoredBuild() in @pnpm/builder.policy.
- pnpm rebuild and approve-builds accept depPath specs for selecting and
approving artifact builds; installs rebuild ignored builds approved by
depPath keys.
- shell-quote is overridden to 1.8.4 (GHSA-w7jw-789q-3m8p /
CVE-2026-9277).
Differences from main: v10 has no lockfile resolution verifier, so the
structural pass lives in pkgSnapshotToResolution and the rebuild loop; the
AllowBuild policy keeps v10's boolean return; the revoked-approval
detection and global-virtual-store hash changes have no v10 counterpart.
* test: serve the direct-tarball fixture from an off-registry origin
The registry mock binds only localhost, so a hard-coded 127.0.0.1 URL is
refused in CI, and a tarball URL on the registry's own origin resolves as
a registry package, which defeats the direct-tarball identity the test
needs. An in-test HTTP server redirecting to the mock provides a separate
origin whose binding the test controls.
* test: approve the git-protocol licenses fixture by its depPath
A git-hosted artifact has an untrusted package identity, so the
ajv-keywords build has to be approved by its depPath. Pin the fixture to
the commit the depPath names.
* refactor: store link values before converting to references
* fix: use .sort() without localeCompare
https://github.com/pnpm/pnpm/pull/8128#discussion_r1614031566
> Nit, but you probably just want to call sort without a comparison
> function; these are already strings and locale compare is not a good
> comparison for anything but human readable strings since it will
> differ on different people's machines based on their language setting.
> I've hit this too many times before for code gen.
* feat: configure meta-updater to write test/tsconfig.json files
* fix: relative imports for __typings__
* chore: `pnpm run meta-updater`
* fix: explicitly use test/tsconfig.json for ts-jest
* test: create new @pnpm/test-ipc-server private util package
* test: use @pnpm/test-ipc-server for previously refactored tests
* test: use @pnpm/test-ipc-server for tests using json-append
* test: change how --no-bail is passed to avoid passing it to scripts
This test began failing after the conversion to use
`@pnpm/test-echo-server` since the `--no-bail` script was being passed
to scripts.
Changing how --no-bail is configured to fix this test.
* test: use @pnpm/test-ipc-server in exec/lifecycle fixture tests
* test: use @pnpm/test-ipc-server in pkg-manager/headless fixture tests
* test: use @pnpm/test-ipc-server in exec/prepare-package fixture tests
* test: switch pnpm test from json-append to @pnpm.e2e/hello-world-js-bin
* test: fix and re-enable 'rebuild multiple packages in correct order'
The pnpm-workspace.yaml file didn't contain all packages, causing:
```
2023-12-22T02:24:46.2277155Z FAIL test/recursive.ts
2023-12-22T02:24:46.2277881Z ● rebuild multiple packages in correct order
2023-12-22T02:24:46.2278348Z
2023-12-22T02:24:46.2278734Z expect(received).toStrictEqual(expected) // deep equality
2023-12-22T02:24:46.2279302Z
2023-12-22T02:24:46.2279517Z - Expected - 1
2023-12-22T02:24:46.2279932Z + Received + 0
2023-12-22T02:24:46.2280186Z
2023-12-22T02:24:46.2280791Z Array [
2023-12-22T02:24:46.2281256Z "project-1",
2023-12-22T02:24:46.2281733Z - "project-2",
2023-12-22T02:24:46.2282135Z ]
2023-12-22T02:24:46.2282334Z
2023-12-22T02:24:46.2282475Z 216 | }, [])
2023-12-22T02:24:46.2282870Z 217 |
2023-12-22T02:24:46.2283788Z > 218 | expect(server1.getMessages()).toStrictEqual(['project-1', 'project-2'])
2023-12-22T02:24:46.2284725Z | ^
2023-12-22T02:24:46.2285802Z 219 | expect(server2.getMessages()).toStrictEqual(['project-1', 'project-3'])
2023-12-22T02:24:46.2286683Z 220 | })
2023-12-22T02:24:46.2287049Z 221 |
2023-12-22T02:24:46.2287269Z
2023-12-22T02:24:46.2287588Z at Object.<anonymous> (test/recursive.ts:218:33)
```
