mirror of
https://github.com/pnpm/pnpm.git
synced 2026-06-10 17:34:53 -04:00
3d50680eda
Follow-up to #12292 (which verifies the **package-manager** binary). This closes the same class of gap for the **Node.js runtime**. When a repository requests a Node.js runtime — `devEngines.runtime: node@X` (with `onFail: download`, the default) or `useNodeVersion` — pnpm downloads and then executes a Node binary (it's used to run lifecycle / `run` / `exec` scripts). The download **mirror is repository-configurable** via `node-mirror:<channel>` (`nodeDownloadMirrors`) in project `.npmrc`, and the integrity comes from `SHASUMS256.txt` fetched **from that same mirror**. That's a circular check: a malicious mirror serves a tampered `node` tarball **and** a matching `SHASUMS256.txt`, the sha256 check passes, and pnpm runs the binary. Drive-by on a normal command in a cloned repo. ## Fix pnpm now fetches `SHASUMS256.txt.sig` and verifies its **detached OpenPGP signature** against the **Node.js release team's public keys, embedded in the pnpm CLI**, before trusting the hashes. A mirror that serves a tampered binary cannot also produce a valid signature, so verification fails. Any faithful mirror (one that proxies the real signed SHASUMS) keeps working. - `@pnpm/crypto.shasums-file`: new `fetchVerifiedNodeShasums` / `fetchVerifiedNodeShasumsFile` verify the signature via `openpgp` against the embedded keys. - The keys live in a generated file (`src/nodeReleaseKeys.ts`, 28 keys) mirrored from the canonical `nodejs/release-keys` list. `crypto/shasums-file/scripts/update-node-release-keys.mjs` keeps them current (`pnpm check:node-release-keys` / `--update`), and the **create-release-pr** workflow runs the check as a gate so a new release signer can't silently break verification. - `@pnpm/engine.runtime.node-resolver` verifies the **configurable-mirror** SHASUMS. The hardcoded `unofficial-builds.nodejs.org` musl mirror is **not** repo-configurable and is signed by a different key, so it stays trusted over TLS. ## Scope - **Pre-release channels (rc, nightly, …) are not verified** — Node only signs the `release` channel (no `SHASUMS256.txt.sig` exists for them, even on nodejs.org), so they remain unverifiable. Verification is gated on the `release` channel. - **Bun / Deno are unaffected** — their download/SHASUMS URLs are hardcoded to canonical GitHub (`github.com/oven-sh/bun`, `api.github.com/repos/denoland/deno`), not mirror-configurable, so a repo can't redirect them. - **Pacquet parity:** `pacquet/crates/engine-runtime-node-resolver` has the same mirror-configurable SHASUMS logic and needs the equivalent Rust port — tracked as a follow-up (per the repo's parity rule, opening the TS side first).
208 lines
11 KiB
TOML
208 lines
11 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = ["pacquet/crates/*", "pacquet/tasks/*", "pnpr/crates/*"]
|
|
|
|
[workspace.package]
|
|
authors = ["Yagiz Nizipli <yagiz@nizipli.com"]
|
|
description = "Pacquet"
|
|
edition = "2024"
|
|
homepage = "https://github.com/pnpm/pacquet"
|
|
keywords = ["nodejs", "package", "manager", "pnpm", "npm"]
|
|
license = "MIT"
|
|
repository = "https://github.com/pnpm/pacquet"
|
|
|
|
[workspace.dependencies]
|
|
# Crates
|
|
pacquet-pnpr-client = { path = "pacquet/crates/pnpr-client" }
|
|
pacquet-catalogs-config = { path = "pacquet/crates/catalogs-config" }
|
|
pacquet-catalogs-protocol-parser = { path = "pacquet/crates/catalogs-protocol-parser" }
|
|
pacquet-catalogs-resolver = { path = "pacquet/crates/catalogs-resolver" }
|
|
pacquet-catalogs-types = { path = "pacquet/crates/catalogs-types" }
|
|
pacquet-cli = { path = "pacquet/crates/cli" }
|
|
pacquet-cmd-shim = { path = "pacquet/crates/cmd-shim" }
|
|
pacquet-crypto-hash = { path = "pacquet/crates/crypto-hash" }
|
|
pacquet-crypto-shasums-file = { path = "pacquet/crates/crypto-shasums-file" }
|
|
pacquet-engine-runtime-bun-resolver = { path = "pacquet/crates/engine-runtime-bun-resolver" }
|
|
pacquet-engine-runtime-deno-resolver = { path = "pacquet/crates/engine-runtime-deno-resolver" }
|
|
pacquet-engine-runtime-node-resolver = { path = "pacquet/crates/engine-runtime-node-resolver" }
|
|
pacquet-env-installer = { path = "pacquet/crates/env-installer" }
|
|
pacquet-env-replace = { path = "pacquet/crates/env-replace" }
|
|
pacquet-fs = { path = "pacquet/crates/fs" }
|
|
pacquet-registry = { path = "pacquet/crates/registry" }
|
|
pacquet-tarball = { path = "pacquet/crates/tarball" }
|
|
pacquet-testing-utils = { path = "pacquet/crates/testing-utils" }
|
|
pacquet-package-manifest = { path = "pacquet/crates/package-manifest" }
|
|
pacquet-package-manager = { path = "pacquet/crates/package-manager" }
|
|
pacquet-package-is-installable = { path = "pacquet/crates/package-is-installable" }
|
|
pacquet-lockfile = { path = "pacquet/crates/lockfile" }
|
|
pacquet-lockfile-preferred-versions = { path = "pacquet/crates/lockfile-preferred-versions" }
|
|
pacquet-lockfile-verification = { path = "pacquet/crates/lockfile-verification" }
|
|
pacquet-modules-yaml = { path = "pacquet/crates/modules-yaml" }
|
|
pacquet-network = { path = "pacquet/crates/network" }
|
|
pacquet-config = { path = "pacquet/crates/config" }
|
|
pacquet-config-dir = { path = "pacquet/crates/config-dir" }
|
|
pacquet-config-parse-overrides = { path = "pacquet/crates/config-parse-overrides" }
|
|
pacquet-executor = { path = "pacquet/crates/executor" }
|
|
pacquet-exportable-manifest = { path = "pacquet/crates/exportable-manifest" }
|
|
pacquet-directory-fetcher = { path = "pacquet/crates/directory-fetcher" }
|
|
pacquet-git-fetcher = { path = "pacquet/crates/git-fetcher" }
|
|
pacquet-deps-path = { path = "pacquet/crates/deps-path" }
|
|
pacquet-detect-libc = { path = "pacquet/crates/detect-libc" }
|
|
pacquet-diagnostics = { path = "pacquet/crates/diagnostics" }
|
|
pacquet-graph-hasher = { path = "pacquet/crates/graph-hasher" }
|
|
pacquet-hooks = { path = "pacquet/crates/hooks" }
|
|
pacquet-store-dir = { path = "pacquet/crates/store-dir" }
|
|
pacquet-reporter = { path = "pacquet/crates/reporter" }
|
|
pacquet-patching = { path = "pacquet/crates/patching" }
|
|
pacquet-real-hoist = { path = "pacquet/crates/real-hoist" }
|
|
pacquet-resolving-default-resolver = { path = "pacquet/crates/resolving-default-resolver" }
|
|
pacquet-resolving-deps-resolver = { path = "pacquet/crates/resolving-deps-resolver" }
|
|
pacquet-resolving-git-resolver = { path = "pacquet/crates/resolving-git-resolver" }
|
|
pacquet-resolving-jsr-specifier-parser = { path = "pacquet/crates/resolving-jsr-specifier-parser" }
|
|
pacquet-resolving-local-resolver = { path = "pacquet/crates/resolving-local-resolver" }
|
|
pacquet-resolving-npm-resolver = { path = "pacquet/crates/resolving-npm-resolver" }
|
|
pacquet-resolving-parse-wanted-dependency = { path = "pacquet/crates/resolving-parse-wanted-dependency" }
|
|
pacquet-resolving-resolver-base = { path = "pacquet/crates/resolving-resolver-base" }
|
|
pacquet-resolving-tarball-resolver = { path = "pacquet/crates/resolving-tarball-resolver" }
|
|
pacquet-workspace = { path = "pacquet/crates/workspace" }
|
|
pacquet-workspace-manifest-writer = { path = "pacquet/crates/workspace-manifest-writer" }
|
|
pacquet-workspace-projects-filter = { path = "pacquet/crates/workspace-projects-filter" }
|
|
pacquet-workspace-projects-graph = { path = "pacquet/crates/workspace-projects-graph" }
|
|
pacquet-workspace-range-resolver = { path = "pacquet/crates/workspace-range-resolver" }
|
|
pacquet-workspace-spec = { path = "pacquet/crates/workspace-spec" }
|
|
pacquet-workspace-state = { path = "pacquet/crates/workspace-state" }
|
|
|
|
# Tasks
|
|
pacquet-registry-mock = { path = "pacquet/tasks/registry-mock" }
|
|
|
|
# Registry (sibling project — pnpm-compatible registry server)
|
|
pnpr = { path = "pnpr/crates/pnpr" }
|
|
pnpr-fixtures = { path = "pnpr/crates/pnpr-fixtures" }
|
|
|
|
# Dependencies
|
|
async-recursion = { version = "1.1.1" }
|
|
async-trait = { version = "0.1.83" }
|
|
axum = { version = "0.8.7", default-features = false, features = [
|
|
"http1",
|
|
"tokio",
|
|
"json",
|
|
"matched-path",
|
|
"original-uri",
|
|
] }
|
|
clap = { version = "4", features = ["derive", "string"] }
|
|
command-extra = { version = "1.0.0" }
|
|
base64 = { version = "0.22.1" }
|
|
bcrypt = { version = "0.19.1" }
|
|
bytes = { version = "1.11.0" }
|
|
chrono = { version = "0.4.44", default-features = false, features = ["clock"] }
|
|
dashmap = { version = "6.2.1" }
|
|
derive_more = { version = "2.1.1", features = ["full"] }
|
|
dialoguer = { version = "0.11.0", default-features = false }
|
|
diffy = { version = "0.5.0" }
|
|
dunce = { version = "1.0.5" }
|
|
home = { version = "0.5.12" }
|
|
httpdate = { version = "1.0.3" }
|
|
ignore = { version = "0.4.25" }
|
|
indexmap = { version = "2.14.0", features = ["serde"] }
|
|
insta = { version = "1.47.2", features = ["yaml", "glob", "walkdir"] }
|
|
itertools = { version = "0.14.0" }
|
|
libsql = { version = "0.9.30", default-features = false, features = ["core", "remote", "replication"] }
|
|
futures-util = { version = "0.3.32" }
|
|
flate2 = { version = "1.1.9" }
|
|
gethostname = { version = "1" }
|
|
getrandom = { version = "0.4.2" }
|
|
miette = { version = "7.6.0", features = ["fancy"] }
|
|
num_cpus = { version = "1.17.0" }
|
|
object_store = { version = "0.12", features = ["aws"] }
|
|
os_display = { version = "0.1.4" }
|
|
owo-colors = { version = "4", features = ["supports-colors"] }
|
|
reflink-copy = { version = "0.1.29" }
|
|
junction = { version = "2.0.0" }
|
|
libc = { version = "0.2.186" }
|
|
reqwest = { version = "0.13", default-features = false, features = [
|
|
"gzip",
|
|
"hickory-dns",
|
|
"json",
|
|
"rustls",
|
|
"socks",
|
|
"stream",
|
|
] }
|
|
node-semver = { version = "2.2.0" }
|
|
pathdiff = { version = "0.2.3" }
|
|
pipe-trait = { version = "0.4.0" }
|
|
pgp = { version = "0.19.0", default-features = false }
|
|
rayon = { version = "1.12.0" }
|
|
rmp-serde = { version = "1.3.0" }
|
|
rusqlite = { version = "0.39.0", features = ["bundled"] }
|
|
serde = { version = "1.0.228", features = ["derive"] }
|
|
serde_json = { version = "1.0.150", features = ["preserve_order"] }
|
|
serde-saphyr = { version = "0.0.27" }
|
|
# 0.11 removes the LowerHex impl on Output; revisit after upstream/consumers catch up
|
|
sha2 = { version = "0.10.9" }
|
|
smart-default = { version = "0.7.1" }
|
|
split-first-char = { version = "2.0.1" }
|
|
ssri = { version = "9.2.0" }
|
|
strum = { version = "0.28.0", features = ["derive"] }
|
|
sysinfo = { version = "0.39.2" }
|
|
tabled = { version = "0.20" }
|
|
tar = { version = "0.4.46" }
|
|
text-block-macros = { version = "0.2.0" }
|
|
tower = { version = "0.5.3" }
|
|
tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
|
|
tracing = { version = "0.1.44" }
|
|
tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "fs", "io-util", "net", "signal", "sync"] }
|
|
walkdir = { version = "2.5.0" }
|
|
yaml_serde = { version = "0.10.4" }
|
|
yamlpatch = { version = "1.25.2" }
|
|
yamlpath = { version = "1.25.2" }
|
|
wax = { version = "0.7.0" }
|
|
which = { version = "8.0.2" }
|
|
zip = { version = "8", default-features = false, features = ["deflate"] }
|
|
zune-inflate = { version = "0.2.54" }
|
|
|
|
# Dev dependencies
|
|
assert_cmd = { version = "2.2.2" }
|
|
criterion = { version = "0.8.2", features = ["async_tokio"] }
|
|
pretty_assertions = { version = "1.4.1" }
|
|
project-root = { version = "0.2.2" }
|
|
tempfile = { version = "3.27.0" }
|
|
mockito = { version = "1.7.2" }
|
|
|
|
[workspace.metadata.workspaces]
|
|
allow_branch = "main"
|
|
|
|
# Declares the `dylint_lib = "perfectionist"` cfg used by the
|
|
# `cfg_attr(dylint_lib = "perfectionist", feature(register_tool))` /
|
|
# `register_tool(perfectionist)` lines at each pacquet crate's root.
|
|
# Those `cfg_attr`s register the perfectionist tool name under dylint's
|
|
# nightly toolchain (so `#[expect(perfectionist::lint, reason = "...")]`
|
|
# at use sites compiles cleanly without a wrapper); this `check-cfg`
|
|
# entry tells stable `cargo check` that the cfg name is expected even
|
|
# though it's never set off-dylint.
|
|
[workspace.lints.rust]
|
|
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(dylint_lib, values("perfectionist"))'] }
|
|
|
|
[workspace.lints.clippy]
|
|
clone_on_ref_ptr = "warn"
|
|
if_then_some_else_none = "warn"
|
|
needless_collect = "warn"
|
|
or_fun_call = "warn"
|
|
redundant_clone = "warn"
|
|
unnecessary_lazy_evaluations = "warn"
|
|
|
|
[profile.release]
|
|
opt-level = 3
|
|
lto = "fat"
|
|
codegen-units = 1
|
|
strip = "symbols"
|
|
debug = false
|
|
panic = "abort" # Let it crash and force ourselves to write safe Rust.
|
|
|
|
# Use the `--profile release-debug` flag to show symbols in release mode.
|
|
# e.g. `cargo build --profile release-debug`
|
|
[profile.release-debug]
|
|
inherits = "release"
|
|
strip = false
|
|
debug = true
|