Class: Dependabot::NpmAndYarn::RegistryHelper

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/npm_and_yarn/registry_helper.rb

Constant Summary collapse

REGISTRY_KEY =

Keys for configurations

"registry"
AUTH_KEY = 
"authToken"
NPM_AUTH_TOKEN_KEY_FOR_YARN =

Yarn-specific keys

"npmAuthToken"
NPM_SCOPE_KEY_FOR_YARN = 
"npmScopes"
NPM_REGISTER_KEY_FOR_YARN = 
"npmRegistryServer"
COREPACK_NPM_REGISTRY_ENV =

Environment variable keys

"COREPACK_NPM_REGISTRY"
NPM_CONFIG_REGISTRY_ENV =

For Corepack

"npm_config_registry"
COREPACK_NPM_TOKEN_ENV =

For npm

"COREPACK_NPM_TOKEN"
COREPACK_INTEGRITY_KEYS_ENV = 
"COREPACK_INTEGRITY_KEYS"
DEFAULT_NPM_REGISTRY =

Default npm registry - no need to set env vars for this

"https://registry.npmjs.org"
KEYS_ENDPOINT_PATH =

Corepack signing-key endpoints. KEYS_ENDPOINT_PATH is the standard npm registry API path (registry-host.tld/-/npm/v1/keys) served by any signature-supporting registry, so it is appended generically to a registry URL. NPM_KEYS_URL is simply that same path applied to the default public npm registry, built from the constants above so the host has a single source of truth.

"/-/npm/v1/keys"
NPM_KEYS_URL = 
T.let("#{DEFAULT_NPM_REGISTRY}#{KEYS_ENDPOINT_PATH}".freeze, String)
REPLACES_BASE_FLAG =

Sentinel recorded in the registry-info hash (whose values are strings) to flag a replaces-base registry. Compared explicitly rather than by truthiness.

"true"

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(registry_config_files, credentials) ⇒ RegistryHelper

Returns a new instance of RegistryHelper.



155
156
157
158
 
# File 'lib/dependabot/npm_and_yarn/registry_helper.rb', line 155

def initialize(registry_config_files, credentials)
  @registry_config_files = registry_config_files
  @credentials = credentials
end

Class Method Details

.corepack_integrity_keys(registry, auth_token) ⇒ Object 



75
76
77
78
79
 
# File 'lib/dependabot/npm_and_yarn/registry_helper.rb', line 75

def self.corepack_integrity_keys(registry, auth_token)
  return @integrity_keys_cache[registry] if @integrity_keys_cache.key?(registry)

  @integrity_keys_cache[registry] = build_integrity_keys(registry, auth_token)
end

.normalize_registry_url(url) ⇒ Object 



57
58
59
60
61
 
# File 'lib/dependabot/npm_and_yarn/registry_helper.rb', line 57

def self.normalize_registry_url(url)
  normalized = url.start_with?("http://", "https://") ? url.dup : "https://#{url}"
  normalized.delete_suffix!("/") while normalized.end_with?("/")
  normalized
end

Instance Method Details

#find_corepack_env_variables ⇒ Object 



161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/dependabot/npm_and_yarn/registry_helper.rb', line 161

def find_corepack_env_variables
  registry_info = find_registry_and_token

  env_variables = {}

  if (raw_registry = registry_info[:registry])
    registry = RegistryHelper.normalize_registry_url(raw_registry)

    unless registry == DEFAULT_NPM_REGISTRY
      env_variables[COREPACK_NPM_REGISTRY_ENV] = registry # For Corepack
      env_variables[NPM_CONFIG_REGISTRY_ENV] = registry # For npm
      env_variables[REGISTRY_KEY] = registry

      # A replaces-base registry (e.g. Cloudsmith) is a caching proxy that
      # re-signs packages with its own keys, so Corepack's default npm-only
      # signature verification fails against it. Rather than disabling the
      # check, merge npm's public keys with the registry's own keys so that
      # verification stays enabled and trusts both sources. See issue #15567.
      if registry_info[:replaces_base] == REPLACES_BASE_FLAG
        integrity_keys = RegistryHelper.corepack_integrity_keys(registry, registry_info[:auth_token])
        env_variables[COREPACK_INTEGRITY_KEYS_ENV] = integrity_keys if integrity_keys
      end
    end
  end

  env_variables[COREPACK_NPM_TOKEN_ENV] = registry_info[:auth_token] if registry_info[:auth_token]

  env_variables
end