Visitar URL original
fix: correct bundled sigstore from dev dependency conflict (#9740) · npm/cli@47fc8b1 · GitHub
Skip to content

Commit 47fc8b1

Browse files
james-prejames-pre
authored
fix: correct bundled sigstore from dev dependency conflict (#9740)
This PR fixes #9722. `mock-registry` pinned `@npmcli/arborist@^9.1.2`, which meant the local workspace version wasn't linked and the dependency was pulled from the registry instead. `sigstore@^4` got installed at the root node_modules and `^5` was put into `workspaces/libnpmpublish/node_modules`. The dev-only `^4` was then excluded when npm was packed. Fix: - `mock-registry`: arborist `^9.1.2` -> `^10.0.0` - `workspaces/arborist`: validate-npm-package-name `^7.0.2` -> `^8.0.0` (need to release a patch for arborist) - Lockfile regenerated via install + dedupe; `node . run dependencies` The packed tarball now contains `package/node_modules/sigstore` and `publish --dry-run` from the extracted tarball succeeds.
1 parent 4403f05 commit 47fc8b1

168 files changed

Lines changed: 957 additions & 3508 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎DEPENDENCIES.json‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@
2121
"libnpmversion"
2222
],
2323
[
24-
"@npmcli/run-script",
2524
"@npmcli/map-workspaces",
25+
"@npmcli/run-script",
2626
"libnpmaccess",
2727
"libnpmorg",
2828
"libnpmpublish",
@@ -41,43 +41,43 @@
4141
],
4242
[
4343
"@npmcli/smoke-tests",
44-
"npm-pick-manifest",
4544
"@npmcli/installed-package-contents",
45+
"npm-pick-manifest",
4646
"cacache",
4747
"promzard"
4848
],
4949
[
5050
"@npmcli/docs",
51-
"npm-package-arg",
51+
"@npmcli/fs",
52+
"npm-bundled",
5253
"@npmcli/promise-spawn",
5354
"npm-install-checks",
54-
"npm-bundled",
55-
"@npmcli/fs",
55+
"npm-package-arg",
5656
"npm-packlist",
57-
"@npmcli/mock-globals",
5857
"bin-links",
5958
"nopt",
6059
"parse-conflict-json",
60+
"@npmcli/mock-globals",
6161
"read"
6262
],
6363
[
6464
"@npmcli/eslint-config",
6565
"@npmcli/template-oss",
6666
"ignore-walk",
6767
"semver",
68+
"npm-normalize-package-bin",
69+
"@npmcli/name-from-folder",
70+
"which",
71+
"ini",
6872
"hosted-git-info",
6973
"proc-log",
7074
"validate-npm-package-name",
71-
"which",
72-
"ini",
73-
"npm-normalize-package-bin",
7475
"json-parse-even-better-errors",
75-
"@npmcli/node-gyp",
7676
"ssri",
77+
"@npmcli/node-gyp",
7778
"@npmcli/redact",
7879
"@npmcli/agent",
7980
"minipass-fetch",
80-
"@npmcli/name-from-folder",
8181
"@npmcli/query",
8282
"cmd-shim",
8383
"read-cmd-shim",

‎DEPENDENCIES.md‎

Lines changed: 4 additions & 4 deletions

‎mock-registry/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
]
4747
},
4848
"devDependencies": {
49-
"@npmcli/arborist": "^9.1.2",
49+
"@npmcli/arborist": "^10.0.0",
5050
"@npmcli/eslint-config": "^5.0.1",
5151
"@npmcli/template-oss": "5.1.1",
5252
"json-stringify-safe": "^5.0.1",

‎node_modules/.gitignore‎

Lines changed: 8 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,16 @@
3636
!/@npmcli/run-script
3737
!/@sigstore/
3838
/@sigstore/*
39+
!/@sigstore/bundle
40+
!/@sigstore/core
3941
!/@sigstore/protobuf-specs
42+
!/@sigstore/sign
4043
!/@sigstore/tuf
44+
!/@sigstore/verify
4145
!/@tufjs/
4246
/@tufjs/*
4347
!/@tufjs/canonical-json
48+
!/@tufjs/models
4449
!/abbrev
4550
!/aproba
4651
!/archy
@@ -51,7 +56,6 @@
5156
!/bin-links/node_modules/cmd-shim
5257
!/bin-links/node_modules/npm-normalize-package-bin
5358
!/bin-links/node_modules/read-cmd-shim
54-
!/bin-links/node_modules/write-file-atomic
5559
!/binary-extensions
5660
!/brace-expansion
5761
!/cacache
@@ -84,11 +88,9 @@
8488
!/just-diff
8589
!/lru-cache
8690
!/make-fetch-happen
87-
!/make-fetch-happen/node_modules/
88-
/make-fetch-happen/node_modules/*
89-
!/make-fetch-happen/node_modules/minipass-fetch
9091
!/minimatch
9192
!/minipass-collect
93+
!/minipass-fetch
9294
!/minipass-flush
9395
!/minipass-pipeline
9496
!/minipass-pipeline/node_modules/
@@ -116,21 +118,9 @@
116118
!/npm-pick-manifest/node_modules/npm-normalize-package-bin
117119
!/npm-profile
118120
!/npm-registry-fetch
119-
!/npm-registry-fetch/node_modules/
120-
/npm-registry-fetch/node_modules/*
121-
!/npm-registry-fetch/node_modules/minipass-fetch
122121
!/npm-user-validate
123122
!/p-map
124123
!/pacote
125-
!/pacote/node_modules/
126-
/pacote/node_modules/*
127-
!/pacote/node_modules/@sigstore/
128-
/pacote/node_modules/@sigstore/*
129-
!/pacote/node_modules/@sigstore/bundle
130-
!/pacote/node_modules/@sigstore/core
131-
!/pacote/node_modules/@sigstore/sign
132-
!/pacote/node_modules/@sigstore/verify
133-
!/pacote/node_modules/sigstore
134124
!/parse-conflict-json
135125
!/path-scurry
136126
!/postcss-selector-parser
@@ -145,6 +135,7 @@
145135
!/safer-buffer
146136
!/semver
147137
!/signal-exit
138+
!/sigstore
148139
!/smart-buffer
149140
!/socks-proxy-agent
150141
!/socks-proxy-agent/node_modules/
@@ -166,16 +157,12 @@
166157
!/tinyglobby/node_modules/picomatch
167158
!/treeverse
168159
!/tuf-js
169-
!/tuf-js/node_modules/
170-
/tuf-js/node_modules/*
171-
!/tuf-js/node_modules/@tufjs/
172-
/tuf-js/node_modules/@tufjs/*
173-
!/tuf-js/node_modules/@tufjs/models
174160
!/undici
175161
!/util-deprecate
176162
!/validate-npm-package-name
177163
!/walk-up-path
178164
!/which
165+
!/write-file-atomic
179166
!/yallist
180167
# Always ignore some specific patterns within any allowed package
181168
.bin/

node_modules/pacote/node_modules/@sigstore/bundle/LICENSE renamed to node_modules/@sigstore/bundle/LICENSE

File renamed without changes.

node_modules/pacote/node_modules/@sigstore/bundle/dist/build.js renamed to node_modules/@sigstore/bundle/dist/build.js

File renamed without changes.

node_modules/pacote/node_modules/@sigstore/bundle/dist/bundle.js renamed to node_modules/@sigstore/bundle/dist/bundle.js

File renamed without changes.

node_modules/pacote/node_modules/@sigstore/bundle/dist/error.js renamed to node_modules/@sigstore/bundle/dist/error.js

File renamed without changes.

node_modules/pacote/node_modules/@sigstore/bundle/dist/index.js renamed to node_modules/@sigstore/bundle/dist/index.js

File renamed without changes.

node_modules/pacote/node_modules/@sigstore/bundle/dist/serialized.js renamed to node_modules/@sigstore/bundle/dist/serialized.js

File renamed without changes.

0 commit comments

Comments
 (0)