Skip to content

Commit e67e5db

Browse files
feelepxyzfeelepxyz
committed
Fix workspace tests
1 parent 5a87311 commit e67e5db

File tree

3 files changed

+132
-33
lines changed

3 files changed

+132
-33
lines changed

‎lib/commands/audit.js

+10-3
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,9 @@ class VerifySignatures {
8080
if (this.npm.config.get('json')) {
8181
this.appendOutput(this.makeJSON({ invalid, missing }))
8282
} else {
83-
const timing = `audited ${this.audited} packages in ${Math.floor(Number(elapsed) / 1e9)}s`
83+
const auditedPlural = this.audited > 1 ? 's' : ''
84+
const timing = `audited ${this.audited} package${auditedPlural} in ` +
85+
`${Math.floor(Number(elapsed) / 1e9)}s`
8486
const verifiedPrefix = verified ? 'verified registry signatures, ' : ''
8587
this.appendOutput(`${verifiedPrefix}${timing}\n`)
8688

@@ -119,9 +121,9 @@ class VerifySignatures {
119121
`${missing.length ? '\n' : ''}${invalid.length} ${msg}:\n`
120122
)
121123
this.appendOutput(this.humanOutput(invalid))
122-
const plural = invalid.length === 1 ? '' : 's'
124+
const invPlural = invalid.length === 1 ? '' : 's'
123125
this.appendOutput(
124-
`\nSomeone might have tampered with the package${plural} ` +
126+
`\nSomeone might have tampered with the package${invPlural} ` +
125127
`since it was published on the registry (monster-in-the-middle attack)!\n`
126128
)
127129
}
@@ -199,6 +201,11 @@ class VerifySignatures {
199201
: edge.dev ? 'devDependencies'
200202
: 'dependencies'
201203

204+
// Skip local workspaces
205+
if (node.isWorkspace) {
206+
return
207+
}
208+
202209
// Skip potentially optional packages that are not on disk, as these could
203210
// be omitted during install
204211
if (edge.error === 'MISSING' && type !== 'dependencies') {

‎tap-snapshots/test/lib/commands/audit.js.test.cjs

+17-7
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ found 0 vulnerabilities
4242
`
4343

4444
exports[`test/lib/commands/audit.js TAP audit signatures ignores optional dependencies > must match snapshot 1`] = `
45-
verified registry signatures, audited 1 packages in xxx
45+
verified registry signatures, audited 1 package in 0s
4646
4747
`
4848

@@ -85,12 +85,12 @@ exports[`test/lib/commands/audit.js TAP audit signatures json output with valid
8585
`
8686

8787
exports[`test/lib/commands/audit.js TAP audit signatures omit dev dependencies with missing signature > must match snapshot 1`] = `
88-
verified registry signatures, audited 1 packages in xxx
88+
verified registry signatures, audited 1 package in 0s
8989
9090
`
9191

9292
exports[`test/lib/commands/audit.js TAP audit signatures output details about missing signatures > must match snapshot 1`] = `
93-
audited 1 packages in xxx
93+
audited 1 package in 0s
9494
9595
1 package has a missing registry signature but the registry is providing signing keys:
9696
@@ -112,7 +112,7 @@ Someone might have tampered with the package since it was published on the regis
112112
`
113113

114114
exports[`test/lib/commands/audit.js TAP audit signatures with colour option and invalid signatures > must match snapshot 1`] = `
115-
audited 1 packages in xxx
115+
audited 1 package in 0s
116116
117117
1 package has an invalid registry signature:
118118
@@ -123,7 +123,7 @@ Someone might have tampered with the package since it was published on the regis
123123
`
124124

125125
exports[`test/lib/commands/audit.js TAP audit signatures with invalid signatures > must match snapshot 1`] = `
126-
audited 1 packages in xxx
126+
audited 1 package in 0s
127127
128128
1 package has an invalid registry signature:
129129
@@ -134,7 +134,7 @@ Someone might have tampered with the package since it was published on the regis
134134
`
135135

136136
exports[`test/lib/commands/audit.js TAP audit signatures with keys but missing signature > must match snapshot 1`] = `
137-
audited 1 packages in xxx
137+
audited 1 package in 0s
138138
139139
1 package has a missing registry signature but the registry is providing signing keys
140140
run \`npm audit signatures --missing\` for details
@@ -150,7 +150,17 @@ audited 2 packages in xxx
150150
`
151151

152152
exports[`test/lib/commands/audit.js TAP audit signatures with valid signatures > must match snapshot 1`] = `
153-
verified registry signatures, audited 1 packages in xxx
153+
verified registry signatures, audited 1 package in 0s
154+
155+
`
156+
157+
exports[`test/lib/commands/audit.js TAP audit signatures workspaces verifies registry deps and ignores local workspace deps > must match snapshot 1`] = `
158+
verified registry signatures, audited 3 packages in xxx
159+
160+
`
161+
162+
exports[`test/lib/commands/audit.js TAP audit signatures workspaces verifies registry deps when filtering by workspace name > must match snapshot 1`] = `
163+
verified registry signatures, audited 2 packages in xxx
154164
155165
`
156166

‎test/lib/commands/audit.js

+105-23
Original file line numberDiff line numberDiff line change
@@ -379,16 +379,16 @@ t.test('audit signatures', async t => {
379379
version: '1.0.0',
380380
}),
381381
},
382-
foo: {
382+
async: {
383383
'package.json': JSON.stringify({
384-
name: 'foo',
385-
version: '1.0.0',
384+
name: 'async',
385+
version: '2.5.0',
386386
}),
387387
},
388-
zeta: {
388+
'light-cycle': {
389389
'package.json': JSON.stringify({
390-
name: 'zeta',
391-
version: '1.0.0',
390+
name: 'light-cycle',
391+
version: '1.4.2',
392392
}),
393393
},
394394
},
@@ -399,7 +399,7 @@ t.test('audit signatures', async t => {
399399
version: '1.0.0',
400400
dependencies: {
401401
b: '^1.0.0',
402-
foo: '^1.0.0',
402+
async: '^2.0.0',
403403
},
404404
}),
405405
},
@@ -408,17 +408,14 @@ t.test('audit signatures', async t => {
408408
name: 'b',
409409
version: '1.0.0',
410410
dependencies: {
411-
zeta: '^1.0.0',
411+
'light-cycle': '^1.0.0',
412412
},
413413
}),
414414
},
415415
c: {
416416
'package.json': JSON.stringify({
417417
name: 'c',
418418
version: '1.0.0',
419-
dependencies: {
420-
theta: '^1.0.0',
421-
},
422419
}),
423420
},
424421
},
@@ -642,7 +639,7 @@ t.test('audit signatures', async t => {
642639

643640
t.equal(process.exitCode, 0, 'should exit successfully')
644641
process.exitCode = 0
645-
t.match(joinedOutput(), /verified registry signatures, audited 1 packages/)
642+
t.match(joinedOutput(), /verified registry signatures, audited 1 package/)
646643
t.matchSnapshot(joinedOutput())
647644
})
648645

@@ -834,7 +831,7 @@ t.test('audit signatures', async t => {
834831

835832
t.equal(process.exitCode, 0, 'should exit successfully')
836833
process.exitCode = 0
837-
t.match(joinedOutput(), /verified registry signatures, audited 1 packages/)
834+
t.match(joinedOutput(), /verified registry signatures, audited 1 package/)
838835
t.matchSnapshot(joinedOutput())
839836
})
840837

@@ -873,7 +870,7 @@ t.test('audit signatures', async t => {
873870

874871
t.equal(process.exitCode, 0, 'should exit successfully')
875872
process.exitCode = 0
876-
t.match(joinedOutput(), /verified registry signatures, audited 1 packages/)
873+
t.match(joinedOutput(), /verified registry signatures, audited 1 package/)
877874
t.matchSnapshot(joinedOutput())
878875
})
879876

@@ -961,33 +958,118 @@ t.test('audit signatures', async t => {
961958
})
962959

963960
t.test('workspaces', async t => {
964-
t.test('verifies registry deps and ignores local workspace deps', { todo: true }, async t => {
961+
t.test('verifies registry deps and ignores local workspace deps', async t => {
965962
npm.prefix = workspaceInstall()
966963
await manifestWithValidSigs()
964+
const asyncManifest = registry.manifest({
965+
name: 'async',
966+
packuments: [{
967+
version: '2.5.0',
968+
dist: {
969+
tarball: 'https://registry.npmjs.org/async/-/async-2.5.0.tgz',
970+
integrity: 'sha512-e+lJAJeNWuPCNyxZKOBdaJGyLGHugXVQtrAwtuAe2vhxTYxFT'
971+
+ 'KE73p8JuTmdH0qdQZtDvI4dhJwjZc5zsfIsYw==',
972+
signatures: [
973+
{
974+
keyid: 'SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA',
975+
sig: 'MEUCIQCM8cX2U3IVZKKhzQx1w5AlNSDUI+fVf4857K1qT0NTNgIgdT4qwEl' +
976+
'/kg2vU1uIWUI0bGikRvVHCHlRs1rgjPMpRFA=',
977+
},
978+
],
979+
},
980+
}],
981+
})
982+
const lightCycleManifest = registry.manifest({
983+
name: 'light-cycle',
984+
packuments: [{
985+
version: '1.4.2',
986+
dist: {
987+
tarball: 'https://registry.npmjs.org/light-cycle/-/light-cycle-1.4.2.tgz',
988+
integrity: 'sha512-badZ3KMUaGwQfVcHjXTXSecYSXxT6f99bT+kVzBqmO10U1UNlE' +
989+
'thJ1XAok97E4gfDRTA2JJ3r0IeMPtKf0EJMw==',
990+
signatures: [
991+
{
992+
keyid: 'SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA',
993+
sig: 'MEUCIQDXjoxQz4MzPqaIuy2RJmBlcFp0UD3h9EhKZxxEz9IYZAIgLO0znG5' +
994+
'aGciTAg4u8fE0/UXBU4gU7JcvTZGxW2BmKGw=',
995+
},
996+
],
997+
},
998+
}],
999+
})
1000+
await registry.package({ manifest: asyncManifest })
1001+
await registry.package({ manifest: lightCycleManifest })
9671002
validKeys()
9681003

9691004
await audit.exec(['signatures'])
9701005

9711006
t.equal(process.exitCode, 0, 'should exit successfully')
9721007
process.exitCode = 0
973-
t.match(joinedOutput(), /verified registry signatures, audited 1 packages/)
1008+
t.match(joinedOutput(), /verified registry signatures, audited 3 packages/)
9741009
t.matchSnapshot(joinedOutput())
9751010
})
9761011

977-
// TODO: This should verify kms-demo, but doesn't because arborist filters
978-
// workspace deps even if they're also root deps
979-
t.test('verifies registry dep if workspaces is disabled', { todo: true }, async t => {
1012+
t.test('verifies registry deps when filtering by workspace name', async t => {
9801013
npm.prefix = workspaceInstall()
981-
npm.flatOptions.workspacesEnabled = false
982-
await manifestWithValidSigs()
1014+
npm.localPrefix = npm.prefix
1015+
const asyncManifest = registry.manifest({
1016+
name: 'async',
1017+
packuments: [{
1018+
version: '2.5.0',
1019+
dist: {
1020+
tarball: 'https://registry.npmjs.org/async/-/async-2.5.0.tgz',
1021+
integrity: 'sha512-e+lJAJeNWuPCNyxZKOBdaJGyLGHugXVQtrAwtuAe2vhxTYxFT'
1022+
+ 'KE73p8JuTmdH0qdQZtDvI4dhJwjZc5zsfIsYw==',
1023+
signatures: [
1024+
{
1025+
keyid: 'SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA',
1026+
sig: 'MEUCIQCM8cX2U3IVZKKhzQx1w5AlNSDUI+fVf4857K1qT0NTNgIgdT4qwEl' +
1027+
'/kg2vU1uIWUI0bGikRvVHCHlRs1rgjPMpRFA=',
1028+
},
1029+
],
1030+
},
1031+
}],
1032+
})
1033+
const lightCycleManifest = registry.manifest({
1034+
name: 'light-cycle',
1035+
packuments: [{
1036+
version: '1.4.2',
1037+
dist: {
1038+
tarball: 'https://registry.npmjs.org/light-cycle/-/light-cycle-1.4.2.tgz',
1039+
integrity: 'sha512-badZ3KMUaGwQfVcHjXTXSecYSXxT6f99bT+kVzBqmO10U1UNlE' +
1040+
'thJ1XAok97E4gfDRTA2JJ3r0IeMPtKf0EJMw==',
1041+
signatures: [
1042+
{
1043+
keyid: 'SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA',
1044+
sig: 'MEUCIQDXjoxQz4MzPqaIuy2RJmBlcFp0UD3h9EhKZxxEz9IYZAIgLO0znG5' +
1045+
'aGciTAg4u8fE0/UXBU4gU7JcvTZGxW2BmKGw=',
1046+
},
1047+
],
1048+
},
1049+
}],
1050+
})
1051+
await registry.package({ manifest: asyncManifest })
1052+
await registry.package({ manifest: lightCycleManifest })
9831053
validKeys()
9841054

985-
await audit.exec(['signatures'])
1055+
await audit.execWorkspaces(['signatures'], ['./packages/a'])
9861056

9871057
t.equal(process.exitCode, 0, 'should exit successfully')
9881058
process.exitCode = 0
989-
t.match(joinedOutput(), /verified registry signatures, audited 1 packages/)
1059+
t.match(joinedOutput(), /verified registry signatures, audited 2 packages/)
9901060
t.matchSnapshot(joinedOutput())
9911061
})
1062+
1063+
// TODO: This should verify kms-demo, but doesn't because arborist filters
1064+
// workspace deps even if they're also root deps
1065+
t.test('verifies registry dep if workspaces is disabled', async t => {
1066+
npm.prefix = workspaceInstall()
1067+
npm.flatOptions.workspacesEnabled = false
1068+
1069+
await t.rejects(
1070+
audit.exec(['signatures']),
1071+
/No dependencies found in current install/
1072+
)
1073+
})
9921074
})
9931075
})

0 commit comments

Comments
 (0)