Repository navigation
Don't fetch npm tarballs whose packument can't be read - #582
Merged
Merged
Conversation
An uncached tarball is checked against the integrity its packument declares. When the packument couldn't be fetched or was refused, for example because it is larger than metadata_max_size or the registry answered 503, the download went ahead with no integrity at all, and the unverified tarball was cached and served to every later client. Without the packument the download now fails like the Composer one does: 502, or 404 when the registry says the package doesn't exist. Nothing is fetched or cached. Tarballs already in the cache are still served, since they were verified when they were stored, and a packument that lists the version without a usable checksum still falls back to an unverified fetch as before.
simonchrz
added
the
breaking
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An uncached npm tarball is verified against the
dist.integrity(ordist.shasum) its packument declares. When the packument couldn't be read — the registry failed, or the document is overmetadata_max_size— the tarball was fetched from the conventional URL with no expected digest and cached unverified, so every later client got that copy.Now a download without a readable packument fails the same way a Composer download without metadata does: 502, or 404 when the registry says the package doesn't exist. Nothing is fetched or cached.
metadata_max_sizecan no longer be downloaded uncached; raise the limit for those.Tests: new
TestNPMTarballWithoutMetadataIsNotFetched(registry 503, packument overmetadata_max_size);TestNPMTarballMetadataFallbackandTestNPMRoutedDownloadWithoutMetadataStaysOnRouteupdated for the new behaviour; a few download tests that never served a packument now get an empty one.