@appsignal/nodejs-ext - npm Package Compare versions

Comparing version 2.0.0 to 2.0.1

package.json

 {
   "name": "@appsignal/nodejs-ext",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "main": "dist/index",
@@ -21,3 +21,3 @@ "types": "dist/index",
     "pretest:failure": "npm run clean",
-    "test:failure": "_TEST_APPSIGNAL_EXTENSION_FAILURE=true npm run install; _TEST_APPSIGNAL_EXTENSION_FAILURE=true jest --filter=./test/filter.js"
+    "test:failure": "_TEST_APPSIGNAL_EXTENSION_FAILURE=true _APPSIGNAL_EXTENSION_INSTALL=true npm run install; _TEST_APPSIGNAL_EXTENSION_FAILURE=true jest --filter=./test/filter.js"
   },
@@ -24,0 +24,0 @@ "os": [

scripts/extension.js

@@ -9,3 +9,3 @@ #!/usr/bin/env node
 
-const { TRIPLES } = require("./extension/constants")
+const { AGENT_VERSION, MIRRORS, TRIPLES } = require("./extension/constants")
 
@@ -28,9 +28,24 @@ const {
   process.env._TEST_APPSIGNAL_EXTENSION_FAILURE === "true"
+const installAllowedEnv = process.env._APPSIGNAL_EXTENSION_INSTALL
+const installAllowed = installAllowedEnv !== "false"
 
-function download(url, outputPath) {
+function failOnPurposeIfConfigured() {
+  if (testExtensionFailure) {
+    throw new Error("AppSignal internal test failure")
+  }
+}
+
+class DownloadError extends Error {
+  constructor(message, downloadUrl) {
+    super(message)
+    this.name = this.constructor.name
+    this.downloadUrl = downloadUrl
+  }
+}
+
+function downloadFromMirror(mirror, filename, outputPath) {
   return new Promise((resolve, reject) => {
-    if (testExtensionFailure) {
-      throw new Error("AppSignal internal test failure")
-    }
+    failOnPurposeIfConfigured()
 
+    const url = path.join(mirror, AGENT_VERSION, filename)
     const file = fs.createWriteStream(outputPath)
@@ -43,7 +58,10 @@
         return reject(
-          new Error(`Request to CDN failed with code HTTP ${statusCode}`)
+          new DownloadError(
+            `Request to CDN failed with code HTTP ${statusCode}`,
+            url
+          )
         )
+      } else {
+        response.pipe(file).on("finish", () => resolve(url))
       }
-
-      response.pipe(file).on("finish", () => resolve(outputPath))
     })
@@ -53,2 +71,26 @@ })
 
+function download(mirrors, filename, outputPath) {
+  return new Promise((resolve, reject) => {
+    if (testExtensionFailure) {
+      throw new DownloadError("AppSignal internal test failure", undefined)
+    }
+
+    if (mirrors.length === 0) {
+      reject(
+        new DownloadError("Could not download agent from any mirror", undefined)
+      )
+      return
+    }
+
+    downloadFromMirror(mirrors.shift(), filename, outputPath)
+      .then(url => resolve(url))
+      .catch(error => {
+        console.error("Error downloading from mirror:", error)
+        download(mirrors, filename, outputPath)
+          .then(url => resolve(url))
+          .catch(error => reject(error))
+      })
+  })
+}
+
 function extract(filepath) {
@@ -128,40 +170,60 @@ return new Promise((resolve, reject) => {
 ;(function () {
-  if (hasLocalBuild() && !testExtensionFailure) {
-    // check for a local build (dev only)
-    console.warn(`Using local build for agent. Skipping download.`)
+  if (!installAllowed) {
+    console.warn(
+      `_APPSIGNAL_EXTENSION_INSTALL is set to "${installAllowedEnv}". Skipping install.`
+    )
     return process.exit(0)
   }
 
-  if (!hasSupportedArchitecture(process.arch)) {
-    console.error(
-      `AppSignal currently does not support your system architecture
-        (${process.platform} ${process.arch}). Please let us know at
-        [e-mail], we aim to support everything our customers run.`
-    )
+  const isLocalBuild = hasLocalBuild()
 
-    return process.exit(1)
-  }
+  if (!isLocalBuild) {
+    if (!hasSupportedArchitecture(process.arch)) {
+      console.error(
+        `AppSignal currently does not support your system architecture
+          (${process.platform} ${process.arch}). Please let us know at
+          [e-mail], we aim to support everything our customers run.`
+      )
 
-  if (!hasSupportedOs(process.platform)) {
-    console.error(
-      `AppSignal currently does not support your operating system (${process.platform}).
-      Please let us know at [e-mail], we aim to support everything
-      our customers run.`
-    )
+      return process.exit(1)
+    }
 
-    return process.exit(1)
+    if (!hasSupportedOs(process.platform)) {
+      console.error(
+        `AppSignal currently does not support your operating system (${process.platform}).
+        Please let us know at [e-mail], we aim to support everything
+        our customers run.`
+      )
+
+      return process.exit(1)
+    }
   }
 
   const report = createReport()
+  report.download = createDownloadReport({})
   report.build = createBuildReport({})
 
-  // try and get one from the CDN
-  const metadata = getMetadataForTarget(report.build)
-  const filename = metadata.downloadUrl.split("/")[4]
-  const outputPath = path.join(EXT_PATH, filename)
+  let result
+  if (isLocalBuild) {
+    console.warn(`Using local build for agent. Skipping download.`)
+    result = Promise.resolve().then(() => failOnPurposeIfConfigured())
+    report.build.source = "local"
+  } else {
+    // Download agent and extension archive from CDN
+    const metadata = getMetadataForTarget(report.build)
+    const filename = metadata.filename
+    const outputPath = path.join(EXT_PATH, filename)
+    report.build.source = "remote"
+    result = download(MIRRORS, filename, outputPath).then(url => {
+      report.download.download_url = url
 
-  return download(metadata.downloadUrl, outputPath)
-    .then(filepath =>
-      verify(filepath, metadata.checksum).then(() => extract(filepath))
-    )
+      verify(outputPath, metadata.checksum).then(() => {
+        report.download.checksum = "verified"
+
+        return extract(outputPath)
+      })
+    })
+  }
+
+  return result
     .then(() => {
@@ -171,9 +233,3 @@ // @TODO: add cleanup step
 
-      report.download = createDownloadReport({
-        verified: true,
-        downloadUrl: metadata.downloadUrl
-      })
       report.result.status = "unknown"
-
-      // Once extracted, we hand it off to node-gyp for building
       return install().then(() => {
@@ -196,7 +252,7 @@ report.result.status = "success"
       }
-      report.download = createDownloadReport({
-        verified: false,
-        downloadUrl: metadata.downloadUrl
-      })
 
+      if (error.downloadUrl) {
+        report.download.download_url = error.downloadUrl
+      }
+
       return dumpReport(report).then(() => {
@@ -203,0 +259,0 @@ process.exit(1)

scripts/extension/constants.js

@@ -1,78 +0,75 @@
-const AGENT_VERSION = "0318770"
+// DO NOT EDIT
+// This is a generated file by the `rake ship` family of tasks in the
+// appsignal-agent repository.
+// Modifications to this file will be overwritten with the next agent release.
 
+const AGENT_VERSION = "7376537"
+const MIRRORS = [
+  "https://appsignal-agent-releases.global.ssl.fastly.net",
+  "https://d135dj0rjqvssy.cloudfront.net"
+]
+
 const TRIPLES = {
   "x86_64-darwin": {
     checksum:
-      "7b17cb76edc58ea54381455f74934d08efbfb7807007e97ae01f751101da8b50",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-darwin-all-static.tar.gz"
+      "108f022d9def20cea03aae52f9c07e8f35ef64a2c046edaad01a38966e1e45a7",
+    filename: "appsignal-x86_64-darwin-all-static.tar.gz"
   },
   "universal-darwin": {
     checksum:
-      "7b17cb76edc58ea54381455f74934d08efbfb7807007e97ae01f751101da8b50",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-darwin-all-static.tar.gz"
+      "108f022d9def20cea03aae52f9c07e8f35ef64a2c046edaad01a38966e1e45a7",
+    filename: "appsignal-x86_64-darwin-all-static.tar.gz"
   },
   "aarch64-darwin": {
     checksum:
-      "d90172492ccf83527696fcd0353796d3d0d4e1704ff986ae90a774a7f11a85a2",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-aarch64-darwin-all-static.tar.gz"
+      "0eacd24a3a053f2f80c8c7aeb7fafa9e851588ddbe798de8f40277b77e2819d5",
+    filename: "appsignal-aarch64-darwin-all-static.tar.gz"
   },
   "arm64-darwin": {
     checksum:
-      "d90172492ccf83527696fcd0353796d3d0d4e1704ff986ae90a774a7f11a85a2",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-aarch64-darwin-all-static.tar.gz"
+      "0eacd24a3a053f2f80c8c7aeb7fafa9e851588ddbe798de8f40277b77e2819d5",
+    filename: "appsignal-aarch64-darwin-all-static.tar.gz"
   },
   "arm-darwin": {
     checksum:
-      "d90172492ccf83527696fcd0353796d3d0d4e1704ff986ae90a774a7f11a85a2",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-aarch64-darwin-all-static.tar.gz"
+      "0eacd24a3a053f2f80c8c7aeb7fafa9e851588ddbe798de8f40277b77e2819d5",
+    filename: "appsignal-aarch64-darwin-all-static.tar.gz"
   },
   "aarch64-linux": {
     checksum:
-      "bef06f27d98cc1afc30b2d8fa23af69bd0206407b0d8d2f052278de3b8c5f2b5",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-aarch64-linux-all-static.tar.gz"
+      "e45c227bf87d855e0a94d3fcb42a96a4140458f796c67865c650ef3ff1275c57",
+    filename: "appsignal-aarch64-linux-all-static.tar.gz"
   },
   "i686-linux": {
     checksum:
-      "7e0aa277c4e49ebe1b805e9db615544c5488a23d8b439867a2a6357d37c897bc",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-i686-linux-all-static.tar.gz"
+      "52a6e693650710f1a8b2b389d4a3dc7194069a4eb507b02b068e05f60b92e790",
+    filename: "appsignal-i686-linux-all-static.tar.gz"
   },
   "x86-linux": {
     checksum:
-      "7e0aa277c4e49ebe1b805e9db615544c5488a23d8b439867a2a6357d37c897bc",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-i686-linux-all-static.tar.gz"
+      "52a6e693650710f1a8b2b389d4a3dc7194069a4eb507b02b068e05f60b92e790",
+    filename: "appsignal-i686-linux-all-static.tar.gz"
   },
   "x86_64-linux": {
     checksum:
-      "e918e24ff1f86d939b8f571506b11f2890d81c741de56cb06ac81b5dcc3f70e1",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-linux-all-static.tar.gz"
+      "8ee5443ca68a3cbac7b63a079bfd734fffd84dbdeab1b9fae7379d7da544d096",
+    filename: "appsignal-x86_64-linux-all-static.tar.gz"
   },
   "x86_64-linux-musl": {
     checksum:
-      "1a90421519d7860bf41d606866252cc7f1cb828a7efb9622045ee4f04d757ebd",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-linux-musl-all-static.tar.gz"
+      "4e01355da3a638bf1fefda47786323eb76345a49e77afab42d79df8510f52e07",
+    filename: "appsignal-x86_64-linux-musl-all-static.tar.gz"
   },
   "x86_64-freebsd": {
     checksum:
-      "22cdd8e44e60dd69003d28ea95c994c27d2223a3872c541c966f32dbea3b0462",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-freebsd-all-static.tar.gz"
+      "6ba022dc3c66b3ff53316ef55b4841e329dc84c0c585dcd87314bcd9ffae9aab",
+    filename: "appsignal-x86_64-freebsd-all-static.tar.gz"
   },
   "amd64-freebsd": {
     checksum:
-      "22cdd8e44e60dd69003d28ea95c994c27d2223a3872c541c966f32dbea3b0462",
-    downloadUrl:
-      "https://appsignal-agent-releases.global.ssl.fastly.net/0318770/appsignal-x86_64-freebsd-all-static.tar.gz"
+      "6ba022dc3c66b3ff53316ef55b4841e329dc84c0c585dcd87314bcd9ffae9aab",
+    filename: "appsignal-x86_64-freebsd-all-static.tar.gz"
   }
 }
 
-module.exports = { AGENT_VERSION, TRIPLES }
+module.exports = { AGENT_VERSION, MIRRORS, TRIPLES }

scripts/report.js

@@ -72,7 +72,7 @@ const crypto = require("crypto")
 
-function createDownloadReport({ verified = false, downloadUrl: download_url }) {
+function createDownloadReport(report) {
   return {
-    checksum: verified ? "verified" : "unverified",
+    checksum: "unverified",
     http_proxy: null,
-    download_url
+    ...report
   }
@@ -79,0 +79,0 @@ }

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

43571

increased by2.22%

Lines of code

588

increased by8.29%

Number of medium supply chain risk alerts

4

decreased by-20%

Worsened metrics

Number of low supply chain risk alerts

12

increased by9.09%

No dependency changes