@evocateur/pacote - npm Package Compare versions

Comparing version 9.6.3 to 9.6.4

CHANGELOG.md

@@ -5,2 +5,39 @@ # Changelog
 
+### [9.6.4](https://github.com/evocateur/pacote/compare/v9.6.3...v9.6.4) (2019-08-20)
+
+
+
+### 9.5.8 (2019-08-20)
+
+
+
+### 9.5.7 (2019-08-19)
+
+
+### Bug Fixes
+
+* do not try to chown if not running as root ([bbc5da3](https://github.com/evocateur/pacote/commit/bbc5da3))
+
+
+
+### 9.5.6 (2019-08-15)
+
+
+### Bug Fixes
+
+* **extract:** chown properly when more than one directory is made ([5161828](https://github.com/evocateur/pacote/commit/5161828))
+
+
+
+### 9.5.5 (2019-08-12)
+
+
+### Bug Fixes
+
+* don't pass uid/gid to cacache ([0a0c73c](https://github.com/evocateur/pacote/commit/0a0c73c))
+* Infer owner of all unpacked files ([f12e7ef](https://github.com/evocateur/pacote/commit/f12e7ef))
+* invalid arg detection in extract() ([b4dc363](https://github.com/evocateur/pacote/commit/b4dc363)), closes [#5](https://github.com/evocateur/pacote/issues/5) [#6](https://github.com/evocateur/pacote/issues/6)
+
+
+
 ### [9.6.3](https://github.com/evocateur/pacote/compare/v9.6.2...v9.6.3) (2019-07-17)
@@ -43,8 +80,76 @@
 
+<a name="9.5.8"></a>
+## [9.5.8](https://github.com/npm/pacote/compare/v9.5.7...v9.5.8) (2019-08-20)
 
+
+
+<a name="9.5.7"></a>
+## [9.5.7](https://github.com/npm/pacote/compare/v9.5.6...v9.5.7) (2019-08-19)
+
+
+### Bug Fixes
+
+* do not try to chown if not running as root ([bbc5da3](https://github.com/npm/pacote/commit/bbc5da3))
+
+
+
+<a name="9.5.6"></a>
+## [9.5.6](https://github.com/npm/pacote/compare/v9.5.5...v9.5.6) (2019-08-15)
+
+
+### Bug Fixes
+
+* **extract:** chown properly when more than one directory is made ([5161828](https://github.com/npm/pacote/commit/5161828))
+
+
+
+<a name="9.5.5"></a>
+## [9.5.5](https://github.com/npm/pacote/compare/v9.5.4...v9.5.5) (2019-08-12)
+
+
+### Bug Fixes
+
+* don't pass uid/gid to cacache ([0a0c73c](https://github.com/npm/pacote/commit/0a0c73c))
+* Infer owner of all unpacked files ([f12e7ef](https://github.com/npm/pacote/commit/f12e7ef))
+* invalid arg detection in extract() ([b4dc363](https://github.com/npm/pacote/commit/b4dc363)), closes [#5](https://github.com/npm/pacote/issues/5) [#6](https://github.com/npm/pacote/issues/6)
+
+
+
+<a name="9.5.4"></a>
+## [9.5.4](https://github.com/npm/pacote/compare/v9.5.3...v9.5.4) (2019-07-16)
+
+
+### Bug Fixes
+
+* **git:** ensure stream failures are reported ([7f07b5d](https://github.com/npm/pacote/commit/7f07b5d)), closes [#1](https://github.com/npm/pacote/issues/1)
+
+
+
+<a name="9.5.3"></a>
+## [9.5.3](https://github.com/npm/pacote/compare/v9.5.2...v9.5.3) (2019-07-16)
+
+
+
+<a name="9.5.2"></a>
+## [9.5.2](https://github.com/npm/pacote/compare/v9.5.1...v9.5.2) (2019-07-12)
+
+
+### Bug Fixes
+
+* always pass uid/gid to cacache.put ([3d08925](https://github.com/npm/pacote/commit/3d08925))
+
+
+
 <a name="9.5.1"></a>
-## [9.5.1](https://github.com/evocateur/pacote/compare/v9.5.0...v9.5.1) (2019-05-08)
+## [9.5.1](https://github.com/npm/pacote/compare/v9.5.0...v9.5.1) (2019-06-17)
 
 
+### Bug Fixes
 
+* **audit:** npm audit fix ([127a28b](https://github.com/npm/pacote/commit/127a28b))
+* **errors:** Fix "TypeError: err.code.match is not a function" error ([#170](https://github.com/npm/pacote/issues/170)) ([92f5e4c](https://github.com/zkat/pacote/commit/92f5e4c))
+* **git:** limit retry times, avoid unlimited retries ([#172](https://github.com/npm/pacote/issues/172)) ([8bbd051](https://github.com/zkat/pacote/commit/8bbd051))
+
+
+
 <a name="9.5.0"></a>
@@ -51,0 +156,0 @@ # [9.5.0](https://github.com/npm/pacote/compare/v9.4.1...v9.5.0) (2019-02-18)

extract.js

@@ -13,2 +13,4 @@ 'use strict'
 const withTarballStream = require('./lib/with-tarball-stream.js')
+const inferOwner = require('infer-owner')
+const chown = BB.promisify(require('chownr'))
 
@@ -19,2 +21,11 @@ const truncateAsync = BB.promisify(fs.truncate)
 
+// you used to call me on my...
+const selfOwner = process.getuid ? {
+  uid: process.getuid(),
+  gid: process.getgid()
+} : {
+  uid: undefined,
+  gid: undefined
+}
+
 module.exports = extract
@@ -24,28 +35,36 @@ function extract (spec, dest, opts) {
   spec = npa(spec, opts.where)
+  if (spec.type === 'git' && !opts.cache) {
+    throw new TypeError('Extracting git packages requires a cache folder')
+  }
+  if (typeof dest !== 'string') {
+    throw new TypeError('Extract requires a destination')
+  }
   const startTime = Date.now()
-
-  return withTarballStream(spec, opts, stream => {
-    return tryExtract(spec, stream, dest, opts)
+  return inferOwner(dest).then(({ uid, gid }) => {
+    opts = opts.concat({ uid, gid })
+    return withTarballStream(spec, opts, stream => {
+      return tryExtract(spec, stream, dest, opts)
+    })
+      .then(() => {
+        if (!opts.resolved) {
+          const pjson = path.join(dest, 'package.json')
+          return readFileAsync(pjson, 'utf8')
+            .then(str => truncateAsync(pjson)
+              .then(() => appendFileAsync(pjson, str.replace(
+                /}\s*$/,
+                `\n,"_resolved": ${
+                  JSON.stringify(opts.resolved || '')
+                }\n,"_integrity": ${
+                  JSON.stringify(opts.integrity || '')
+                }\n,"_from": ${
+                  JSON.stringify(spec.toString())
+                }\n}`
+              ))))
+        }
+      })
+      .then(() => opts.log.silly(
+        'extract',
+        `${spec} extracted to ${dest} (${Date.now() - startTime}ms)`
+      ))
   })
-    .then(() => {
-      if (!opts.resolved) {
-        const pjson = path.join(dest, 'package.json')
-        return readFileAsync(pjson, 'utf8')
-          .then(str => truncateAsync(pjson)
-            .then(() => appendFileAsync(pjson, str.replace(
-              /}\s*$/,
-              `\n,"_resolved": ${
-                JSON.stringify(opts.resolved || '')
-              }\n,"_integrity": ${
-                JSON.stringify(opts.integrity || '')
-              }\n,"_from": ${
-                JSON.stringify(spec.toString())
-              }\n}`
-            ))))
-      }
-    })
-    .then(() => opts.log.silly(
-      'extract',
-      `${spec} extracted to ${dest} (${Date.now() - startTime}ms)`
-    ))
 }
@@ -59,2 +78,11 @@
       .then(() => mkdirp(dest))
+      .then((made) => {
+        // respect the current ownership of unpack targets
+        // but don't try to chown if we're not root.
+        if (selfOwner.uid === 0 &&
+            typeof selfOwner.gid === 'number' &&
+            selfOwner.uid !== opts.uid && selfOwner.gid !== opts.gid) {
+          return chown(made || dest, opts.uid, opts.gid)
+        }
+      })
       .then(() => {
@@ -61,0 +89,0 @@ const xtractor = extractStream(spec, dest, opts)

lib/fetchers/file.js

@@ -63,4 +63,2 @@ 'use strict'
             cacache.put.stream(opts.cache, `pacote:tarball:${src}`, {
-              uid: opts.uid,
-              gid: opts.gid,
               integrity: opts.integrity
@@ -67,0 +65,0 @@ }).on('integrity', d => { integrity = d })

lib/fetchers/registry/manifest.js

@@ -30,3 +30,3 @@ 'use strict'
     } catch (err) {
-      if (err.code === 'ETARGET' && packument._cached && !opts.offline) {
+      if ((err.code === 'ETARGET' || err.code === 'E403') && packument._cached && !opts.offline) {
         opts.log.silly(
@@ -33,0 +33,0 @@ 'registry:manifest',

package.json

 {
   "name": "@evocateur/pacote",
-  "version": "9.6.3",
+  "version": "9.6.4",
   "description": "JavaScript package downloader",
@@ -49,6 +49,8 @@ "main": "index.js",
     "bluebird": "^3.5.3",
-    "cacache": "^12.0.0",
+    "cacache": "^12.0.2",
+    "chownr": "^1.1.2",
     "figgy-pudding": "^3.5.1",
     "get-stream": "^4.1.0",
     "glob": "^7.1.4",
+    "infer-owner": "^1.0.4",
     "lru-cache": "^5.1.1",
@@ -63,3 +65,3 @@ "make-fetch-happen": "^5.0.0",
     "npm-packlist": "^1.4.4",
-    "npm-pick-manifest": "^2.2.3",
+    "npm-pick-manifest": "^3.0.0",
     "osenv": "^0.1.5",
@@ -66,0 +68,0 @@ "promise-inflight": "^1.0.1",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

118715

increased by3.5%

Lines of code

1833

increased by1.44%

Worsened metrics

Dependency count

29

increased by7.41%

Dependency changes

• + Addedchownr@^1.1.2

• + Addedinfer-owner@^1.0.4

• + Addednpm-pick-manifest@3.0.2(transitive)

• - Removednpm-pick-manifest@2.2.3(transitive)

• Updatedcacache@^12.0.2

• Updatednpm-pick-manifest@^3.0.0