SRI integrety hash generator for gulp. Based on gulp-buster. 

mathisonian

gulp-sri

Error

Ignore

Warn

License

Maintenance

Miscellaneous

Quality

Supply chain risk

Vulnerability

Admins only

Organization members

Dashboard

<upgradeLink>Upgrade</upgradeLink> to access this feature

About

Blog

Socket CLI

Customers

Socket Dependency Search

Docs

Socket for GitHub

Love

Impersonation Mode Active

Update your browser to the latest version for the best experience.

Your web browser is outdated

Use another browser for the best experience.

Your web browser is unsupported

{{count, number}} commits last two months

{{count, number}} critical severity alert

{{count, number}} critical severity alerts

{{count, number}} dependency vulnerability

{{count, number}} dependency vulnerabilities

{{count, number}} development dependencies

{{count, number}} transitive dependencies

{{count, number}} version published last month

{{count, number}} versions published last month

{{count, number}} version published in last two months

{{count, number}} versions published in last two months

{{count, number}} version published last week

{{count, number}} versions published last week

{{count, number}} version published last year

{{count, number}} versions published last year

Socket undergoes annual SOC2 Type II audits. Socket customers can request a copy of the full SOC2 Type II report.

Allows organization owners and admins to access detailed records of actions taken by members of their organization, complete with timestamps.

Prevent compromised packages from infiltrating your supply chain by monitoring for changes in real-time.

Join our Discord community to get help from Socket engineers and other Socket users.

Compare millions of open source packages on socket.dev

Detect malicious code and risky behavior (e.g. network) in your dependencies using "deep package inspection"

All data is encrypted in transit and at rest using industry standard encryption algorithms.

Get a dedicated Socket account manager and access to Socket’s Customer Success team.

Get dedicated support from Socket engineers via email and Slack.

"Shift left" with the Socket Chrome extension and give intervene early, before developers choose risky or low quality dependencies.

Catch developers using risky dependencies and give them a "speed bump" to encourage good behavior

Install the Socket GitHub app to receive real-time dependency scanning and reports with every pull request.

Integrate Socket into your GitHub SCM to prevent risky dependencies from being installed.

Socket scans for vulnerabilities in your dependencies, including CVEs, security advisories, and more.

Socket supports dependencies in many languages, with most popular ecosystems coming in 2024. We've got you covered no matter what languages you use.

Enforce license policies across your organization

Receive a Microsoft Teams message to the channel of your choice anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Get help migrating from Socket's free plan to Socket's paid plans.

Run Socket on-premises or in your own cloud environment.

Query for any dependency (at any version) across your entire organization

Integrate Socket into your CI/CD pipeline to prevent risky dependencies from being deployed to production.

Analyze an entire project to find supply chain risks

Tag projects to organize and filter your projects

Restrict access based on the roles of individual users within an organization.

Receive a Slack message to the channel of your choice anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Socket is SOC2 Type II compliant and undergoes annual audits.

The Socket CLI allows teams to prevent risky dependencies from being installed, and to get dependency insights from the command line.

Socket supports SAML SSO for single sign-on and identity management.

Integrate Socket into your VS Code IDE to prevent risky dependencies from being installed.

Get a POST request anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Socket will analyzed your SBOMs up to a maximum number of dependencies.

API that allows you to analyze a project, lookup package scores and alerts, and more.

Create API tokens to authenticate with the Socket API and CLI.

The number of developers in your team. A developer is someone who made a commit to your organization's repositories scanned by Socket in the past month.

Use Socket to protect your private repositories.

Socket is always free for open source projects.

Socket retains all reporting data for 3 months, 1 year, or a custom term of your choice.

Access the threat feed that powers Socket.

Unlimited scale, self-hosting, and priority support for large teams.

For open-source projects, individuals, and small teams.

For growing teams with enhanced scale, security, and support.

There is a package with a similar name that is downloaded much more often.

There are packages with similar names that are downloaded much more often.

This may not be the package you want!

Instance

Alert Locations

Package

The {{ecosystem}} package {{- packageName}} receives a total of <strong>{{numWeeklyDownloadCount, number}}</strong> weekly downloads. As such, {{- packageName}} popularity was classified as <strong>{{popularity}}</strong>.

Is {{- packageName}} popular?

Is {{- packageName}} safe to use?

Is {{- packageName}} well maintained?

What is {{- packageName}}?

{{packageDescription}}Version: {{versionString}} was published by {{publisherName}}. Start using Socket to analyze {{- packageName}} and its {{dependencyCount, number}} dependencies to secure your app from supply chain attacks.

Sorry, it seems this package was removed from the registry

Package was removed

This package version has been unpublished, mostly likely due to security reasons

Package version was removed

Provide a detailed description of the malware...

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

Socket - Secure your dependencies. Ship with confidence.

Compare versions

{{- packageName}} - npm Package Compare versions

	hashesStore = {}; // options.fileName: { relativePath: hash }

	return new gutil.PluginError('gulp-sri', msg);

	// positive length = leading characters; negative = trailing

function relativePath(projectPath, filePath) {

	return path.relative(projectPath, filePath).replace(/\\/g, '/');

	return {}.toString.call(value).slice(8, -1);

	if (typeof options === 'string') options = { fileName: options };

	Object.keys(options).forEach(function(option) {

		if (!OPTION_TYPES.hasOwnProperty(option)) throw error('Unsupported option: ' + option);

		if (options[option] !== undefined && !~OPTION_TYPES[option].indexOf(getType(options[option]))) throw error('`options.' + option + '` must be of type ' + OPTION_TYPES[option].join(' or '));

	return defaults({}, options, DEFAULT_OPTIONS);

module.exports = exports = function(options) {

	var hashes = hashesStore[options.fileName] = hashesStore[options.fileName] || {},

		if (file.isStream()) return this.emit('error', error('Streaming not supported'));

		// start hashing files as soon as they are received for maximum concurrency

			Promise.try(hash.bind(undefined, file, options)).then(function(hashed) {

				if (typeof hashed !== 'string') throw error('Return/fulfill value must be a string');

				hashes[relativePath(file.cwd, file.path)] = sliceHash(hashed, options);

		Promise.all(hashingPromises).bind(this).then(function() {

			return options.transform.call(undefined, assign({}, hashes));

			return options.formatter.call(undefined, transformed);

			if (typeof formatted !== 'string') throw error('Return/fulfill value of `options.formatter` must be a string');

				path: path.join(process.cwd(), options.fileName),

			this.emit('error', err instanceof gutil.PluginError ? err : error(err));

// for testing. Don't use, may be removed or changed at anytime

  "description": "SRI integrety hash generator for gulp. Based on gulp-buster.",

    "url": "https://github.com/mathisonian/gulp-sri.git"

    "url": "https://github.com/mathisonian/gulp-sri/issues"

    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- -R dot",

    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly"

# [gulp](https://github.com/gulpjs/gulp/)-sri

[![npm version](http://img.shields.io/npm/v/gulp-sri.svg)](https://npmjs.org/package/gulp-sri)

[![Build Status](https://travis-ci.org/mathisonian/gulp-sri.svg?branch=master)](https://travis-ci.org/mathisonian/gulp-sri)

[SubResource Integrity](http://www.w3.org/TR/SRI/) hashes generator for gulp. Code heavily borrowed from [gulp-buster](https://github.com/UltCombo/gulp-buster).

A way to verify the contents of files after they have been delivered to the browser. There is a good blog post here: https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/

First off, [install gulp](https://github.com/gulpjs/gulp/blob/master/docs/getting-started.md).

Then install gulp-sri as a development dependency:

gulp-sri can be used standalone as part of a build task, or in conjunction with [gulp-watch](https://npmjs.org/package/gulp-watch) to update the hashes as the files are modified.

Example with gulp-watch `^1.0.5` and gulp-ruby-sass `^0.7.1` (compile, bust and watch for changes):

				.pipe(sri())           // pipe generated files into gulp-sri

				.pipe(gulp.dest('.'));  // output sri.json to project root

- `options` (object|string, optional): the configuration options object. Passing `options` as a string is treated as `{ fileName: options }`.

- `options.fileName` (string, optional): the output filename. Defaults to `'sri.json'`.

- `options.algorithms` (string|function, optional): the hashing algorithms to be used. Defaults to `['sha256']`. This option is passed directly to the [sri-toolbox](https://github.com/neftaly/npm-sri-toolbox).

- `options.type` (string, optional): Content type string to be included in the output hash. This option is passed directly to the [sri-toolbox](https://github.com/neftaly/npm-sri-toolbox).

- `options.transform` (function, optional): allows mutating the hashes object, or even creating a completely new data structure, before passing it to the `formatter`. It takes a copy of the hashes object (a plain object in the `filePath: hash` format) as the first argument and must return a value compatible with the `formatter` option. Defaults to passing through the hashes object.

- `options.formatter` (function, optional): the function responsible for serializing the hashes data structure into the string content of the output file. It takes the value returned from the `transform` function as the first argument and must return a string. Defaults to `JSON.stringify`.

**Note:** all of the options which accept a function can be run asynchronously by returning a promise (or *thenable*). If the given option has a return value constraint, the constraint will still be applied to the promise's fulfillment value.

gulp-sri is language-agnostic, thus this part relies on you and your specific use case. By default, gulp-sri generates a JSON file in the following format:

	"path/to/file/relative/to/project/root/filename.ext": "srihash",

Integration can be easily achieved on any language which supports JSON parsing, in either back-end or front-end. See the [Implementations page](https://github.com/UltCombo/gulp-buster/blob/master/IMPLEMENTATIONS.md) for examples and existing solutions for your language of choice.

**Note:** The output file contents' data structure and format can be customized through the [configuration options](#parameters). This enables gulp-sri to output the cache buster hashes file in a suitable native data structure for your target language, as well as allowing to mutate the paths and hashes to suit your specific needs.

When gulp-sri is initialized, it creates an empty object which serves as a cache for the generated hashes. Generated hashes are then grouped by the `options.fileName` parameter. That means, piping two different streams into `sri('foo.json')` will merge both of those streams' files' hashes into the same output file. This approach's main pros are:

- Allows piping only modified files into gulp-sri, the other hashes are retrieved from the cache when generating the output file;

- Deleted files' hashes are automatically cleaned on startup, as the hashes cache object starts empty on every startup;

- Although this feature is very similar to [gulp-remember](https://github.com/ahaurw01/gulp-remember), gulp-sri's hashes cache is much more efficient. Using gulp-remember would cause all of the files that have ever went through the stream to be re-hashed whenever piping any new file, unlike gulp-sri's hashes cache which allows hashing only the files that are piped into gulp-buster.

There are close to no cons, the only notable drawback is that all the to-be-hashed files must be piped into gulp-sri (preferably at startup) before it generates the output file with all hashes that you'd expect. A feature to allow inputting an already-generated hashes file was considered in order to avoid having to pipe all the to-be-hashed files at startup, but that seems to bring more cons than pros -- the auto-cleanup of deleted files' hashes would no longer happen, outdated hashes could stay in the output hashes file if the to-be-hashed files were edited while gulp was not running, and finally it'd also be incompatible with the `transform` and `formatter` features.

		0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,

		0xff, 0xff, 0xff, 0x21, 0xf9, 0x04, 0x01, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x00,

		0x01, 0x00, 0x01, 0x00, 0x00, 0x02, 0x01, 0x44, 0x00, 0x3b

	fileBustPath = bust._relativePath(file.cwd, file.path),

	file2BustPath = bust._relativePath(file2.cwd, file2.path),

	fileHash = bust._hash(file, bust._DEFAULT_OPTIONS),

	file2Hash = bust._hash(file2, bust._DEFAULT_OPTIONS);

describe('Configuration-independent internal methods', function() {

		it('should return an instance of PluginError', function() {

			bust._error('err').should.be.an.instanceOf(gutil.PluginError);

	describe('_relativePath()', function() {

		it('should return a path relative to project root', function() {

			bust._relativePath('/projectRoot/', '/projectRoot/folder/file.ext').should.equal('folder/file.ext');

		it('should return the correct type for all native values', function() {

			bust._getType('').should.equal('String');

			bust._getType(0).should.equal('Number');

			bust._getType({}).should.equal('Object');

			bust._getType([]).should.equal('Array');

			bust._getType(null).should.equal('Null');

			bust._getType(undefined).should.equal('Undefined');

			bust._getType(false).should.equal('Boolean');

			bust._getType(function() {}).should.equal('Function');

			bust._getType(/(?:)/).should.equal('RegExp');

			bust._getType(new Date()).should.equal('Date');

			bust._getType(new Error()).should.equal('Error');

	describe('_assignOptions()', function() {

		it('should assign options', function() {

			var options = { algorithms: ['sha256'] };

			bust._assignOptions(options).should.eql(assign({}, bust._DEFAULT_OPTIONS, options));

		it('should return the default options when no options are passed', function() {

			bust._assignOptions().should.eql(bust._DEFAULT_OPTIONS);

		it('should treat `options` string as `options.fileName`', function() {

			bust._assignOptions(fileName).fileName.should.equal(fileName);

		it('should set options whose value evaluate to `undefined` to their default value', function() {

			bust._assignOptions({ fileName: undefined }).should.eql(bust._DEFAULT_OPTIONS);

		it('should not mutate the `options` argument', function() {

		it('should throw on unsupported options', function() {

		@@ -31,3 +31,3 @@ 'use strict';
		algorithms: options.algorithms
		}, file.contents.toString());
		}, file.contents);
		}
		@@ -34,0 +34,0 @@

		{
		"name": "gulp-sri",
		"description": "SRI integrety hash generator for gulp. Based on gulp-buster.",
		"version": "0.3.0",
		"version": "0.3.1",
		"author": {
		@@ -6,0 +6,0 @@ "name": "Matthew Conlen",

		@@ -7,3 +7,7 @@ 'use strict';
		fileContentStr = 'foo',
		file2ContentStr = 'bar',
		file2ContentStr = [ // Transparent.gif
		0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
		0xff, 0xff, 0xff, 0x21, 0xf9, 0x04, 0x01, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x00,
		0x01, 0x00, 0x01, 0x00, 0x00, 0x02, 0x01, 0x44, 0x00, 0x3b
		],
		file = new gutil.File({
		@@ -199,2 +203,10 @@ cwd: 'C:/users/ult/',

		it('should correctly generate the hash for a binary file', function(done) {
		var stream = bust({ algorithms: ['sha256'] });
		stream.on('data', function(newFile) {
		JSON.parse(newFile.contents.toString())[file2BustPath].should.be.exactly('sha256-7xlVrnV8i5ZsgySDUDMb06MPZYztEfOH+OvwWrM2hik=');
		done();
		});
		stream.end(file2);
		});
		});
		@@ -201,0 +213,0 @@

Improved metrics