feat: check the contents of zip or tar.gz packages against allow lists COMPASS-8743 (#6679)

Author: lerouxb

.evergreen/verify-artifacts.sh

@@ -74,18 +74,23 @@ if [ "$IS_WINDOWS" = true ]; then
   verify_using_powershell $WINDOWS_EXE_NAME
   verify_using_powershell $WINDOWS_MSI_NAME
   echo "Skipping verification for Windows artifacts using gpg: $WINDOWS_ZIP_NAME, $WINDOWS_NUPKG_NAME"
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
+
 elif [ "$IS_UBUNTU" = true ]; then
   setup_gpg
   verify_using_gpg $LINUX_DEB_NAME
   verify_using_gpg $LINUX_TAR_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 elif [ "$IS_RHEL" = true ]; then
   setup_gpg
   verify_using_rpm $RHEL_RPM_NAME
   verify_using_gpg $RHEL_TAR_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 elif [ "$IS_OSX" = true ]; then
   setup_gpg
   verify_using_gpg $OSX_ZIP_NAME
   verify_using_codesign $OSX_DMG_NAME
+  DEBUG=compass* npm run -w mongodb-compass verify-package-contents
 else
   echo "Unknown OS, failed to verify file signing"
   exit 1

package-lock.json

@@ -28,8 +28,7 @@
     "test-web": "env DEBUG=hadron*,mongo*,compass*,xvfb-maybe* npm run test web",
     "test-web-noserver": "env DEBUG=hadron*,mongo*,compass*,xvfb-maybe* npm run test web -- --disable-start-stop --bail",
     "coverage-merge": "nyc merge .log/coverage .nyc_output/coverage.json",
-    "coverage-report": "npm run coverage-merge && nyc report",
-    "smoketest": "ts-node smoke-test.ts"
+    "coverage-report": "npm run coverage-merge && nyc report"
   },
   "devDependencies": {
     "@electron/rebuild": "^3.7.1",

packages/compass-e2e-tests/package.json

@@ -168,7 +168,8 @@
     "depcheck": "depcheck",
     "test-ci-electron": "npm run test-electron",
     "typecheck": "tsc -p tsconfig-lint.json --noEmit",
-    "reformat": "npm run eslint . -- --fix && npm run prettier -- --write ."
+    "reformat": "npm run eslint . -- --fix && npm run prettier -- --write .",
+    "verify-package-contents": "ts-node ./scripts/verify-package-contents.ts"
   },
   "repository": {
     "type": "git",
@@ -190,6 +191,7 @@
   "devDependencies": {
     "@electron/rebuild": "^3.7.1",
     "@electron/remote": "^2.1.2",
+    "@types/minimatch": "^5.1.2",
     "@mongodb-js/atlas-service": "^0.35.1",
     "@mongodb-js/compass-aggregations": "^9.52.1",
     "@mongodb-js/compass-app-stores": "^7.36.1",
@@ -252,12 +254,14 @@
     "electron-squirrel-startup": "^1.0.1",
     "ensure-error": "^3.0.1",
     "eslint": "^7.25.0",
-    "hadron-app-registry": "^9.4.1",
-    "hadron-build": "^25.7.1",
-    "hadron-ipc": "^3.4.1",
+    "glob": "^10.2.5",
     "local-links": "^1.4.0",
     "make-fetch-happen": "^10.2.1",
     "marky": "^1.2.1",
+    "hadron-app-registry": "^9.4.1",
+    "hadron-build": "^25.7.1",
+    "hadron-ipc": "^3.4.1",
+    "minimatch": "^10.0.1",
     "mongodb": "^6.12.0",
     "mongodb-build-info": "^1.7.2",
     "mongodb-cloud-info": "^2.1.2",