Skip to content

Commit 192f448

Browse files
wraithgarwraithgar
committed
feat: add support for git-256 sha lengths
They are 64 characters long, not 40
1 parent 417daa7 commit 192f448

File tree

2 files changed

+179
-128
lines changed

2 files changed

+179
-128
lines changed

‎workspaces/arborist/lib/dep-valid.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ const depValid = (child, requested, requestor) => {
8282
const resRepo = npa(child.resolved || '')
8383
const resHost = resRepo.hosted
8484
const reqHost = requested.hosted
85-
const reqCommit = /^[a-fA-F0-9]{40}$/.test(requested.gitCommittish || '')
85+
const reqCommit = /^[a-fA-F0-9]{40,64}$/.test(requested.gitCommittish || '')
8686
const nc = { noCommittish: !reqCommit }
8787
if (!resHost) {
8888
if (resRepo.fetchSpec !== requested.fetchSpec) {

‎workspaces/arborist/test/dep-valid.js‎

Lines changed: 178 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -9,133 +9,136 @@ const emptyRequestor = {
99
edgesOut: new Map(),
1010
}
1111

12-
t.ok(depValid({}, '', null, emptyRequestor), '* is always ok')
13-
14-
t.ok(depValid({
15-
package: {
16-
version: '1.2.3',
17-
},
18-
get version () {
19-
return this.package.version
20-
},
21-
}, '1.x', null, emptyRequestor), 'range that is satisfied')
22-
23-
t.ok(depValid({
24-
package: {
25-
version: '2.2.3',
26-
},
27-
get version () {
28-
return this.package.version
29-
},
30-
}, '1.x', '2.x', emptyRequestor), 'range that is acceptable')
31-
32-
t.ok(depValid({
33-
isLink: true,
34-
realpath: '/some/path',
35-
}, normalizePaths(npa('file:/some/path')), null, emptyRequestor), 'links must point at intended target')
36-
37-
t.notOk(depValid({
38-
isLink: true,
39-
realpath: '/some/other/path',
40-
}, 'file:/some/path', null, emptyRequestor), 'links must point at intended target')
41-
42-
t.notOk(depValid({
43-
realpath: '/some/path',
44-
}, 'file:/some/path', null, emptyRequestor), 'file:// must be a link')
45-
46-
t.ok(depValid({
47-
name: 'foo',
48-
resolved: 'git://host/repo#somebranch',
49-
package: {
50-
version: '1.2.3',
51-
},
52-
get version () {
53-
return this.package.version
54-
},
55-
}, 'git://host/repo#semver:1.x', null, emptyRequestor), 'git url with semver range')
56-
57-
t.ok(depValid({
58-
name: 'foo',
59-
package: {
60-
name: 'bar',
61-
version: '1.2.3',
62-
},
63-
get version () {
64-
return this.package.version
65-
},
66-
}, 'npm:bar@1.2.3', null, emptyRequestor), 'alias is ok')
67-
68-
t.ok(depValid({
69-
resolved: 'https://registry/abbrev-1.1.1.tgz',
70-
package: {},
71-
get version () {
72-
return this.package.version
73-
},
74-
}, 'https://registry/abbrev-1.1.1.tgz', null, emptyRequestor), 'remote url match')
75-
76-
t.ok(depValid({
77-
resolved: 'git+ssh://git@github.com/foo/bar',
78-
package: {},
79-
get version () {
80-
return this.package.version
81-
},
82-
}, 'git+ssh://git@github.com/foo/bar.git', null, emptyRequestor), 'matching _from saveSpec')
83-
84-
t.notOk(depValid({
85-
resolved: 'git+ssh://git@github.com/foo/bar',
86-
package: {},
87-
get version () {
88-
return this.package.version
89-
},
90-
}, 'git+ssh://git@github.com/bar/foo.git', null, emptyRequestor), 'different repo')
91-
92-
t.notOk(depValid({
93-
package: {},
94-
get version () {
95-
return this.package.version
96-
},
97-
}, 'git+ssh://git@github.com/bar/foo.git', null, emptyRequestor), 'missing repo')
98-
99-
t.ok(depValid({
100-
resolved: `file:${resolve('/path/to/tarball.tgz')}`,
101-
}, resolve('/path/to/tarball.tgz'), null, emptyRequestor), 'same tarball')
102-
103-
t.notOk(depValid({
104-
resolved: 'file:/path/to/other/tarball.tgz',
105-
}, '/path/to/tarball.tgz', null, emptyRequestor), 'different tarball')
106-
107-
t.notOk(depValid({
108-
isLink: true,
109-
}, '/path/to/tarball.tgz', null, emptyRequestor), 'links are not tarballs')
110-
111-
t.ok(depValid({
112-
package: {
113-
_requested: {
114-
saveSpec: 'file:tarball.tgz',
115-
},
116-
},
117-
get version () {
118-
return this.package.version
119-
},
120-
}, './tarball.tgz', null, emptyRequestor), 'probably the same-ish, hopefully')
121-
122-
t.notOk(depValid({
123-
package: {},
124-
get version () {
125-
return this.package.version
126-
},
127-
}, './tarball.tgz', null, emptyRequestor), 'too uncertain, nope')
128-
129-
t.ok(depValid({
130-
resolved: 'https://registry.npmjs.org/foo/foo-1.2.3.tgz',
131-
}, 'latest', null, emptyRequestor), 'tagged registry version needs remote tarball')
132-
133-
t.notOk(depValid({
134-
resolved: 'git+https://registry.npmjs.org/foo/foo-1.2.3.git',
135-
}, 'latest', null, emptyRequestor), 'tagged registry version needs remote tarball, not git')
136-
137-
t.notOk(depValid({}, 'latest', null, emptyRequestor),
138-
'tagged registry version needs remote tarball resolution')
12+
t.test('basic', t => {
13+
t.ok(depValid({}, '', null, emptyRequestor), '* is always ok')
14+
15+
t.ok(depValid({
16+
package: {
17+
version: '1.2.3',
18+
},
19+
get version () {
20+
return this.package.version
21+
},
22+
}, '1.x', null, emptyRequestor), 'range that is satisfied')
23+
24+
t.ok(depValid({
25+
package: {
26+
version: '2.2.3',
27+
},
28+
get version () {
29+
return this.package.version
30+
},
31+
}, '1.x', '2.x', emptyRequestor), 'range that is acceptable')
32+
33+
t.ok(depValid({
34+
isLink: true,
35+
realpath: '/some/path',
36+
}, normalizePaths(npa('file:/some/path')), null, emptyRequestor), 'links must point at intended target')
37+
38+
t.notOk(depValid({
39+
isLink: true,
40+
realpath: '/some/other/path',
41+
}, 'file:/some/path', null, emptyRequestor), 'links must point at intended target')
42+
43+
t.notOk(depValid({
44+
realpath: '/some/path',
45+
}, 'file:/some/path', null, emptyRequestor), 'file:// must be a link')
46+
47+
t.ok(depValid({
48+
name: 'foo',
49+
resolved: 'git://host/repo#somebranch',
50+
package: {
51+
version: '1.2.3',
52+
},
53+
get version () {
54+
return this.package.version
55+
},
56+
}, 'git://host/repo#semver:1.x', null, emptyRequestor), 'git url with semver range')
57+
58+
t.ok(depValid({
59+
name: 'foo',
60+
package: {
61+
name: 'bar',
62+
version: '1.2.3',
63+
},
64+
get version () {
65+
return this.package.version
66+
},
67+
}, 'npm:bar@1.2.3', null, emptyRequestor), 'alias is ok')
68+
69+
t.ok(depValid({
70+
resolved: 'https://registry/abbrev-1.1.1.tgz',
71+
package: {},
72+
get version () {
73+
return this.package.version
74+
},
75+
}, 'https://registry/abbrev-1.1.1.tgz', null, emptyRequestor), 'remote url match')
76+
77+
t.ok(depValid({
78+
resolved: 'git+ssh://git@github.com/foo/bar',
79+
package: {},
80+
get version () {
81+
return this.package.version
82+
},
83+
}, 'git+ssh://git@github.com/foo/bar.git', null, emptyRequestor), 'matching _from saveSpec')
84+
85+
t.notOk(depValid({
86+
resolved: 'git+ssh://git@github.com/foo/bar',
87+
package: {},
88+
get version () {
89+
return this.package.version
90+
},
91+
}, 'git+ssh://git@github.com/bar/foo.git', null, emptyRequestor), 'different repo')
92+
93+
t.notOk(depValid({
94+
package: {},
95+
get version () {
96+
return this.package.version
97+
},
98+
}, 'git+ssh://git@github.com/bar/foo.git', null, emptyRequestor), 'missing repo')
99+
100+
t.ok(depValid({
101+
resolved: `file:${resolve('/path/to/tarball.tgz')}`,
102+
}, resolve('/path/to/tarball.tgz'), null, emptyRequestor), 'same tarball')
103+
104+
t.notOk(depValid({
105+
resolved: 'file:/path/to/other/tarball.tgz',
106+
}, '/path/to/tarball.tgz', null, emptyRequestor), 'different tarball')
107+
108+
t.notOk(depValid({
109+
isLink: true,
110+
}, '/path/to/tarball.tgz', null, emptyRequestor), 'links are not tarballs')
111+
112+
t.ok(depValid({
113+
package: {
114+
_requested: {
115+
saveSpec: 'file:tarball.tgz',
116+
},
117+
},
118+
get version () {
119+
return this.package.version
120+
},
121+
}, './tarball.tgz', null, emptyRequestor), 'probably the same-ish, hopefully')
122+
123+
t.notOk(depValid({
124+
package: {},
125+
get version () {
126+
return this.package.version
127+
},
128+
}, './tarball.tgz', null, emptyRequestor), 'too uncertain, nope')
129+
130+
t.ok(depValid({
131+
resolved: 'https://registry.npmjs.org/foo/foo-1.2.3.tgz',
132+
}, 'latest', null, emptyRequestor), 'tagged registry version needs remote tarball')
133+
134+
t.notOk(depValid({
135+
resolved: 'git+https://registry.npmjs.org/foo/foo-1.2.3.git',
136+
}, 'latest', null, emptyRequestor), 'tagged registry version needs remote tarball, not git')
137+
138+
t.notOk(depValid({}, 'latest', null, emptyRequestor),
139+
'tagged registry version needs remote tarball resolution')
140+
t.end()
141+
})
139142

140143
t.test('unsupported dependency type', t => {
141144
const requestor = { errors: [], edgesOut: new Map() }
@@ -202,3 +205,51 @@ t.test('installLinks does not make workspace nodes invalid', t => {
202205
t.ok(depValid(child, request, null, requestor))
203206
t.end()
204207
})
208+
209+
t.test('sha-1 and sha-256', t => {
210+
t.ok(depValid({
211+
name: 'foo',
212+
resolved: 'npm/repo#0d7bd85a85fa2571fa532d2fc842ed099b236ad2',
213+
package: {
214+
version: '1.2.3',
215+
},
216+
get version () {
217+
return this.package.version
218+
},
219+
}, 'npm/repo#0d7bd85a85fa2571fa532d2fc842ed099b236ad2', null, emptyRequestor), 'git url with full sha-1 hash match')
220+
221+
t.notOk(depValid({
222+
name: 'foo',
223+
resolved: 'npm/repo#0d7bd85a85fa2571fa532d2fc842ed099b236ad2',
224+
package: {
225+
version: '1.2.3',
226+
},
227+
get version () {
228+
return this.package.version
229+
},
230+
}, 'npm/repo#1d7bd85a85fa2571fa532d2fc842ed099b236ad2', null, emptyRequestor), 'git url with full sha-1 hash mismatch')
231+
232+
t.ok(depValid({
233+
name: 'foo',
234+
resolved: 'npm/repo#8e3a9b3579ab330238c06b761e7f1b5dc5b4ac6e5a96da4dd2fb3b7411009df8',
235+
package: {
236+
version: '1.2.3',
237+
},
238+
get version () {
239+
return this.package.version
240+
},
241+
}, 'npm/repo#8e3a9b3579ab330238c06b761e7f1b5dc5b4ac6e5a96da4dd2fb3b7411009df8', null, emptyRequestor), 'git url with full sha-256 hash match')
242+
243+
t.notOk(depValid({
244+
name: 'foo',
245+
resolved: 'npm/repo#8e3a9b3579ab330238c06b761e7f1b5dc5b4ac6e5a96da4dd2fb3b7411009df8',
246+
package: {
247+
version: '1.2.3',
248+
},
249+
get version () {
250+
return this.package.version
251+
},
252+
}, 'npm/repo#9e3a9b3579ab330238c06b761e7f1b5dc5b4ac6e5a96da4dd2fb3b7411009df8', null, emptyRequestor), 'git url with full sha-256 hash mismatch')
253+
254+
t.end()
255+
})

0 commit comments

Comments
 (0)