Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: support strictValidateTarballPkg #546

Merged
merged 3 commits into from
Jul 9, 2023
Merged

feat: support strictValidateTarballPkg #546

merged 3 commits into from
Jul 9, 2023

Conversation

elrrrrrrr
Copy link
Member

@elrrrrrrr elrrrrrrr commented Jul 8, 2023 •
edited
Loading

Validate the manifest and tarball info to prevent contamination during consumption, closes #542.

  1. 🔨 Added the "strictValidateTarballPkg" mode to enable validation, only applicable to the slef registry scenario.
  2. 🧶 When the configuration is enabled, validate the relevant fields during publishing, currently only validating the fields affecting consumption.
  3. ♻️ No corrective actions will be taken for existing scenario data.

发布时校验 manifest 和 tarball 字段是否陪陪，防止消费时被污染 closes #542

  1. 🔨 新增 strictValidateTarballPkg 配置，仅对在发布当前 registry 场景下生效
  2. 🧶 配置开启时，发布时校验相关字段，目前仅校验影响消费相关字段
  3. ♻️ 存量场景数据不做订正处理

@elrrrrrrr elrrrrrrr added the enhancement New feature or request label Jul 8, 2023
@codecov
Copy link

codecov bot commented Jul 8, 2023 •
edited
Loading

Codecov Report

Merging #546 (f56ec9d) into master (ab2fde7) will decrease coverage by 0.06%.
The diff coverage is 95.55%.

@@            Coverage Diff             @@
##           master     #546      +/-   ##
==========================================
- Coverage   97.02%   96.96%   -0.06%     
==========================================
  Files         174      174              
  Lines       16588    16632      +44     
  Branches     2177     2181       +4     
==========================================
+ Hits        16095    16128      +33     
- Misses        493      504      +11
Impacted Files Coverage Δ
app/common/PackageUtil.ts 97.61% <90.90%> (-1.42%) ⬇️
app/port/config.ts 100.00% <100.00%> (ø)
...controller/package/SavePackageVersionController.ts 100.00% <100.00%> (ø)
config/config.default.ts 88.48% <100.00%> (+0.06%) ⬆️

... and 2 files with indirect coverage changes

fengmk2
fengmk2 reviewed Jul 9, 2023
View reviewed changes
app/common/PackageUtil.ts Outdated
onentry: entry => {
let json = '';
entry.on('data', data => {
json += data.toString();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

应该不是走这种模式，data 是 buffer，走 buffer concat ，要不然有机会导致 json 最终拼接出来是错误的

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

entry 是一个 stream？参考 https://github.com/node-modules/urllib/blob/master/test/utils.ts#L14

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

使用 await stream 的方式来拼接 Buffer，替换了原有方式。

由于在 onentry 才能拿到对应的 stream，还是使用了 Promise 来返回异步结果。

fengmk2
fengmk2 reviewed Jul 9, 2023
View reviewed changes
app/port/config.ts Outdated Show resolved Hide resolved
@elrrrrrrr elrrrrrrr marked this pull request as draft July 9, 2023 04:53
@elrrrrrrr elrrrrrrr marked this pull request as ready for review July 9, 2023 14:39
@elrrrrrrr elrrrrrrr requested a review from fengmk2 July 9, 2023 14:39
@elrrrrrrr elrrrrrrr changed the title feat: support strictlyValidateTarballPkg feat: support strictValidateTarballPkg Jul 9, 2023
@fengmk2 fengmk2 merged commit dd3438f into master Jul 9, 2023
@fengmk2 fengmk2 deleted the tarbll-pkg branch July 9, 2023 15:32
fengmk2 pushed a commit that referenced this pull request Jul 9, 2023
@semantic-release-bot
Release 3.36.0
f5da7e6 
[skip ci]

## [3.36.0](v3.35.1...v3.36.0) (2023-07-09)

### Features

* support strictValidateTarballPkg ([#546](#546)) ([dd3438f](dd3438f)), closes [#542](#542)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

@fengmk2 fengmk2 fengmk2 approved these changes

@gemwuu gemwuu Awaiting requested review from gemwuu

@killagu killagu Awaiting requested review from killagu

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

strictly enforces/validates manifest and tgz
2 participants
@elrrrrrrr @fengmk2