Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

strictly enforces/validates manifest and tgz #542

Closed
fengmk2 opened this issue Jul 4, 2023 · 1 comment · Fixed by #546
Closed

strictly enforces/validates manifest and tgz #542

fengmk2 opened this issue Jul 4, 2023 · 1 comment · Fixed by #546
Assignees
@elrrrrrrr
Labels
enhancement New feature or request

Comments

@fengmk2
Copy link
Member

fengmk2 commented Jul 4, 2023

https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem?utm_source=ESnextNews.com&utm_medium=Weekly+Newsletter&utm_campaign=2023-07-04

cc @elrrrrrrr
@fengmk2 fengmk2 added the enhancement New feature or request label Jul 4, 2023
@elrrrrrrr
Copy link
Member

先完善在当前 registry 上发私有包的场景，公网包还是以 npm registry 为准

@elrrrrrrr elrrrrrrr mentioned this issue Jul 8, 2023
Merged
fengmk2 pushed a commit that referenced this issue Jul 9, 2023
@elrrrrrrr
feat: support strictValidateTarballPkg (#546)
dd3438f 
> Validate the manifest and tarball info to prevent contamination during
consumption, closes #542.
1. 🔨 Added the "strictValidateTarballPkg" mode to enable validation,
only applicable to the slef registry scenario.
2. 🧶 When the configuration is enabled, validate the relevant fields
during publishing, currently only validating the fields affecting
consumption.
3. ♻️ No corrective actions will be taken for existing scenario data.
-----

> 发布时校验 manifest 和 tarball 字段是否陪陪，防止消费时被污染 closes #542
1. 🔨 新增 strictValidateTarballPkg 配置，仅对在发布当前 registry 场景下生效
2. 🧶 配置开启时，发布时校验相关字段，目前仅校验影响消费相关字段
3. ♻️ 存量场景数据不做订正处理
fengmk2 pushed a commit that referenced this issue Jul 9, 2023
@semantic-release-bot
Release 3.36.0
f5da7e6 
[skip ci]

## [3.36.0](v3.35.1...v3.36.0) (2023-07-09)

### Features

* support strictValidateTarballPkg ([#546](#546)) ([dd3438f](dd3438f)), closes [#542](#542)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@elrrrrrrr elrrrrrrr

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: support strictValidateTarballPkg cnpm/cnpmcore
2 participants
@fengmk2 @elrrrrrrr