Skip to content

Commit 100be8a

Browse files
authored
feat: add default untrusted list (#4)
* feat: add default untrusted list for packages with unnecessary postinstall scripts * feat: generate allowBuilds.json as Record<string, boolean> for pnpm v11 * fix: run update-list before tests to generate allowBuilds.json * fix: lazy-load allowBuilds.json so tests work without generating it * fix: don't overwrite untrusted entries in allowBuilds.json and remove network-dependent pretest
1 parent d389a45 commit 100be8a

7 files changed

Lines changed: 73 additions & 8 deletions

File tree

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
allowBuilds.json

index.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
11
module.exports.TRUSTED_PACKAGE_NAMES = require('./allow.json')
2+
3+
Object.defineProperty(module.exports, 'DEFAULT_ALLOW_BUILDS', {
4+
get () { return require('./allowBuilds.json') },
5+
enumerable: true,
6+
})

package.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
"files": [
77
"index.js",
88
"allow.json",
9+
"allowBuilds.json",
10+
"untrusted.js",
911
"pnpmfile.cjs"
1012
],
1113
"scripts": {

pnpmfile.cjs

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,16 @@ module.exports = {
44
const pnpmMajor = parseInt(config.packageManager?.version?.split('.')[0] ?? '0', 10)
55
const useAllowBuilds = pnpmMajor >= 11
66
const defaultAllowed = require('./allow.json')
7+
const defaultUntrusted = require('./untrusted.js')
78
if (useAllowBuilds) {
89
if (config.allowBuilds == null) {
910
config.allowBuilds = {}
1011
}
12+
for (const untrusted of defaultUntrusted) {
13+
if (config.allowBuilds[untrusted] == null) {
14+
config.allowBuilds[untrusted] = false
15+
}
16+
}
1117
for (const allowed of defaultAllowed) {
1218
if (config.allowBuilds[allowed] == null) {
1319
config.allowBuilds[allowed] = true
@@ -17,14 +23,14 @@ module.exports = {
1723
if (config.onlyBuiltDependencies == null) {
1824
config.onlyBuiltDependencies = []
1925
}
20-
if (!config.ignoredBuiltDependencies?.length) {
21-
config.onlyBuiltDependencies.push(...defaultAllowed)
22-
} else {
23-
const ignored = new Set(config.ignoredBuiltDependencies)
24-
for (const allowed of defaultAllowed) {
25-
if (!ignored.has(allowed)) {
26-
config.onlyBuiltDependencies.push(allowed)
27-
}
26+
if (config.ignoredBuiltDependencies == null) {
27+
config.ignoredBuiltDependencies = []
28+
}
29+
config.ignoredBuiltDependencies.push(...defaultUntrusted)
30+
const ignored = new Set(config.ignoredBuiltDependencies)
31+
for (const allowed of defaultAllowed) {
32+
if (!ignored.has(allowed)) {
33+
config.onlyBuiltDependencies.push(allowed)
2834
}
2935
}
3036
}

test.js

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ test('populates onlyBuiltDependencies for pnpm < 11', () => {
1717
assert.equal(config.allowBuilds, undefined)
1818
})
1919

20+
test('excludes untrusted packages for pnpm < 11', () => {
21+
const config = {
22+
packageManager: { version: '10.28.1' },
23+
}
24+
pnpmfile.hooks.updateConfig(config)
25+
assert(!config.onlyBuiltDependencies.includes('core-js'))
26+
assert(config.ignoredBuiltDependencies.includes('core-js'))
27+
})
28+
2029
test('do not reenable dependency builds for pnpm < 11', () => {
2130
const config = {
2231
packageManager: { version: '10.28.1' },
@@ -38,6 +47,23 @@ test('populates allowBuilds for pnpm >= 11', () => {
3847
assert.equal(config.onlyBuiltDependencies, undefined)
3948
})
4049

50+
test('excludes untrusted packages for pnpm >= 11', () => {
51+
const config = {
52+
packageManager: { version: '11.0.0' },
53+
}
54+
pnpmfile.hooks.updateConfig(config)
55+
assert.equal(config.allowBuilds['core-js'], false)
56+
})
57+
58+
test('respects user override of untrusted package for pnpm >= 11', () => {
59+
const config = {
60+
packageManager: { version: '11.0.0' },
61+
allowBuilds: { 'core-js': true },
62+
}
63+
pnpmfile.hooks.updateConfig(config)
64+
assert.equal(config.allowBuilds['core-js'], true)
65+
})
66+
4167
test('do not reenable dependency builds for pnpm >= 11', () => {
4268
const config = {
4369
packageManager: { version: '11.0.0' },

untrusted.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
module.exports = [
2+
// Prints a message in postinstall script
3+
'core-js',
4+
'core-js-pure',
5+
'es5-ext',
6+
'less',
7+
'protobufjs',
8+
]

updateList.ts

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,24 @@ async function fetchToJson (
2626
const outPath = `allow.json`
2727
await writeFile(outPath, JSON.stringify(combined, null, 2), "utf8")
2828

29+
// Generate allowBuilds.json (Record<string, boolean>)
30+
const { createRequire } = await import('node:module')
31+
const require = createRequire(import.meta.url)
32+
const untrusted: string[] = require('./untrusted.js')
33+
const allowBuilds: Record<string, boolean> = {}
34+
for (const pkg of untrusted.sort()) {
35+
allowBuilds[pkg] = false
36+
}
37+
for (const pkg of combined) {
38+
if (!(pkg in allowBuilds)) {
39+
allowBuilds[pkg] = true
40+
}
41+
}
42+
const allowBuildsPath = 'allowBuilds.json'
43+
await writeFile(allowBuildsPath, JSON.stringify(allowBuilds, null, 2), "utf8")
44+
2945
console.log(`✅ Saved ${combined.length} items to ${outPath} (${bunEntries.length} from bun + ${pnpmEntries.length} from pnpm-allow.json)`)
46+
console.log(`✅ Saved ${Object.keys(allowBuilds).length} items to ${allowBuildsPath}`)
3047
}
3148

3249
fetchToJson().catch((err) => {

0 commit comments

Comments
 (0)