feat: add no-downgrade package trust policy

lib/commands/ci.js

@@ -1,6 +1,7 @@
 const reifyFinish = require('../utils/reify-finish.js')
 const resolveAllowScripts = require('../utils/resolve-allow-scripts.js')
 const strictAllowScriptsPreflight = require('../utils/strict-allow-scripts-preflight.js')
+const trustPolicyPreflight = require('../utils/trust-policy-preflight.js')
 const runScript = require('@npmcli/run-script')
 const fs = require('node:fs/promises')
 const path = require('node:path')
@@ -31,6 +32,9 @@ class CI extends ArboristWorkspaceCmd {
     'allow-scripts',
     'strict-allow-scripts',
     'dangerously-allow-all-scripts',
+    'trust-policy',
+    'trust-policy-exclude',
+    'trust-policy-ignore-after',
     'audit',
     'bin-links',
     'fund',
@@ -113,6 +117,8 @@ class CI extends ArboristWorkspaceCmd {
       )
     }
 
+    await trustPolicyPreflight({ arb, options: opts })
+
     if (!dryRun) {
       const workspacePaths = await getWorkspaces([], {
         path: this.npm.localPrefix,

lib/commands/install.js

@@ -7,6 +7,7 @@ const checks = require('npm-install-checks')
 const reifyFinish = require('../utils/reify-finish.js')
 const resolveAllowScripts = require('../utils/resolve-allow-scripts.js')
 const strictAllowScriptsPreflight = require('../utils/strict-allow-scripts-preflight.js')
+const trustPolicyPreflight = require('../utils/trust-policy-preflight.js')
 const { patchRelaxOpts } = require('../utils/cli-only-flag.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
@@ -41,6 +42,9 @@ class Install extends ArboristWorkspaceCmd {
     'before',
     'min-release-age',
     'min-release-age-exclude',
+    'trust-policy',
+    'trust-policy-exclude',
+    'trust-policy-ignore-after',
     'bin-links',
     'fund',
     'dry-run',
@@ -173,6 +177,7 @@ class Install extends ArboristWorkspaceCmd {
 
     const arb = new Arborist(opts)
     await strictAllowScriptsPreflight({ arb, npm: this.npm, idealTreeOpts: opts })
+    await trustPolicyPreflight({ arb, options: opts })
     await arb.reify(opts)
 
     if (runRootLifecycle) {

lib/commands/update.js

@@ -3,6 +3,7 @@ const { log } = require('proc-log')
 const reifyFinish = require('../utils/reify-finish.js')
 const resolveAllowScripts = require('../utils/resolve-allow-scripts.js')
 const strictAllowScriptsPreflight = require('../utils/strict-allow-scripts-preflight.js')
+const trustPolicyPreflight = require('../utils/trust-policy-preflight.js')
 const { patchRelaxOpts } = require('../utils/cli-only-flag.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
@@ -29,6 +30,9 @@ class Update extends ArboristWorkspaceCmd {
     'before',
     'min-release-age',
     'min-release-age-exclude',
+    'trust-policy',
+    'trust-policy-exclude',
+    'trust-policy-ignore-after',
     'bin-links',
     'fund',
     'dry-run',
@@ -71,6 +75,7 @@ class Update extends ArboristWorkspaceCmd {
 
     const reifyOpts = { ...opts, update }
     await strictAllowScriptsPreflight({ arb, npm: this.npm, idealTreeOpts: reifyOpts })
+    await trustPolicyPreflight({ arb, options: reifyOpts })
     await arb.reify(reifyOpts)
     await reifyFinish(this.npm, arb)
   }

lib/utils/trust-policy-preflight.js

@@ -0,0 +1,17 @@
+const { verifyTrustPolicy } = require('@npmcli/arborist/lib/trust-policy-verifier.js')
+
+const trustPolicyPreflight = async ({ arb, options }) => {
+  const effectiveOptions = { ...arb.options, ...options }
+
+  if (effectiveOptions.trustPolicy !== 'no-downgrade') {
+    return
+  }
+
+  if (!arb.idealTree) {
+    await arb.buildIdealTree(options)
+  }
+
+  await verifyTrustPolicy(arb.idealTree, effectiveOptions)
+}
+
+module.exports = trustPolicyPreflight

test/lib/utils/trust-policy-preflight.js

@@ -0,0 +1,83 @@
+const t = require('tap')
+
+const load = t => {
+  const calls = []
+  const preflight = t.mock('../../../lib/utils/trust-policy-preflight.js', {
+    '@npmcli/arborist/lib/trust-policy-verifier.js': {
+      verifyTrustPolicy: async (tree, options) => calls.push({ tree, options }),
+    },
+  })
+  return { preflight, calls }
+}
+
+t.test('no-op when trust policy is disabled', async t => {
+  const { preflight, calls } = load(t)
+  let builds = 0
+  const arb = { idealTree: null,
+    buildIdealTree: async () => {
+      builds++
+    } }
+  await preflight({ arb, options: {} })
+  t.equal(builds, 0)
+  t.equal(calls.length, 0)
+})
+
+t.test('builds and verifies the ideal tree for install-style calls', async t => {
+  const { preflight, calls } = load(t)
+  const idealTree = { inventory: new Map() }
+  let builds = 0
+  const arb = {
+    idealTree: null,
+    buildIdealTree: async options => {
+      builds++
+      t.equal(options.trustPolicy, 'no-downgrade')
+      arb.idealTree = idealTree
+    },
+  }
+  const options = { trustPolicy: 'no-downgrade' }
+  await preflight({ arb, options })
+  t.equal(builds, 1)
+  t.equal(calls.length, 1)
+  t.equal(calls[0].tree, idealTree)
+  t.strictSame(calls[0].options, options)
+})
+
+t.test('reuses a prebuilt ideal tree for ci-style calls', async t => {
+  const { preflight, calls } = load(t)
+  const idealTree = { inventory: new Map() }
+  let builds = 0
+  const arb = { idealTree,
+    buildIdealTree: async () => {
+      builds++
+    } }
+  const options = { trustPolicy: 'no-downgrade', trustPolicyExclude: ['pkg@1'] }
+  await preflight({ arb, options })
+  t.equal(builds, 0)
+  t.equal(calls.length, 1)
+  t.equal(calls[0].tree, idealTree)
+  t.strictSame(calls[0].options, options)
+})
+
+t.test('uses Arborist constructor options for ci-style calls', async t => {
+  const { preflight, calls } = load(t)
+  const idealTree = { inventory: new Map() }
+  const arb = {
+    idealTree,
+    options: {
+      trustPolicy: 'no-downgrade',
+      trustPolicyExclude: ['pkg@1'],
+      registry: 'https://registry.example.test/',
+    },
+  }
+
+  await preflight({ arb, options: { packageLock: true } })
+
+  t.equal(calls.length, 1)
+  t.equal(calls[0].tree, idealTree)
+  t.strictSame(calls[0].options, {
+    trustPolicy: 'no-downgrade',
+    trustPolicyExclude: ['pkg@1'],
+    registry: 'https://registry.example.test/',
+    packageLock: true,
+  })
+})

workspaces/arborist/lib/trust-policy-verifier.js

@@ -0,0 +1,66 @@
+const npa = require('npm-package-arg')
+const pacote = require('pacote')
+const { callLimit: promiseCallLimit } = require('promise-call-limit')
+const { checkTrustDowngrade, isTrustPolicyExcluded } = require('./trust-policy.js')
+
+const registryVersions = tree => {
+  const packages = new Map()
+  for (const node of tree.inventory.values()) {
+    if (node.isProjectRoot || node.isWorkspace || node.isLink || node.inDepBundle || !node.version) {
+      continue
+    }
+
+    // An edgeless node can still be a registry dependency. Only skip when
+    // every actual consumer edge proves the package came from file:, git:,
+    // or remote. If any registry edge reaches the node, verify it.
+    const incomingEdges = [...node.edgesIn]
+    if (incomingEdges.length &&
+        incomingEdges.every(edge => edge.spec && !npa(edge.spec).registry)) {
+      continue
+    }
+    const name = node.packageName || node.name
+    if (!name) {
+      continue
+    }
+
+    if (!packages.has(name)) {
+      packages.set(name, new Set())
+    }
+    packages.get(name).add(node.version)
+  }
+  return packages
+}
+
+const verifyTrustPolicy = async (tree, opts = {}) => {
+  if (opts.trustPolicy !== 'no-downgrade') {
+    return
+  }
+
+  const queue = []
+  for (const [name, versions] of registryVersions(tree)) {
+    const versionsToCheck = [...versions].filter(version =>
+      !isTrustPolicyExcluded(opts.trustPolicyExclude, name, version))
+    if (!versionsToCheck.length) {
+      continue
+    }
+
+    queue.push(async () => {
+      const packument = await pacote.packument(name, {
+        ...opts,
+        fullMetadata: true,
+      })
+      for (const version of versionsToCheck) {
+        checkTrustDowngrade(packument, version, {
+          exclude: opts.trustPolicyExclude,
+          ignoreAfter: opts.trustPolicyIgnoreAfter,
+        })
+      }
+    })
+  }
+  await promiseCallLimit(queue)
+}
+
+module.exports = {
+  registryVersions,
+  verifyTrustPolicy,
+}