+33
-7
lines changedFilter options
+33
-7
lines changed Original file line number Diff line number Diff line change
@@ -111,11 +111,11 @@ async function oidc ({ packageName, registry, opts, config }) {
111 111
// this checks if the user configured provenance or it's the default unset value
112 112
const isDefaultProvenance = config.isDefault('provenance')
113 113
const provenanceIntent = config.get('provenance')
114 +
let enableProvenance = false
114 115 115 116
// if provenance is the default value or the user explicitly set it
116 117
if (isDefaultProvenance || provenanceIntent) {
117 118
const [headerB64, payloadB64] = idToken.split('.')
118 -
let enableProvenance = false
119 119
if (headerB64 && payloadB64) {
120 120
const payloadJson = Buffer.from(payloadB64, 'base64').toString('utf8')
121 121
try {
@@ -131,12 +131,6 @@ async function oidc ({ packageName, registry, opts, config }) {
131 131
// Failed to parse idToken payload as JSON
132 132
}
133 133
}
134 - 135 -
if (enableProvenance) {
136 -
// Repository is public, setting provenance
137 -
opts.provenance = true
138 -
config.set('provenance', true, 'user')
139 -
}
140 134
}
141 135 142 136
const parsedRegistry = new URL(registry)
@@ -160,6 +154,13 @@ async function oidc ({ packageName, registry, opts, config }) {
160 154
log.verbose('oidc', 'Failed because token exchange was missing the token in the response body')
161 155
return undefined
162 156
}
157 + 158 +
if (enableProvenance) {
159 +
// Repository is public, setting provenance
160 +
opts.provenance = true
161 +
config.set('provenance', true, 'user')
162 +
}
163 + 163 164
/*
164 165
* The "opts" object is a clone of npm.flatOptions and is passed through the `publish` command,
165 166
* eventually reaching `otplease`. To ensure the token is accessible during the publishing process,
@@ -1450,5 +1450,30 @@ t.test('oidc token exchange - provenance', (t) => {
1450 1450
}))
1451 1451
})
1452 1452 1453 +
t.test('token exchange 500 with fallback should not have provenance by default', oidcPublishTest({
1454 +
oidcOptions: { github: true },
1455 +
config: {
1456 +
'//registry.npmjs.org/:_authToken': 'existing-fallback-token',
1457 +
},
1458 +
mockGithubOidcOptions: {
1459 +
audience: 'npm:registry.npmjs.org',
1460 +
idToken: githubPublicIdToken,
1461 +
},
1462 +
mockOidcTokenExchangeOptions: {
1463 +
statusCode: 500,
1464 +
idToken: githubPublicIdToken,
1465 +
body: {
1466 +
message: 'oidc token exchange failed',
1467 +
},
1468 +
},
1469 +
publishOptions: {
1470 +
token: 'existing-fallback-token',
1471 +
},
1472 +
logsContain: [
1473 +
'verbose oidc Failed token exchange request with body message: oidc token exchange failed',
1474 +
],
1475 +
provenance: false,
1476 +
}))
1477 + 1453 1478
t.end()
1454 1479
})
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4