lockfile-lint-api

npmpackage.info

Gathering detailed insights and metrics for lockfile-lint-api

Other packages similar to lockfile-lint-api

@types/lockfile-lint-api

5.1.5

TypeScript definitions for lockfile-lint-api

@ellentorg/nostrum-exercitationem-facilis

6.16.146

A _very_ minimal implementation of a [PassThrough stream](https://nodejs.org/api/stream.html#stream_class_stream_passthrough)

@crabas0npm2/ex-ipsum-excepturi

0.0.1-security

security holding package

@taktikorg/unde-animi-omnis

5.8.117

<p align="center"> <a href="https://www.npmjs.com/package/@taktikorg/unde-animi-omnis"><img src="https://img.shields.io/npm/v/@taktikorg/unde-animi-omnis"></a> <a href=""><img src="https://img.shields.io/github/actions/workflow/status/RemiMyrset/@taktikor

Gathering detailed insights and metrics for lockfile-lint-api

Validators

The following lockfile validators are supported

Validator API	description	implemented
ValidateHttps	validates the use of HTTPS as protocol schema for all resources	✅
ValidateHost	validates a whitelist of allowed hosts to be used for resources in the lockfile	✅
ValidatePackageNames	validates that the resolved URL matches the package name	✅
ValidateScheme	validates a whitelist of allowed URI schemes to be used for hosts	✅
ValidateIntegrity	validates that the integrity hash type is sha512	✅

Validator API

description

implemented

ValidateHttps

validates the use of HTTPS as protocol schema for all resources

✅

ValidateHost

validates a whitelist of allowed hosts to be used for resources in the lockfile

✅

ValidatePackageNames

validates that the resolved URL matches the package name

✅

ValidateScheme

validates a whitelist of allowed URI schemes to be used for hosts

✅

ValidateIntegrity

validates that the integrity hash type is sha512

✅

NOTE: package entries without a resolved field (for example, those installed from the local filesystem) will automatically pass all url-based validators.

Success and failures

When validators encounter errors they will throw an exception, and on either success or failure in validating data they will always return a descriptive object for the validation task.

Successful validation

When validation is successful the following object will be returned from the validating function:

1{ 2 "type": "success", 3 "errors": [] 4}

Failed validation

When validation has failed the following object will be returned from the validating function:

1{ 2 "type": "error", 3 "errors": [ 4 { 5 "package": "@babel/cli", 6 "message": "detected invalid origin for package: @babel/cli" 7 } 8 ] 9}

Notes about the returned object:

An errors object will always return an array of errors metadata, even if there's only one error associated with the validation being performed

All errors should always have a message

The availability of the package property and other metadata depends on the specific validators being used

Example

1const validator = new ValidateHost({packages: lockfile.object}) 2let result 3try { 4 result = validator.validate(['npm']) 5} catch (error) { 6 // something bad happened during validation and the validation 7 // process couldn't take place 8} 9 10console.log(result) 11/* prints 12{ 13 "type": "error", 14 "errors": [ 15 { 16 "message": "detected invalid origin for package: meow", 17 "package": "meow" 18 } 19 ] 20} 21*/

Example

1const {ValidateHost, ParseLockfile} = require('lockfile-lint-api') 2 3// path to the lockfile 4const yarnLockfilePath = '/path/to/my/yarn.lock' 5const options = { 6 lockfilePath: yarnLockfilePath 7} 8 9// instantiate a new parser with options object 10const parser = new ParseLockfile(options) 11 12// read the file synchronously and parses it 13// providing back an object that is compatible 14// with the @yarn/lockfile library which has 15// all the packages listed in `lockfile.object` 16const lockfile = parser.parseSync() 17 18// now instantiate a validator object with those 19// list of packages 20const validator = new ValidateHost({packages: lockfile.object}) 21let result 22try { 23 // validation is synchronous and is being called 24 // with 'npm' as a shortcut for the npm registry 25 // host to validate all lockfile resources are 26 // whitelisted to the npm host 27 result = validator.validate(['npm']) 28} catch (error) { 29 // couldn't process the validation 30} 31 32if (result.type === 'success') { 33 // validation succeeded 34}

Other packages similar to lockfile-lint-api

Other packages similar to lockfile-lint-api

Installations

Developer Guide

No

CommonJS

>=16.0.0

18.20.8

10.8.2

Pull Requests

0

127

14

113

Issues

3

79

76

Releases

Languages

Developer

lirantal

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

lockfile-lint-api

About

Install

Usage

Validators

Success and failures

Successful validation

Failed validation

Example

Example

Contributing

Author

10

10

10

10

5

3

2

0

0

0

0

0

4.4

/10