FilesExpand file tree

main

/

generate-third-party-inventory.mjs

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

120 lines (117 loc) · 4.34 KB

main

/

generate-third-party-inventory.mjs

Copy path

Top

File metadata and controls

• Code
• Blame

120 lines (117 loc) · 4.34 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

import { createHash } from "node:crypto";

import { readFile } from "node:fs/promises";

import { dirname, join } from "node:path";

import { fileURLToPath } from "node:url";

import { ensureGeneratedFile } from "./lib/generated-file.mjs";

const arguments_ = new Set(process.argv.slice(2));

for (const argument of arguments_)

if (argument !== "--check")

throw new Error(`Unknown inventory option: ${argument}`);

const root = join(dirname(fileURLToPath(import.meta.url)), "..");

const lock = JSON.parse(

await readFile(join(root, "package-lock.json"), "utf8"),

);

const entries = Object.entries(lock.packages)

.filter(([path]) => path !== "")

.map(([path, record]) => ({

path,

name: record.name ?? path.slice(path.lastIndexOf("node_modules/") + 13),

version: record.version,

license: record.license ?? "UNDECLARED",

resolved: record.resolved,

integrity: record.integrity,

dev: record.dev === true,

optional: record.optional === true,

}))

.sort((left, right) =>

left.path < right.path ? -1 : left.path > right.path ? 1 : 0,

);

for (const entry of entries)

for (const field of ["name", "version", "resolved", "integrity"])

if (typeof entry[field] !== "string" || entry[field].length === 0)

throw new Error(`Missing locked ${field}: ${entry.path}`);

const runtime = entries.filter(({ dev }) => !dev);

const runtimeFingerprint = createHash("sha256")

.update(JSON.stringify(runtime))

.digest("hex");

const source = [

"REA npm dependency inventory",

"Prepared from the root package-lock.json; refresh this inventory when locked dependencies change.",

"License identifiers are upstream lockfile declarations, not a legal assessment.",

"Runtime includes transitive and optional platform packages; development includes build, test and website tooling.",

`Locked package entries: ${entries.length}; runtime: ${runtime.length}.`,

"Full runtime copyright/license/NOTICE texts: npm-runtime-notices.txt.",

"",

...entries.flatMap((entry) => [

`${entry.name}@${entry.version} | ${entry.dev ? "development" : "runtime"}${entry.optional ? ", optional" : ""} | ${entry.license}`,

` Lockfile path: ${entry.path}`,

` Package: https://www.npmjs.com/package/${entry.name}/v/${entry.version}`,

` Archive: ${entry.resolved}`,

` Integrity: ${entry.integrity}`,

]),

"",

].join("\n");

await ensureGeneratedFile({

path: join(root, "licenses/npm-dependencies.txt"),

source,

check: arguments_.has("--check"),

generateCommand: "npm run licenses:generate",

});

if (arguments_.has("--check")) {

const notices = await readFile(

join(root, "licenses/npm-runtime-notices.txt"),

"utf8",

);

const headings = [...notices.matchAll(/^===== (.+) =====$/gmu)];

const sections = new Map();

for (const [index, heading] of headings.entries()) {

if (sections.has(heading[1]))

throw new Error(`Duplicate runtime notice: ${heading[1]}`);

sections.set(

heading[1],

notices.slice(

heading.index + heading[0].length + 1,

headings[index + 1]?.index,

),

);

}

for (const entry of runtime) {

const identity = `${entry.name}@${entry.version}`;

const section = sections.get(identity);

if (section === undefined)

throw new Error(`Missing runtime notice: ${identity}`);

const metadata = [

`Declared license: ${entry.license}`,

`Archive: ${entry.resolved}`,

`Integrity: ${entry.integrity}`,

"",

].join("\n");

if (!section.startsWith(metadata))

throw new Error(`Runtime notice metadata differs for ${identity}`);

}

if (

!notices

.slice(0, headings[0]?.index)

.includes(

`Runtime dependency fingerprint (SHA-256): ${runtimeFingerprint}\n`,

)

)

throw new Error(

`Runtime notice fingerprint differs; refresh verified notices for ${runtimeFingerprint}`,

);

const references = JSON.parse(

await readFile(join(root, "licenses/upstream-sources.json"), "utf8"),

);

for (const reference of references) {

const bytes = await readFile(join(root, reference.file));

if (createHash("sha256").update(bytes).digest("hex") !== reference.sha256)

throw new Error(`Preserved notice digest differs: ${reference.file}`);

}

}

console.log(

JSON.stringify({

locked_packages: entries.length,

runtime_packages: runtime.length,

runtime_dependency_fingerprint: runtimeFingerprint,

}),

);