Restore openvibe-publishing v1.2.0 lock integrity and guard codeload…

OP OpenVibers committed 4 Oct 2026 · f7cb2646d5 · 2 files, +30 −0

Asked: Follow-up of https://github.com/OpenVibers/OpenVibe.Reviews/pull/7 (Render Reviews pages through openvibe-publishing/layout shell): its review asked for a change in OpenVibe.Deals that the PR cannot make from OpenVibe.Reviews. The review said: VERDICT: FIX
Harness job deals-follow-up-of-https-github-com-open-133926.

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex f84a639..85709a8 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1165,6 +1165,7 @@
      "node_modules/openvibe-publishing": {
        "version": "1.2.0",
        "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.2.0",
++      "integrity": "sha512-n/20yxXo5jRs0wi7KsR+R9jDkGsoBak3gqElHV6XyU+i1t3XCzaoz+sDb10G2cbc4uEaNB/F09VtQKrQzLp6YQ==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
ddiff --git a/test/lockfile.test.js b/test/lockfile.test.js
nnew file mode 100644
iindex 0000000..65711ad
---- /dev/null
++++ b/test/lockfile.test.js
@@@ -0,0 +1,29 @@
++'use strict';
++/**
++ * Every codeload GitHub tarball pin is installed as-is by `npm ci`, so its lock entry must keep an
++ * integrity and point at the same tag package.json pins. A hand-edited bump can drop the integrity
++ * (it happened to openvibe-publishing v1.2.0); without this the tarball is accepted unchecked.
++ */
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++const { check, done } = require('./helpers/boot');
++
++const ROOT = path.join(__dirname, '..');
++const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
++const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
++
++(async () => {
++    await check('every codeload GitHub tarball pin has a lock entry with sha512 integrity and the same resolved URL', async () => {
++        const pins = { ...pkg.dependencies, ...pkg.devDependencies };
++        const tarballs = Object.entries(pins).filter(([, spec]) => /^https:\/\/codeload\.github\.com\//.test(spec));
++        assert.ok(tarballs.length > 0, 'expected at least one codeload tarball pin');
++        for (const [name, spec] of tarballs) {
++            const entry = lock.packages[`node_modules/${name}`];
++            assert.ok(entry, `package-lock.json has no entry for ${name}`);
++            assert.strictEqual(entry.resolved, spec, `${name}: package.json and package-lock.json disagree on the tag`);
++            assert.match(entry.integrity || '', /^sha512-[A-Za-z0-9+/]+=*$/, `${name}: lock entry has no sha512 integrity`);
++        }
++    });
++    done();
++})();

diff --git a/package-lock.json b/package-lock.json

index f84a639..85709a8 100644

--- a/package-lock.json

+++ b/package-lock.json

@@ -1165,6 +1165,7 @@

"node_modules/openvibe-publishing": {

"version": "1.2.0",

"resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.2.0",

+ "integrity": "sha512-n/20yxXo5jRs0wi7KsR+R9jDkGsoBak3gqElHV6XyU+i1t3XCzaoz+sDb10G2cbc4uEaNB/F09VtQKrQzLp6YQ==",

"license": "MIT",

"engines": {

"node": ">=20"

diff --git a/test/lockfile.test.js b/test/lockfile.test.js

new file mode 100644

index 0000000..65711ad

--- /dev/null

+++ b/test/lockfile.test.js

@@ -0,0 +1,29 @@

+'use strict';

+/**

+ * Every codeload GitHub tarball pin is installed as-is by `npm ci`, so its lock entry must keep an

+ * integrity and point at the same tag package.json pins. A hand-edited bump can drop the integrity

+ * (it happened to openvibe-publishing v1.2.0); without this the tarball is accepted unchecked.

+ */

+const assert = require('assert');

+const fs = require('fs');

+const path = require('path');

+const { check, done } = require('./helpers/boot');

+const ROOT = path.join(__dirname, '..');

+const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));

+const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));

+(async () => {

+ await check('every codeload GitHub tarball pin has a lock entry with sha512 integrity and the same resolved URL', async () => {

+ const pins = { ...pkg.dependencies, ...pkg.devDependencies };

+ const tarballs = Object.entries(pins).filter(([, spec]) => /^https:\/\/codeload\.github\.com\//.test(spec));

+ assert.ok(tarballs.length > 0, 'expected at least one codeload tarball pin');

+ for (const [name, spec] of tarballs) {

+ const entry = lock.packages[`node_modules/${name}`];

+ assert.ok(entry, `package-lock.json has no entry for ${name}`);

+ assert.strictEqual(entry.resolved, spec, `${name}: package.json and package-lock.json disagree on the tag`);

+ assert.match(entry.integrity || '', /^sha512-[A-Za-z0-9+/]+=*$/, `${name}: lock entry has no sha512 integrity`);

+ }

+ });

+ done();

+})();