fix(release/10): fail by default when a tarball does not match the locked integrity#11985
Merged
Conversation
Backport of #11968 to release/10. Treats tarball-integrity mismatches against the lockfile as a hard failure by default; `--update-checksums` is the only opt-in. `--force` and `pnpm update` deliberately do not bypass the integrity check. 🤖 Written by an agent (Claude Code, claude-opus-4-7).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport of #11968 to
release/10.pnpm install(non-frozen) used to react toERR_PNPM_TARBALL_INTEGRITYby logging the error, silently re-resolving from the registry, and overwriting the locked integrity. The lockfile's integrity was effectively advisory by default — a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committedpnpm-lock.yaml.Integrity mismatches against the lockfile now fail by default.
The only opt-in is
pnpm install --update-checksums— a new flag, narrowly scoped to refreshing the locked integrity values. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the rewrite stays auditable.--forceandpnpm updatedeliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide.--frozen-lockfilebehavior is unchanged.--fix-lockfilekeeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.--update-checksumsalso bypasses the resolver's on-disk metadata cache fast path (pickPackage.ts). Without that, a stale on-disk packument that already contained the pinned version would short-circuit the registry entirely and the flag would silently no-op on dev machines.Differences from #11968
The path layout in
release/10predates theinstalling/refactor inmain, so this PR touches the v10 equivalents:mainrelease/10installing/commands/pkg-manager/plugin-commands-installation/installing/deps-installer/pkg-manager/core/installing/deps-resolver/pkg-manager/resolve-dependencies/store/controller-types/store/store-controller-types/Pacquet changes from #11968 are out of scope (not in v10).
One v10-specific extra change:
pkg-manager/package-requester/src/packageRequester.tsgained&& !options.updateChecksumson theskipResolutionguard. Inmain, the package-requester was refactored to always run resolution (so the cache-bypass in pickPackage always applies). Inrelease/10, theskipResolutionshort-circuit is still in place — without this extra check,--update-checksumswould silently no-op on retry because the resolver is never called. The brokenLockfileIntegrity tests caught this.Test plan
pnpm --filter @pnpm/core test test/brokenLockfileIntegrity.ts— passes (covers plain install fails,--update-checksumsrecovers,--forcestill fails)pnpm --filter @pnpm/core test test/install/fixLockfile.ts— passes (--fix-lockfilesemantics unchanged)pnpm --filter @pnpm/npm-resolver test— 132 passpnpm --filter @pnpm/tarball-fetcher test— 22 passpnpm --filter @pnpm/package-requester test— 21 passpnpm --filter @pnpm/plugin-commands-installation test test/install.ts— passesWritten by an agent (Claude Code, claude-opus-4-7).