Rebase to 16.16.0

Resolves: RHBZ#2106290
Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215

0001-fix-ci-lock-file-validation.patch

@@ -1,397 +0,0 @@
-From 730dd78c897a28c3df0468ed1fc42d5817badefe Mon Sep 17 00:00:00 2001
-From: Ruy Adorno <ruyadorno@hotmail.com>
-Date: Wed, 2 Feb 2022 22:10:22 -0500
-Subject: [PATCH] fix(ci): lock file validation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Make sure to validate any lock file (either package-lock.json or
-npm-shrinkwrap.json) against the current install. This will properly
-throw an error in case any of the dependencies being installed don't
-match the dependencies that are currently listed in the lock file.
-
-Fixes: https://github.com/npm/cli/issues/2701
-Fixes: https://github.com/npm/cli/issues/3947
-Signed-off-by: Jan Staněk <jstanek@redhat.com>
----
- deps/npm/lib/commands/ci.js                   | 23 ++++++
- deps/npm/lib/utils/validate-lockfile.js       | 29 +++++++
- .../smoke-tests/index.js.test.cjs             | 11 +++
- .../test/lib/commands/ci.js.test.cjs          | 13 +++
- .../lib/utils/validate-lockfile.js.test.cjs   | 35 ++++++++
- deps/npm/test/lib/commands/ci.js              | 82 +++++++++++++++++++
- deps/npm/test/lib/utils/validate-lockfile.js  | 82 +++++++++++++++++++
- 7 files changed, 275 insertions(+)
- create mode 100644 deps/npm/lib/utils/validate-lockfile.js
- create mode 100644 deps/npm/tap-snapshots/test/lib/commands/ci.js.test.cjs
- create mode 100644 deps/npm/tap-snapshots/test/lib/utils/validate-lockfile.js.test.cjs
- create mode 100644 deps/npm/test/lib/utils/validate-lockfile.js
-
-diff --git a/deps/npm/lib/commands/ci.js b/deps/npm/lib/commands/ci.js
-index 2c2f8da..376a85d 100644
---- a/deps/npm/lib/commands/ci.js
-+++ b/deps/npm/lib/commands/ci.js
-@@ -6,6 +6,7 @@ const runScript = require('@npmcli/run-script')
- const fs = require('fs')
- const readdir = util.promisify(fs.readdir)
- const log = require('../utils/log-shim.js')
-+const validateLockfile = require('../utils/validate-lockfile.js')
- 
- const removeNodeModules = async where => {
-   const rimrafOpts = { glob: false }
-@@ -55,6 +56,28 @@ class CI extends ArboristWorkspaceCmd {
-       }),
-       removeNodeModules(where),
-     ])
-+
-+    // retrieves inventory of packages from loaded virtual tree (lock file)
-+    const virtualInventory = new Map(arb.virtualTree.inventory)
-+
-+    // build ideal tree step needs to come right after retrieving the virtual
-+    // inventory since it's going to erase the previous ref to virtualTree
-+    await arb.buildIdealTree()
-+
-+    // verifies that the packages from the ideal tree will match
-+    // the same versions that are present in the virtual tree (lock file)
-+    // throws a validation error in case of mismatches
-+    const errors = validateLockfile(virtualInventory, arb.idealTree.inventory)
-+    if (errors.length) {
-+      throw new Error(
-+        '`npm ci` can only install packages when your package.json and ' +
-+        'package-lock.json or npm-shrinkwrap.json are in sync. Please ' +
-+        'update your lock file with `npm install` ' +
-+        'before continuing.\n\n' +
-+        errors.join('\n') + '\n'
-+      )
-+    }
-+
-     await arb.reify(opts)
- 
-     const ignoreScripts = this.npm.config.get('ignore-scripts')
-diff --git a/deps/npm/lib/utils/validate-lockfile.js b/deps/npm/lib/utils/validate-lockfile.js
-new file mode 100644
-index 0000000..29161ec
---- /dev/null
-+++ b/deps/npm/lib/utils/validate-lockfile.js
-@@ -0,0 +1,29 @@
-+// compares the inventory of package items in the tree
-+// that is about to be installed (idealTree) with the inventory
-+// of items stored in the package-lock file (virtualTree)
-+//
-+// Returns empty array if no errors found or an array populated
-+// with an entry for each validation error found.
-+function validateLockfile (virtualTree, idealTree) {
-+  const errors = []
-+
-+  // loops through the inventory of packages resulted by ideal tree,
-+  // for each package compares the versions with the version stored in the
-+  // package-lock and adds an error to the list in case of mismatches
-+  for (const [key, entry] of idealTree.entries()) {
-+    const lock = virtualTree.get(key)
-+
-+    if (!lock) {
-+      errors.push(`Missing: ${entry.name}@${entry.version} from lock file`)
-+      continue
-+    }
-+
-+    if (entry.version !== lock.version) {
-+      errors.push(`Invalid: lock file's ${lock.name}@${lock.version} does ` +
-+      `not satisfy ${entry.name}@${entry.version}`)
-+    }
-+  }
-+  return errors
-+}
-+
-+module.exports = validateLockfile
-diff --git a/deps/npm/tap-snapshots/smoke-tests/index.js.test.cjs b/deps/npm/tap-snapshots/smoke-tests/index.js.test.cjs
-index c1316e0..5fa3977 100644
---- a/deps/npm/tap-snapshots/smoke-tests/index.js.test.cjs
-+++ b/deps/npm/tap-snapshots/smoke-tests/index.js.test.cjs
-@@ -40,6 +40,17 @@ Configuration fields: npm help 7 config
- 
- npm {CWD}
- 
-+`
-+
-+exports[`smoke-tests/index.js TAP npm ci > should throw mismatch deps in lock file error 1`] = `
-+npm ERR! \`npm ci\` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with \`npm install\` before continuing.
-+npm ERR! 
-+npm ERR! Invalid: lock file's abbrev@1.0.4 does not satisfy abbrev@1.1.1
-+npm ERR! 
-+
-+npm ERR! A complete log of this run can be found in:
-+
-+
- `
- 
- exports[`smoke-tests/index.js TAP npm diff > should have expected diff output 1`] = `
-diff --git a/deps/npm/tap-snapshots/test/lib/commands/ci.js.test.cjs b/deps/npm/tap-snapshots/test/lib/commands/ci.js.test.cjs
-new file mode 100644
-index 0000000..d6a7471
---- /dev/null
-+++ b/deps/npm/tap-snapshots/test/lib/commands/ci.js.test.cjs
-@@ -0,0 +1,13 @@
-+/* IMPORTANT
-+ * This snapshot file is auto-generated, but designed for humans.
-+ * It should be checked into source control and tracked carefully.
-+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
-+ * Make sure to inspect the output below.  Do not ignore changes!
-+ */
-+'use strict'
-+exports[`test/lib/commands/ci.js TAP should throw error when ideal inventory mismatches virtual > must match snapshot 1`] = `
-+\`npm ci\` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with \`npm install\` before continuing.
-+
-+Invalid: lock file's foo@1.0.0 does not satisfy foo@2.0.0
-+
-+`
-diff --git a/deps/npm/tap-snapshots/test/lib/utils/validate-lockfile.js.test.cjs b/deps/npm/tap-snapshots/test/lib/utils/validate-lockfile.js.test.cjs
-new file mode 100644
-index 0000000..98a5126
---- /dev/null
-+++ b/deps/npm/tap-snapshots/test/lib/utils/validate-lockfile.js.test.cjs
-@@ -0,0 +1,35 @@
-+/* IMPORTANT
-+ * This snapshot file is auto-generated, but designed for humans.
-+ * It should be checked into source control and tracked carefully.
-+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
-+ * Make sure to inspect the output below.  Do not ignore changes!
-+ */
-+'use strict'
-+exports[`test/lib/utils/validate-lockfile.js TAP extra inventory items on idealTree > should have missing entries error 1`] = `
-+Array [
-+  "Missing: baz@3.0.0 from lock file",
-+]
-+`
-+
-+exports[`test/lib/utils/validate-lockfile.js TAP extra inventory items on virtualTree > should have no errors if finding virtualTree extra items 1`] = `
-+Array []
-+`
-+
-+exports[`test/lib/utils/validate-lockfile.js TAP identical inventory for both idealTree and virtualTree > should have no errors on identical inventories 1`] = `
-+Array []
-+`
-+
-+exports[`test/lib/utils/validate-lockfile.js TAP mismatching versions on inventory > should have errors for each mismatching version 1`] = `
-+Array [
-+  "Invalid: lock file's foo@1.0.0 does not satisfy foo@2.0.0",
-+  "Invalid: lock file's bar@2.0.0 does not satisfy bar@3.0.0",
-+]
-+`
-+
-+exports[`test/lib/utils/validate-lockfile.js TAP missing virtualTree inventory > should have errors for each mismatching version 1`] = `
-+Array [
-+  "Missing: foo@1.0.0 from lock file",
-+  "Missing: bar@2.0.0 from lock file",
-+  "Missing: baz@3.0.0 from lock file",
-+]
-+`
-diff --git a/deps/npm/test/lib/commands/ci.js b/deps/npm/test/lib/commands/ci.js
-index 537d078..e077c99 100644
---- a/deps/npm/test/lib/commands/ci.js
-+++ b/deps/npm/test/lib/commands/ci.js
-@@ -19,6 +19,17 @@ t.test('should ignore scripts with --ignore-scripts', async t => {
-       this.reify = () => {
-         REIFY_CALLED = true
-       }
-+      this.buildIdealTree = () => {}
-+      this.virtualTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-+      this.idealTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-     },
-   })
- 
-@@ -99,6 +110,17 @@ t.test('should use Arborist and run-script', async t => {
-       this.reify = () => {
-         t.ok(true, 'reify is called')
-       }
-+      this.buildIdealTree = () => {}
-+      this.virtualTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-+      this.idealTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-     },
-     rimraf: (path, ...args) => {
-       actualRimrafs++
-@@ -138,6 +160,17 @@ t.test('should pass flatOptions to Arborist.reify', async t => {
-       this.reify = async (options) => {
-         t.equal(options.production, true, 'should pass flatOptions to Arborist.reify')
-       }
-+      this.buildIdealTree = () => {}
-+      this.virtualTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-+      this.idealTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-     },
-   })
-   const npm = mockNpm({
-@@ -218,6 +251,17 @@ t.test('should remove existing node_modules before installing', async t => {
-         const nodeModules = contents.filter((path) => path.startsWith('node_modules'))
-         t.same(nodeModules, ['node_modules'], 'should only have the node_modules directory')
-       }
-+      this.buildIdealTree = () => {}
-+      this.virtualTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-+      this.idealTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-     },
-   })
- 
-@@ -231,3 +275,41 @@ t.test('should remove existing node_modules before installing', async t => {
- 
-   await ci.exec(null)
- })
-+
-+t.test('should throw error when ideal inventory mismatches virtual', async t => {
-+  const CI = t.mock('../../../lib/commands/ci.js', {
-+    '../../../lib/utils/reify-finish.js': async () => {},
-+    '@npmcli/run-script': ({ event }) => {},
-+    '@npmcli/arborist': function () {
-+      this.loadVirtual = async () => {}
-+      this.reify = () => {}
-+      this.buildIdealTree = () => {}
-+      this.virtualTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '1.0.0' }],
-+        ]),
-+      }
-+      this.idealTree = {
-+        inventory: new Map([
-+          ['foo', { name: 'foo', version: '2.0.0' }],
-+        ]),
-+      }
-+    },
-+  })
-+
-+  const npm = mockNpm({
-+    globalDir: 'path/to/node_modules/',
-+    prefix: 'foo',
-+    config: {
-+      global: false,
-+      'ignore-scripts': true,
-+    },
-+  })
-+  const ci = new CI(npm)
-+
-+  try {
-+    await ci.exec([])
-+  } catch (err) {
-+    t.matchSnapshot(err.message)
-+  }
-+})
-diff --git a/deps/npm/test/lib/utils/validate-lockfile.js b/deps/npm/test/lib/utils/validate-lockfile.js
-new file mode 100644
-index 0000000..25939c5
---- /dev/null
-+++ b/deps/npm/test/lib/utils/validate-lockfile.js
-@@ -0,0 +1,82 @@
-+const t = require('tap')
-+const validateLockfile = require('../../../lib/utils/validate-lockfile.js')
-+
-+t.test('identical inventory for both idealTree and virtualTree', async t => {
-+  t.matchSnapshot(
-+    validateLockfile(
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+      ]),
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+      ])
-+    ),
-+    'should have no errors on identical inventories'
-+  )
-+})
-+
-+t.test('extra inventory items on idealTree', async t => {
-+  t.matchSnapshot(
-+    validateLockfile(
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+      ]),
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+        ['baz', { name: 'baz', version: '3.0.0' }],
-+      ])
-+    ),
-+    'should have missing entries error'
-+  )
-+})
-+
-+t.test('extra inventory items on virtualTree', async t => {
-+  t.matchSnapshot(
-+    validateLockfile(
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+        ['baz', { name: 'baz', version: '3.0.0' }],
-+      ]),
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+      ])
-+    ),
-+    'should have no errors if finding virtualTree extra items'
-+  )
-+})
-+
-+t.test('mismatching versions on inventory', async t => {
-+  t.matchSnapshot(
-+    validateLockfile(
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+      ]),
-+      new Map([
-+        ['foo', { name: 'foo', version: '2.0.0' }],
-+        ['bar', { name: 'bar', version: '3.0.0' }],
-+      ])
-+    ),
-+    'should have errors for each mismatching version'
-+  )
-+})
-+
-+t.test('missing virtualTree inventory', async t => {
-+  t.matchSnapshot(
-+    validateLockfile(
-+      new Map([]),
-+      new Map([
-+        ['foo', { name: 'foo', version: '1.0.0' }],
-+        ['bar', { name: 'bar', version: '2.0.0' }],
-+        ['baz', { name: 'baz', version: '3.0.0' }],
-+      ])
-+    ),
-+    'should have errors for each mismatching version'
-+  )
-+})
--- 
-2.35.1
-

nodejs.spec

@@ -30,7 +30,7 @@
 # This is used by both the nodejs package and the npm subpackage that
 # has a separate version - the name is special so that rpmdev-bumpspec
 # will bump this rather than adding .1 to the end.
-%global baserelease 5
+%global baserelease 1
 
 %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
@@ -41,7 +41,7 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 16
-%global nodejs_minor 14
+%global nodejs_minor 16
 %global nodejs_patch 0
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
@@ -69,13 +69,13 @@
 %global c_ares_version 1.18.1
 
 # llhttp - from deps/llhttp/include/llhttp.h
-%global llhttp_version 6.0.4
+%global llhttp_version 6.0.7
 
 # libuv - from deps/uv/include/uv/version.h
 %global libuv_version 1.43.0
 
 # nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
-%global nghttp2_version 1.45.1
+%global nghttp2_version 1.47.0
 
 # nghttp3 - from deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
 %global nghttp3_major 0
@@ -118,7 +118,7 @@
 
 # npm - from deps/npm/package.json
 %global npm_epoch 1
-%global npm_version 8.3.1
+%global npm_version 8.11.0
 
 # In order to avoid needing to keep incrementing the release version for the
 # main package forever, we will just construct one for npm that is guaranteed
@@ -132,9 +132,6 @@
 # histogram_c - assumed from timestamps
 %global histogram_version 0.9.7
 
-# Node.js 16.9.1 and later comes with an experimental package management tool
-%global corepack_version 0.10.0
-
 Name: nodejs
 Epoch: %{nodejs_epoch}
 Version: %{nodejs_version}
@@ -166,9 +163,6 @@ Patch1: 0001-Disable-running-gyp-on-shared-deps.patch
 # Patch to install both node and libnode.so, using the correct libdir
 Patch2: 0002-Install-both-binaries-and-use-libdir.patch
 
-# CVE-2021-43616
-Patch3: 0001-fix-ci-lock-file-validation.patch
-
 BuildRequires: make
 BuildRequires: python3-devel
 BuildRequires: python3-setuptools
@@ -268,7 +262,6 @@ Provides: bundled(icu) = %{icu_version}
 # or there's no option to built it as a shared dependency, so we bundle them
 Provides: bundled(uvwasi) = %{uvwasi_version}
 Provides: bundled(histogram) = %{histogram_version}
-Provides: bundled(corepack) = %{corepack_version}
 
 %if 0%{?fedora}
 # Make sure to pull in the appropriate packaging macros when building RPMs
@@ -443,6 +436,7 @@ export LDFLAGS="%{build_ldflags}"
            --with-dtrace \
            --with-intl=small-icu \
            --with-icu-default-data-dir=%{icudatadir} \
+           --without-corepack \
            --openssl-use-def-ca-store \
            --openssl-default-cipher-list=PROFILE=SYSTEM
 
@@ -558,11 +552,6 @@ find %{buildroot}%{_prefix}/lib/node_modules/npm \
 chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp
 chmod 0755 %{buildroot}%{_prefix}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js
 
-# Corepack contains a number of executable"shims", including some for Windows
-# PowerShell. Drop the executable bit for those so we don't pick up an
-# automatic dependency on /usr/bin/pwsh that we cannot satisfy.
-chmod -x %{buildroot}%{_prefix}/lib/node_modules/corepack/shims/*.ps1
-
 # Drop the NPM default configuration in place
 mkdir -p %{buildroot}%{_sysconfdir}
 cp %{SOURCE1} %{buildroot}%{_sysconfdir}/npmrc
@@ -618,10 +607,6 @@ end
 %dir %{_datadir}/systemtap/tapset
 %{_datadir}/systemtap/tapset/node.stp
 
-# corepack
-%{_bindir}/corepack
-%{_prefix}/lib/node_modules/corepack
-
 %dir %{_usr}/lib/dtrace
 %{_usr}/lib/dtrace/node.d
 
@@ -695,6 +680,11 @@ end
 
 
 %changelog
+* Tue Aug 23 2022 Jan Staněk <jstanek@redhat.com> - 16.16.0-1
+- Rebase to version 16.16.0
+  Resolves: RHBZ#2106290
+  Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215
+
 * Thu Apr 21 2022 Jan Staněk <jstanek@redhat.com> - 16.14.0-5
 - Decouple dependency bundling from bootstrapping
 

sources

@@ -1,2 +1,2 @@
+SHA512 (node-v16.16.0-stripped.tar.gz) = 260e3192dfbc5cebc6a0caceef9d29d57f219302c7ac0fae5ecb7b090d8d8f25eb8470ff77a3c8aa0ca41e90a08655fd5b4626c1b9dfbfad8519092590dec852
 SHA512 (icu4c-70_1-src.tgz) = 0b26ae7207155cb65a8fdb25f7b2fa4431e74b12bccbed0884a17feaae3c96833d12451064dd152197fd6ea5fd3adfd95594284a463e66c82e0d860f645880c9
-SHA512 (node-v16.14.0-stripped.tar.gz) = 14f146a04e7ce8dded189b52053d71f927c154498d9b2f4b1f4f61547effcebc33e81f99a0a92c08347dc6179f42b98e3cd0f5b6e5160b01a7dfc3721c875642