1/* IMPORTANT 2 * This snapshot file is auto-generated, but designed for humans. 3 * It should be checked into source control and tracked carefully. 4 * Re-generate by setting TAP_SNAPSHOT=1 and running tests. 5 * Make sure to inspect the output below. Do not ignore changes! 6 */ 7'use strict' 8exports[`test/lib/commands/audit.js TAP audit fix - bulk endpoint > lockfile has test-dep-a@1.0.1 1`] = ` 9{ 10 "name": "test-dep", 11 "version": "1.0.0", 12 "lockfileVersion": 2, 13 "requires": true, 14 "packages": { 15 "": { 16 "name": "test-dep", 17 "version": "1.0.0", 18 "dependencies": { 19 "test-dep-a": "*" 20 } 21 }, 22 "node_modules/test-dep-a": { 23 "version": "1.0.1", 24 "resolved": "https://registry.npmjs.org/test-dep-a/-/test-dep-a-1.0.1.tgz" 25 } 26 }, 27 "dependencies": { 28 "test-dep-a": { 29 "version": "1.0.1", 30 "resolved": "https://registry.npmjs.org/test-dep-a/-/test-dep-a-1.0.1.tgz" 31 } 32 } 33} 34 35` 36 37exports[`test/lib/commands/audit.js TAP audit fix - bulk endpoint > must match snapshot 1`] = ` 38 39added 1 package, and audited 2 packages in xxx 40 41found 0 vulnerabilities 42` 43 44exports[`test/lib/commands/audit.js TAP audit signatures ignores optional dependencies > must match snapshot 1`] = ` 45audited 1 package in xxx 46 471 package has a verified registry signature 48 49` 50 51exports[`test/lib/commands/audit.js TAP audit signatures json output with invalid and missing signatures > must match snapshot 1`] = ` 52{ 53 "invalid": [ 54 { 55 "code": "EINTEGRITYSIGNATURE", 56 "message": "kms-demo@1.0.0 has an invalid registry signature with keyid: SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA and signature: bogus", 57 "integrity": "sha512-QqZ7VJ/8xPkS9s2IWB7Shj3qTJdcRyeXKbPQnsZjsPEwvutGv0EGeVchPcauoiDFJlGbZMFq5GDCurAGNSghJQ==", 58 "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA", 59 "location": "node_modules/kms-demo", 60 "name": "kms-demo", 61 "registry": "https://registry.npmjs.org/", 62 "resolved": "https://registry.npmjs.org/kms-demo/-/kms-demo-1.0.0.tgz", 63 "signature": "bogus", 64 "type": "dependencies", 65 "version": "1.0.0" 66 } 67 ], 68 "missing": [ 69 { 70 "location": "node_modules/async", 71 "name": "async", 72 "registry": "https://registry.npmjs.org/", 73 "resolved": "https://registry.npmjs.org/async/-/async-1.1.1.tgz", 74 "version": "1.1.1" 75 } 76 ] 77} 78` 79 80exports[`test/lib/commands/audit.js TAP audit signatures json output with invalid attestations > must match snapshot 1`] = ` 81{ 82 "invalid": [ 83 { 84 "code": "EATTESTATIONVERIFY", 85 "message": "sigstore@1.0.0 failed to verify attestation: artifact signature verification failed", 86 "integrity": "sha512-e+qfbn/zf1+rCza/BhIA//Awmf0v1pa5HQS8Xk8iXrn9bgytytVLqYD0P7NSqZ6IELTgq+tcDvLPkQjNHyWLNg==", 87 "keyid": "", 88 "location": "node_modules/sigstore", 89 "name": "sigstore", 90 "registry": "https://registry.npmjs.org/", 91 "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-1.0.0.tgz", 92 "signature": "MEYCIQD10kAn3lC/1rJvXBtSDckbqkKEmz369gPDKb4lG4zMKQIhAP1+RhbMcASsfXhxpXKNCAjJb+3Av3Br95eKD7VL/BEB", 93 "predicateType": "https://slsa.dev/provenance/v0.2", 94 "type": "dependencies", 95 "version": "1.0.0" 96 } 97 ], 98 "missing": [] 99} 100` 101 102exports[`test/lib/commands/audit.js TAP audit signatures json output with invalid signatures > must match snapshot 1`] = ` 103{ 104 "invalid": [ 105 { 106 "code": "EINTEGRITYSIGNATURE", 107 "message": "kms-demo@1.0.0 has an invalid registry signature with keyid: SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA and signature: bogus", 108 "integrity": "sha512-QqZ7VJ/8xPkS9s2IWB7Shj3qTJdcRyeXKbPQnsZjsPEwvutGv0EGeVchPcauoiDFJlGbZMFq5GDCurAGNSghJQ==", 109 "keyid": "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA", 110 "location": "node_modules/kms-demo", 111 "name": "kms-demo", 112 "registry": "https://registry.npmjs.org/", 113 "resolved": "https://registry.npmjs.org/kms-demo/-/kms-demo-1.0.0.tgz", 114 "signature": "bogus", 115 "type": "dependencies", 116 "version": "1.0.0" 117 } 118 ], 119 "missing": [] 120} 121` 122 123exports[`test/lib/commands/audit.js TAP audit signatures json output with valid signatures > must match snapshot 1`] = ` 124{ 125 "invalid": [], 126 "missing": [] 127} 128` 129 130exports[`test/lib/commands/audit.js TAP audit signatures multiple registries with keys and signatures > must match snapshot 1`] = ` 131audited 2 packages in xxx 132 1332 packages have verified registry signatures 134 135` 136 137exports[`test/lib/commands/audit.js TAP audit signatures omit dev dependencies with missing signature > must match snapshot 1`] = ` 138audited 1 package in xxx 139 1401 package has a verified registry signature 141 142` 143 144exports[`test/lib/commands/audit.js TAP audit signatures output details about missing signatures > must match snapshot 1`] = ` 145audited 1 package in xxx 146 1471 package has a missing registry signature but the registry is providing signing keys: 148 149kms-demo@1.0.0 (https://registry.npmjs.org/) 150` 151 152exports[`test/lib/commands/audit.js TAP audit signatures third-party registry with invalid signatures errors > must match snapshot 1`] = ` 153audited 1 package in xxx 154 1551 package has an invalid registry signature: 156 157@npmcli/arborist@1.0.14 (https://verdaccio-clone.org/) 158 159Someone might have tampered with this package since it was published on the registry! 160 161` 162 163exports[`test/lib/commands/audit.js TAP audit signatures third-party registry with keys and missing signatures errors > must match snapshot 1`] = ` 164audited 1 package in xxx 165 1661 package has a missing registry signature but the registry is providing signing keys: 167 168@npmcli/arborist@1.0.14 (https://verdaccio-clone.org/) 169` 170 171exports[`test/lib/commands/audit.js TAP audit signatures third-party registry with keys and signatures > must match snapshot 1`] = ` 172audited 1 package in xxx 173 1741 package has a verified registry signature 175 176` 177 178exports[`test/lib/commands/audit.js TAP audit signatures third-party registry with sub-path (trailing slash) > must match snapshot 1`] = ` 179audited 1 package in xxx 180 1811 package has a verified registry signature 182 183` 184 185exports[`test/lib/commands/audit.js TAP audit signatures third-party registry with sub-path > must match snapshot 1`] = ` 186audited 1 package in xxx 187 1881 package has a verified registry signature 189 190` 191 192exports[`test/lib/commands/audit.js TAP audit signatures with both invalid and missing signatures > must match snapshot 1`] = ` 193audited 2 packages in xxx 194 1951 package has a missing registry signature but the registry is providing signing keys: 196 197async@1.1.1 (https://registry.npmjs.org/) 198 1991 package has an invalid registry signature: 200 201kms-demo@1.0.0 (https://registry.npmjs.org/) 202 203Someone might have tampered with this package since it was published on the registry! 204 205` 206 207exports[`test/lib/commands/audit.js TAP audit signatures with bundled and peer deps and no signatures > must match snapshot 1`] = ` 208audited 1 package in xxx 209 2101 package has a verified registry signature 211 212` 213 214exports[`test/lib/commands/audit.js TAP audit signatures with invalid attestations > must match snapshot 1`] = ` 215audited 1 package in xxx 216 2171 package has an invalid attestation: 218 219sigstore@1.0.0 (https://registry.npmjs.org/) 220 221Someone might have tampered with this package since it was published on the registry! 222 223` 224 225exports[`test/lib/commands/audit.js TAP audit signatures with invalid signatures > must match snapshot 1`] = ` 226audited 1 package in xxx 227 2281 package has an invalid registry signature: 229 230kms-demo@1.0.0 (https://registry.npmjs.org/) 231 232Someone might have tampered with this package since it was published on the registry! 233 234` 235 236exports[`test/lib/commands/audit.js TAP audit signatures with invalid signtaures and color output enabled > must match snapshot 1`] = ` 237audited 1 package in xxx 238 2391 package has an [1m[31minvalid[39m[22m registry signature: 240 241[31mkms-demo@1.0.0[39m (https://registry.npmjs.org/) 242 243Someone might have tampered with this package since it was published on the registry! 244 245` 246 247exports[`test/lib/commands/audit.js TAP audit signatures with key fallback to legacy API > must match snapshot 1`] = ` 248audited 1 package in xxx 249 2501 package has a verified registry signature 251 252` 253 254exports[`test/lib/commands/audit.js TAP audit signatures with keys but missing signature > must match snapshot 1`] = ` 255audited 1 package in xxx 256 2571 package has a missing registry signature but the registry is providing signing keys: 258 259kms-demo@1.0.0 (https://registry.npmjs.org/) 260` 261 262exports[`test/lib/commands/audit.js TAP audit signatures with multiple invalid attestations > must match snapshot 1`] = ` 263audited 2 packages in xxx 264 2652 packages have invalid attestations: 266 267sigstore@1.0.0 (https://registry.npmjs.org/) 268tuf-js@1.0.0 (https://registry.npmjs.org/) 269 270Someone might have tampered with these packages since they were published on the registry! 271 272` 273 274exports[`test/lib/commands/audit.js TAP audit signatures with multiple invalid signatures > must match snapshot 1`] = ` 275audited 2 packages in xxx 276 2772 packages have invalid registry signatures: 278 279async@1.1.1 (https://registry.npmjs.org/) 280kms-demo@1.0.0 (https://registry.npmjs.org/) 281 282Someone might have tampered with these packages since they were published on the registry! 283 284` 285 286exports[`test/lib/commands/audit.js TAP audit signatures with multiple missing signatures > must match snapshot 1`] = ` 287audited 2 packages in xxx 288 2892 packages have missing registry signatures but the registry is providing signing keys: 290 291async@1.1.1 (https://registry.npmjs.org/) 292kms-demo@1.0.0 (https://registry.npmjs.org/) 293` 294 295exports[`test/lib/commands/audit.js TAP audit signatures with multiple valid signatures and one invalid > must match snapshot 1`] = ` 296audited 3 packages in xxx 297 2982 packages have verified registry signatures 299 3001 package has an invalid registry signature: 301 302node-fetch@1.6.0 (https://registry.npmjs.org/) 303 304Someone might have tampered with this package since it was published on the registry! 305 306` 307 308exports[`test/lib/commands/audit.js TAP audit signatures with valid and missing signatures > must match snapshot 1`] = ` 309audited 2 packages in xxx 310 3111 package has a verified registry signature 312 3131 package has a missing registry signature but the registry is providing signing keys: 314 315async@1.1.1 (https://registry.npmjs.org/) 316` 317 318exports[`test/lib/commands/audit.js TAP audit signatures with valid attestations > must match snapshot 1`] = ` 319audited 1 package in xxx 320 3211 package has a verified registry signature 322 3231 package has a verified attestation 324 325` 326 327exports[`test/lib/commands/audit.js TAP audit signatures with valid signatures > must match snapshot 1`] = ` 328audited 1 package in xxx 329 3301 package has a verified registry signature 331 332` 333 334exports[`test/lib/commands/audit.js TAP audit signatures with valid signatures using alias > must match snapshot 1`] = ` 335audited 1 package in xxx 336 3371 package has a verified registry signature 338 339` 340 341exports[`test/lib/commands/audit.js TAP audit signatures workspaces verifies registry deps and ignores local workspace deps > must match snapshot 1`] = ` 342audited 3 packages in xxx 343 3443 packages have verified registry signatures 345 346` 347 348exports[`test/lib/commands/audit.js TAP audit signatures workspaces verifies registry deps when filtering by workspace name > must match snapshot 1`] = ` 349audited 2 packages in xxx 350 3512 packages have verified registry signatures 352 353` 354 355exports[`test/lib/commands/audit.js TAP fallback audit > must match snapshot 1`] = ` 356# npm audit report 357 358test-dep-a 1.0.0 359Severity: high 360Test advisory 100 - https://github.com/advisories/GHSA-100 361fix available via \`npm audit fix\` 362node_modules/test-dep-a 363 3641 high severity vulnerability 365 366To address all issues, run: 367 npm audit fix 368` 369 370exports[`test/lib/commands/audit.js TAP json audit > must match snapshot 1`] = ` 371{ 372 "auditReportVersion": 2, 373 "vulnerabilities": { 374 "test-dep-a": { 375 "name": "test-dep-a", 376 "severity": "high", 377 "isDirect": true, 378 "via": [ 379 { 380 "source": 100, 381 "name": "test-dep-a", 382 "dependency": "test-dep-a", 383 "title": "Test advisory 100", 384 "url": "https://github.com/advisories/GHSA-100", 385 "severity": "high", 386 "cwe": [ 387 "cwe-0" 388 ], 389 "cvss": { 390 "score": 0 391 }, 392 "range": "*" 393 } 394 ], 395 "effects": [], 396 "range": "*", 397 "nodes": [ 398 "node_modules/test-dep-a" 399 ], 400 "fixAvailable": false 401 } 402 }, 403 "metadata": { 404 "vulnerabilities": { 405 "info": 0, 406 "low": 0, 407 "moderate": 0, 408 "high": 1, 409 "critical": 0, 410 "total": 1 411 }, 412 "dependencies": { 413 "prod": 2, 414 "dev": 0, 415 "optional": 0, 416 "peer": 0, 417 "peerOptional": 0, 418 "total": 1 419 } 420 } 421} 422` 423 424exports[`test/lib/commands/audit.js TAP normal audit > must match snapshot 1`] = ` 425# npm audit report 426 427test-dep-a 1.0.0 428Severity: high 429Test advisory 100 - https://github.com/advisories/GHSA-100 430fix available via \`npm audit fix\` 431node_modules/test-dep-a 432 4331 high severity vulnerability 434 435To address all issues, run: 436 npm audit fix 437` 438