Return the cached codeload extract for (url, commit) without
touching the network. Callers should consult this before
downloading a codeload tarball — once the resolver has populated
the cache during BFS, the install-time materialization should
reuse it instead of paying a second HTTPS round-trip only to have
extract_codeload_tarball short-circuit and discard the bytes.
Mirrors git_shallow_clone’s top-of-function fast path.
Metadata-only fingerprint for the same tree as
directory_content_fingerprint. This stats every included file but does
not read its contents, letting warm install checks avoid unbounded file I/O
when the source tree is unchanged.
Extract a codeload-style HTTPS tarball (e.g. the bytes of a GET to
https://codeload.github.com/<owner>/<repo>/tar.gz/<sha>) into a
deterministic per-(url, commit) cache directory and return a path
shaped like git_shallow_clone’s output: the extracted tree at
the top level, with the <owner>-<repo>-<sha>/ wrapper component
codeload adds stripped off so callers can join subpath and read
package.json exactly the same way they do for a clone.
Shallow-clone url at commit into a fresh temp directory and
return the temp path. The caller is responsible for removing the
returned directory once it’s imported into the store.
Resolve a git ref (branch name, tag, or partial commit) to a full
40-char commit SHA by shelling out to git ls-remote. committish
of None means resolve HEAD. An input that already looks like a
full 40-char hex SHA is returned as-is without touching the network.
Clone a git repo into a deterministic per-(url, commit) cache dir
and check out commit. When shallow is true, aube uses
fetch --depth 1 origin <sha> and falls back to a full fetch if
the server rejects by-SHA shallow fetches; when false, aube skips
straight to the full-fetch path. Callers decide shallow vs. full
by consulting the gitShallowHosts setting via
git_host_in_list.
Decode a pnpm-style SRI integrity string (sha512- / sha384- /
sha256- / sha1- + base64) into its raw hex digest. Used by
introspection commands that accept the registry integrity format
as an ergonomic input, and by index_path to shard the cache
directory by integrity prefix. Returns None if the input isn’t a
well-formed SRI integrity string.
Convert a legacy dist.shasum (hex-encoded SHA-1) into an SRI
sha1-<base64> integrity string — the inverse of the sha1 branch of
integrity_to_hex. Registries that predate npm’s 2017 SRI rollout,
or proxies that strip the modern dist.integrity field, still ship
dist.shasum, and npm’s classic client has always treated it as the
package’s verification hash. Deriving sha1-… from it lets the
resolver record a verifiable integrity instead of falling through to
an unverifiable tarball-only resolution. Returns None unless the
input is a well-formed 40-char hex digest, so a malformed/absent
field cleanly degrades to the existing no-integrity path rather than
minting a bogus SRI.
Validate a package name and return the safe_name form used as a
cache filename stem (/ collapsed to __ so scoped names survive
a single path component). Refuses anything outside the npm name
grammar so a hostile packument cannot turn a cache write into an
arbitrary-file-write primitive. Public so callers in
aube-registry and aube (which own separate cache layouts under
the same cache root) can share one validator.
Cross-check that an extracted tarball’s package.json reports the
same name and version the registry told us to fetch. This is the
implementation behind the strictStorePkgContentCheck setting and
guards against registry-substitution attacks where a tarball is
served under one (name, version) but actually contains a different
package on disk.
Check a version string for use as a cache filename component.
The lockfile already constrains versions to semver-ish shapes, but
the cache path is independent of the lockfile on the write side so
a crafted packument version would still land here. Returns true
for anything the cache path builder is willing to accept.
Verify that data matches an SRI integrity hash. Accepts any of
sha512- / sha384- / sha256- / sha1- prefixed base64 digests
— the set npm and pnpm accept in dist.integrity. Returns Ok(())
on match, Err(Error::Integrity) on mismatch or unknown algorithm.
Verify a precomputed SHA-512 digest against an SRI integrity
string. Used by the streaming-tarball fetch path: SHA-512 is
computed during the chunk read loop, then handed here so the
owned Bytes are not re-hashed on the import side. Saves one
pass over the buffer (~7 ms / 5 MB tarball).