šŸŒœ
šŸŒž
lockfile-lint

lockfile-lint

v4.7.7

A CLI to lint a lockfile for security policies

npm install lockfile-lint

README

lockfile-lint

A CLI to lint a lockfile for security policies

npm version license downloads build codecov Known Vulnerabilities Security Responsible Disclosure

About

A CLI tool to lint a lockfile for security policies

Install

npm install --save lockfile-lint

Usage

lockfile-lint can be installed per a project scope, or globally and exposes a lockfile-lint executable that should be practiced during builds, CIs, and general static code analysis procedures to ensure that lockfiles are kept up to date with pre-defined security and usage policies.

lockfile-lint --type <yarn|npm> --path <path-to-lockfile> --validate-https --allowed-hosts <host-to-match> --allowed-urls <urls-to-match>

Supported lockfiles:

  • npm's package-lock.json and npm-shrinkwrap.json
  • yarn's yarn.lock

Example

An example of running the linter with debug output for a yarn lockfile and asserting that all resources are using the official npm registry as source for packages:

DEBUG=* lockfile-lint --path yarn.lock --type yarn --allowed-hosts npm

Example 2: specify hostnames and enforce the use of HTTPS as a protocol

lockfile-lint --path yarn.lock --allowed-hosts registry.yarnpkg.com --validate-https
  • --type yarn is ommitted since lockfile-lint can figure it out on it's own
  • --allowed-hosts explicitly set to match yarn's mirror host

Example 3: allow the lockfile to contain packages served over github and so need to specify github.com as a host as well as the git+https: as a valid URI scheme

lockfile-lint --path yarn.lock --allowed-hosts yarn github.com --allowed-schemes "https:" "git+https:"
  • --allowed-hosts explicitly set to match github.com as a host and specifies yarn as the alias for yarn's official mirror host
  • --allowed-schemes is used instead of validate-https and it explicitly allows both https: and git+https: as the HTTP Scheme for the github URL. Note that --allowed-schemes and --validate-https are mutually exclusive.

Example 4: allow the lockfile to contain a package which resolves to a specific URL specified by the --allowed-urls option while all other packages must resolve to yarn as specified by --allowed-hosts

lockfile-lint --path yarn.lock --allowed-hosts yarn --allowed-urls https://github.com/lirantal/lockfile-lint#d30ce73a3e5977dede29450df1c79b09f02779b2
  • --allowed-hosts allows packages from yarn only
  • --allowed-urls overrides allowed-hosts and allows a specific Github URL to pass validation

CLI command options

command line argument description implemented
--path, -p path to the lockfile āœ…
--type, -t lockfile type, options are npm or yarn āœ…
--validate-https, -s validates the use of HTTPS as protocol schema for all resources in the lockfile āœ…
--allowed-hosts, -a validates a list of allowed hosts to be used for all resources in the lockfile. Supported short-hands aliases are npm, yarn, and verdaccio which will match URLs https://registry.npmjs.org, https://registry.yarnpkg.com and https://registry.verdaccio.org respectively āœ…
--allowed-schemes, -o allowed URI schemes such as "https:", "http", "git+ssh:", or "git+https:" āœ…
--allowed-urls, -u allowed URLs (e.g. https://github.com/some-org/some-repo#some-hash) āœ…
--empty-hostname, -e allow empty hostnames, or set to false if you wish for a stricter policy āœ…
--validate-package-names, -n validates that the resolved URL matches the package name āœ…
--validate-checksum, -c check that all resources include a checksum āŒ PRs welcome
--validate-integrity, -i check that all resources include an integrity field āŒ PRs welcome

File-Based Configuration

Lockfile-lint uses cosmiconfig for configuration file support. This means you can configure the above options via (in order of precedence):

  • A "lockfile-lint" key in your package.json file.
  • A .lockfile-lintrc file, written in JSON or YAML, with optional extensions: .json/.yaml/.yml (without extension takes precedence).
  • A .lockfile-lint.js or lockfilelint.config.js file that exports an object.
  • A .lockfile-lint.toml file, written in TOML (the .toml extension is required).

The configuration file will be resolved starting from the current working directory, and searching up the file tree until a config file is (or isn't) found. Command-line options take precedence over any file-based configuration.

The options accepted in the configuration file are the same as the options above in camelcase (e.g. "path", "allowedHosts").

Contributing

Please consult CONTIRBUTING for guidelines on contributing to this project.

Author

lockfile-lint Ā© Liran Tal, Released under the Apache-2.0 License.

General

License
Apache-2.0
Typescript Types
None found
Tree-shakeable
No

Popularity

GitHub Stargazers
615
Community Interest
483
Number of Forks
33

Maintenance

Commits
10/219/22015
Last Commit
Open Issues
8
Closed Issues
54
Open Pull Requests
2
Closed Pull Requests
7

Versions

Versions Released
10/219/2202
Latest Version Released
Jul 22, 2022
Current Tags
latest4.7.7

Contributors

lirantal
lirantal
Commits: 75
XhmikosR
XhmikosR
Commits: 7
bolatovumar
bolatovumar
Commits: 5
snyk-bot
snyk-bot
Commits: 4
emimuresan
emimuresan
Commits: 3
juanpicado
juanpicado
Commits: 2
richsilv
richsilv
Commits: 2
pratik97
pratik97
Commits: 2
xiniria
xiniria
Commits: 1
salesh
salesh
Commits: 1
anishkny
anishkny
Commits: 1
JaanJah
JaanJah
Commits: 1
jonchurch
jonchurch
Commits: 1
matthias-ccri
matthias-ccri
Commits: 1
MathieuAA
MathieuAA
Commits: 1