Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-26 18:31:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(installer): pin npm registry trust boundary

Browse Source 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-07-27 15:32:13 +00:00
1 parent 94b68d2437
commit b9df8bf4f5
6 files changed
+83 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/install-sh-fixtures/npx
+7
View File
@@ -3,4 +3,11 @@ set -euo pipefail
: "${PAPERCLIP_INSTALL_TEST_LOG:?PAPERCLIP_INSTALL_TEST_LOG is required}"
node --version >"${PAPERCLIP_INSTALL_TEST_LOG}.node"
printf 'NPM_CONFIG_REGISTRY=%s\n' "${NPM_CONFIG_REGISTRY:-}" >>"$PAPERCLIP_INSTALL_TEST_LOG"
printf 'npm_config_registry=%s\n' "${npm_config_registry:-}" >>"$PAPERCLIP_INSTALL_TEST_LOG"
printf 'NPM_CONFIG_USERCONFIG=%s\n' "${NPM_CONFIG_USERCONFIG:-}" >>"$PAPERCLIP_INSTALL_TEST_LOG"
printf 'npm_config_userconfig=%s\n' "${npm_config_userconfig:-}" >>"$PAPERCLIP_INSTALL_TEST_LOG"
if [ -n "${NPM_CONFIG_USERCONFIG:-}" ] && [ -f "$NPM_CONFIG_USERCONFIG" ]; then
sed 's/^/npmrc:/' "$NPM_CONFIG_USERCONFIG" >>"$PAPERCLIP_INSTALL_TEST_LOG"
fi
printf '%s\n' "$@" >>"$PAPERCLIP_INSTALL_TEST_LOG"
scripts/install.sh
+9 -3
View File
@@ -4,6 +4,7 @@ set -euo pipefail
MIN_NODE_MAJOR=20
DEFAULT_NODE_MAJOR=22
PAPERCLIP_PACKAGE="paperclipai"
PUBLIC_NPM_REGISTRY="https://registry.npmjs.org"
HOMEBREW_INSTALL_COMMIT="99e13e96cbbdc1ac1ac09c0a40b450bf219ef3aa"
HOMEBREW_INSTALL_SHA256="99287f194a8b3c9e6b0203a11a5fa54518be57209343e6bb954dec4635796d9d"
NODESOURCE_DEB_SHA256="575583bbac2fccc0b5edd0dbc03e222d9f9dc8d724da996d22754d6411104fd1"
@@ -354,7 +355,12 @@ INSTALL_ARGS=(install)
[ "$CANARY" = "1" ] && INSTALL_ARGS+=(--canary)
[ -n "$VERSION" ] && INSTALL_ARGS+=(--version "$VERSION")
[ "$NO_PROMPT" = "1" ] && INSTALL_ARGS+=(--yes)
INSTALL_COMMAND=(npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}")
ensure_temp_dir
NPM_USERCONFIG="$TEMP_DIR/npmrc"
printf 'registry=%s\n@paperclipai:registry=%s\n' "$PUBLIC_NPM_REGISTRY" "$PUBLIC_NPM_REGISTRY" >"$NPM_USERCONFIG"
chmod 600 "$NPM_USERCONFIG"
NPM_ENV=(env "NPM_CONFIG_REGISTRY=$PUBLIC_NPM_REGISTRY" "npm_config_registry=$PUBLIC_NPM_REGISTRY" "NPM_CONFIG_USERCONFIG=$NPM_USERCONFIG" "npm_config_userconfig=$NPM_USERCONFIG")
INSTALL_COMMAND=("${NPM_ENV[@]}" npx --yes "--registry=$PUBLIC_NPM_REGISTRY" "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}")
log "Delegating to the Paperclip CLI"
if [ "$DRY_RUN" = "1" ]; then
@@ -367,8 +373,8 @@ print_command "${INSTALL_COMMAND[@]}"
if [ "$INSTALL_SERVICE" = "1" ]; then
log "Installing the Paperclip service"
print_command npx --yes "$PACKAGE_SPEC" service install
npx --yes "$PACKAGE_SPEC" service install
print_command "${NPM_ENV[@]}" npx --yes "--registry=$PUBLIC_NPM_REGISTRY" "$PACKAGE_SPEC" service install
"${NPM_ENV[@]}" npx --yes "--registry=$PUBLIC_NPM_REGISTRY" "$PACKAGE_SPEC" service install
fi
if [ "$NO_ONBOARD" = "0" ] && [ -t 0 ] && [ -t 1 ]; then
scripts/test-install-sh-docker.sh
+22
View File
@@ -68,6 +68,28 @@ run_with_node with-node bash /paperclip-scripts/install.sh --no-onboard
assert_line "$RESULTS_DIR/with-node.args" "paperclipai@latest"
assert_line "$RESULTS_DIR/with-node.args" "install"
assert_line "$RESULTS_DIR/with-node.args" "--yes"
assert_line "$RESULTS_DIR/with-node.args" "--registry=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/with-node.args" "NPM_CONFIG_REGISTRY=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/with-node.args" "npm_config_registry=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/with-node.args" "npmrc:registry=https://registry.npmjs.org"
echo "==> hostile npm config isolation"
mkdir -p "$RESULTS_DIR/hostile-home"
printf 'registry=http://attacker-registry.invalid\n' >"$RESULTS_DIR/hostile-home/.npmrc"
docker run --rm \
-v "$REPO_ROOT/scripts:/paperclip-scripts:ro" \
-v "$RESULTS_DIR:/results" \
-e HOME=/results/hostile-home \
-e NPM_CONFIG_REGISTRY=http://attacker-registry.invalid \
-e npm_config_registry=http://attacker-registry.invalid \
-e PAPERCLIP_INSTALL_TEST_LOG=/results/hostile.args \
-e PATH="/paperclip-scripts/install-sh-fixtures:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
node:22-bookworm-slim \
bash /paperclip-scripts/install.sh --no-onboard
assert_line "$RESULTS_DIR/hostile.args" "--registry=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/hostile.args" "NPM_CONFIG_REGISTRY=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/hostile.args" "npm_config_registry=https://registry.npmjs.org"
assert_line "$RESULTS_DIR/hostile.args" "npmrc:registry=https://registry.npmjs.org"
echo "==> --ref master"
if run_with_node ref-master bash /paperclip-scripts/install.sh --ref master --no-onboard; then