Check that integrity hashes match hashes from NPM

[patcon]

Re-ticketed from #2414 (comment)

Currently, we're checking that (1) integrity hashes exist in our lockfile and (2) that they're validly formed. We're not checking that they (3) match the files in our node_modules, nor if (4) those hashes match those from NPM (our local cache could be corrupted). This focusses on (4).

(This should use external packages when possible)

• validate cached integrity hash matches hash on npmjs
  • the cached tarball and cached checksum could match, but it might not be the contents from npm. we don't confirm that yet

[esizer]

I don't fully understand this issue but I did find this stack overflow page while researching it. Is this related/helpful?

Honestly - no. NPM is the distribution service, and you'd need to trust it to deliver an integrity check. If you trust it, and you have your https root certificates setup correctly (aka no mitm), then you can trust the files it delivers.

Ref: https://stackoverflow.com/questions/57667640/is-there-a-way-to-assure-the-integrity-of-a-published-npm-packages-using-hashes

[patcon]

Thanks @esizer, but I think that is unrelated and this is still outstanding, as evidenced by this npm issue which has not been getting any love: npm/cli#4460 (comment)

As someone who used to work with reproducible build systems and processes for high-stakes security software like Tor and TailsOS, I find the npm team response to this issue quite disappointing.

Recommendation

I'd suggest we don't remediate this downstream in our repo, and instead just try to move to using yarn asap (which as I understand, doesn't have these issues with integrity checksums.

[esizer]

As someone who used to work with reproducible build systems and processes for high-stakes security software like Tor and TailsOS, I find the npm team response to this issue quite disappointing.

Yikes, so they don't validate integrity hashes? 😱 Okay, then yeah that is not good for us :(

I'd suggest we don't remediate this downstream in our repo, and instead just try to move to using yarn asap (which as I understand, doesn't have these issues with integrity checksums.

Agreed, if yarn is doing proper validations then I agree to move to it. I prefer yarn anyway 😏

[mnigh]

@esizer What about pnpm, will this solve this issue?

[esizer]

@esizer What about pnpm, will this solve this issue?

Definitely https://pnpm.io/npmrc#verify-store-integrity