He aha te hiranga o Package-Lock.JSON mō ngā Kaiwhakawhanake
I roto i ngā kaupapa Node.js, ehara i te mea he kōnae hoa noa iho a package-lock.json ki a package.json. Ka rakahia ngā putanga tuturu o ia whakawhirinakitanga kua tāutahia, tae atu ki ngā mea kua whakapūtāhia. Ka whakarite tēnei kōnae i te āheinga tāruarua puta noa i ngā taiao, ā, ka ārai i ngā huringa ohorere ina whakaputaina ngā putanga mōkihi hou. Ki te kore, ka tūpono ngā kaiwhakawhanake ki ngā whanonga rerekē i roto i ngā wāhanga whakawhanake, whakamātautau, me te whakaputa nā te neke haere o ngā rākau whakawhirinakitanga, ā, ka huaki te kuaha ki te hapa pato npm mēnā ka uru ngā hapa ki roto i te kōnae lock.
Ina whakamahia tika, ka whakarite a package-lock.json kia mōhio te katoa o tō rōpū me tō rōpū CI/CD pipeline tāuta te waehere kotahi. Engari kotahi te hapa pato puku i roto i tēnei kōnae ka taea te tuku tika i tō taupānga ki roto i te mahanga.
Me pēhea te arahi a ngā hapa pato ki ngā whakaekenga hapa NPM?
Me kī he mōkihi tika i roto i mōkihi.json kua tika te tuhi, pērā i rorirori. Engari he tāurunga i he te pato i roto i package-lock.json, Pērā i ngā loda, ka taea tonu e ia te uru puku ki roto i tō rākau whakawhirinakitanga, ina koa mēnā i whakatikahia ā-ringa e tetahi, i tuhia rānei e tētahi taputapu hapa.
Ka whakawhirinaki ngā kaiwhakaeke ki ēnei hapa pato mā te tikanga e kiia nei ko te npm typosquatting. Ka tukuatu rātou i ngā mōkihi kino me ngā ingoa e rite ana ki ngā mea rongonui (hei tauira, tauhohe-domm, whakapuaki, rahiri). Mena kei roto i tō JSON raka mōkihi tētahi hapa pato pēnei, ka tāutahia e te npm te mōkihi a te kaiwhakaeke me te kore pātai, nā te mea i kī mārama koe kia pērā.
Ehara i te mea he ariā noa iho te mahi tāpāpāho npm. Kua rongonui ngā whakaekenga tāpāpāho npm o te ao tūturu. Ko tētahi tauira ko te Te takahi i te mōkihi Coa, i reira waehere kino i tukuna mā te whakahoutanga o tētahi mōkihi pono. Ko te rerekētanga ko te hapa pato o te npm, ka pōhiritia e te kaiwhakawhanake te kaiwhakaeke mā te pato he i tētahi whakawhirinakitanga.
Ngā Tūponotanga Tuturu i roto i CI/CD PipelineNā ngā hapa json raka mōkihi i puta
Modern CI/CD pipelinete maimoatanga package-lock.json hei puna o te pono. I te wā e hangaia ana, e whakatinanahia ana rānei, ko te pipeline rere npm ci or npm tāuta, e rua ngā mea e pānuihia ana mai i te kōnae maukati. Mena he hapa tā, ka kumea aunoatia te mōkihi kino. Kāore he whakatūpato. Kāore he tohu.
Ko te tikanga o tēnei, ka horapa puku te hapa i whakaurua i te wā o te whanaketanga ā-rohe tae noa ki te whakaaturanga, tae noa ki te whakaputanga. Ka taea e ngā kaiwhakaeke te whakauru i ngā tahae tohu, ngā kaikeri moni matihiko, ngā tatau muri rānei e whakahohe ana i muri i te whakatinanatanga. Ka taea tēnei katoa te puta me te kore e whakaoho i ngā taputapu haumarutanga, nā te mea i "whakapuakina" te whakawhirinakitanga i roto i te package-lock.json.
Ehara tēnei i te hapa noa iho. He takahi mekameka tuku e tatari ana kia puta, ā, mā te patopato npm ka waiho hei tūmomo mōrearea.
Te Kite me te Ārai i ngā Pāpāho Whakawhirinakitanga hei Whakaiti i te Pāpāho NPM
Ngā hapa pato i roto package-lock.json kāore e kitea mēnā kāore koe e rapu kaha ana i a rātou. Anei te tīmatanga:
- Tātari PatekoKāore ētahi taputapu e hopu i ēnei take, engari ka taea e ngā matawai whakawhirinakitanga motuhake. Whakauruhia ngā taputapu e matawai ana mō ngā tauira patopato npm me te tirotiro i tō package-lock.json mō ngā taupatupatu.
- Ngā Kōnae Maukati WhakatakotoriaWhakamahia ngā ture whakakoi ritenga, ngā monomai rānei hei whakamana package-lock.json ngā tāurunga ki ngā rārangi haumaru e mōhiotia ana.
- Arotake WaehereHe mea nui ngā arotake a ngā hoa mahi. He haruru ngā rerekētanga o te kōnae maukati, engari whakaakona tō rōpū ki te arotake i aua mea pērā i te waehere.
- Nga Tirohanga Aunoa: Whakaritea pre-commit hooks ngā mahi CI rānei hei whakakore i ngā whakaurunga kāore anō kia manatokohia, kia whakapaetia rānei i roto package-lock.json.
Anei tētahi tauira whai hua mā te whakamahi i a GitHub Actions:
Ehara tēnei i te mea ārai-mate, engari ka tohu i ngā ingoa mōkihi tauhou e tohu ana pea i te hapa npm.
Te Whakamarumaru i ngā Kaupapa Node.js Mai i te NPM Typosquatting me ngā Whakaekenga mekameka tuku
Hei raka i tō taupānga Node.js me te ārai i ngā whakaekenga mā te package-lock.json:
- Te whakapiri i te putanga tino pakari: Āta karohia ngā awhe putanga (^, ~) i roto i mōkihi.jsonMaukatihia ngā whakawhirinakitanga katoa ki ngā putanga tuturu hei whakaiti i ngā whakahōutanga ohorere me te hēmanawa.
- Manatoko WaitohuWhakamahia ngā taputapu pēnei i a Sigstore me ngā āhuatanga takenga mai o npm hei manatoko i te pono me te takenga mai o ngā mōkihi.
- Ngā Hanganga Tuturu: Whakamahia i nga wa katoa npm ci me te mea kua whakamanahia package-lock.json kōnae i roto i ngā taiao whakaputa. Kaua rawa e whakawhirinaki ki npm tāuta i te wā o ngā whakatinanatanga, nā te mea ka taea te whakauru mai i ngā huringa kāore anō kia tirohia.
- Te aro turuki tonuWhakamahia ngā otinga aroturuki hei whakatūpato i a koe ina:
- Ka puta mai ngā mōkihi hou i roto i tō package-lock.json
- Ka huri ohorere ngā mōkihi o nāianei
- Ngā tauira whakapae (hei tauira, ngā ingoa mōkihi pēnei i whakapuaki, tauhohe-domm, rahiri) kua kitea
- Ngā Utauta Arotake WhakawhirinakitangaWhakauruhia ngā taputapu aunoa pēnei i te npm arotake, Snyk, ranei Xygeni ki roto i tō CI pipeline hei matawai i ngā ngoikoretanga me ngā tohu hapa pato.
- Te Hauora o te Kōnae Maukati: Tutuki package-lock.json hei waehere. Arotakehia i te wā pull requests, inā koa ka whakahoutia, ka tāpirihia rānei ngā whakawhirinakitanga.
- aunoa Pre-Commit Ngā haki: Whakamahia pre-commit hooks hei whakamana i tō kōnae maukati i mua i tōna taenga ki te mana whakahaere putanga.
package-lock.json he whāinga nui te uara i roto i ngā whakaekenga typosquatting npm. He typo rite ki tauhohe-domm or ngā loda ka hoatu he ara tika ki ngā kaiwhakaeke ki roto i tō hanganga pipelineHe mea nui te tūpato ki tēnei kōnae hei pupuri i te pono o te mekameka tuku.
Nō reira, ka taea e te hapa pato kotahi te totohu i tō hanganga. Kaua e Tukua!
He hapa tā package-lock.json ehara i te mea he mahi waehere pōrearea noa iho; he tūmomo mōrearea tūturu mō te mahi patopato npm. He kaitiaki tatau te kōnae, ā, ki te takahia, ko tāu pipeline he nui rawa atu. Kāore te whakatikatika i te ātaahua: whakaroa, arotake i te kōnae maukati, aunoatia ngā tirotiro, me te aroturuki i ngā huringa. Engari he pai te utu.
Hei whakapai ake i tō parepare, whakaarohia te whakamahi i ngā taputapu pēnei i a Xygeni, he mea hanga hei kite i ngā hapa pato, hei tirotiro raka mōkihi JSON ngā kōnae, me te tiaki i te pono o te mōkihi puta noa i tō pūnaha katoa CI/CD pipelineI tēnei ao o te pūmanawa tuwhera, ka whiwhihia te whakawhirinaki, ā, ka manatokohia.
