deps!: bump sigstore from 2.x to 3.0.0

BREAKING CHANGE: Attestations made by this package will no longer validate in npm versions prior to 10.6.0 Signed-off-by: Brian DeHamer <bdehamer@github.com>

Author: bdehamer

node_modules/.gitignore

@@ -222,6 +222,23 @@
 !/shebang-regex
 !/signal-exit
 !/sigstore
+!/sigstore/node_modules/
+/sigstore/node_modules/*
+!/sigstore/node_modules/@npmcli/
+/sigstore/node_modules/@npmcli/*
+!/sigstore/node_modules/@npmcli/agent
+!/sigstore/node_modules/@npmcli/fs
+!/sigstore/node_modules/@sigstore/
+/sigstore/node_modules/@sigstore/*
+!/sigstore/node_modules/@sigstore/tuf
+!/sigstore/node_modules/cacache
+!/sigstore/node_modules/make-fetch-happen
+!/sigstore/node_modules/minipass-fetch
+!/sigstore/node_modules/proc-log
+!/sigstore/node_modules/ssri
+!/sigstore/node_modules/tuf-js
+!/sigstore/node_modules/unique-filename
+!/sigstore/node_modules/unique-slug
 !/smart-buffer
 !/socks-proxy-agent
 !/socks
@@ -253,17 +270,9 @@
 !/tuf-js
 !/tuf-js/node_modules/
 /tuf-js/node_modules/*
-!/tuf-js/node_modules/@npmcli/
-/tuf-js/node_modules/@npmcli/*
-!/tuf-js/node_modules/@npmcli/agent
-!/tuf-js/node_modules/@npmcli/fs
-!/tuf-js/node_modules/cacache
-!/tuf-js/node_modules/make-fetch-happen
-!/tuf-js/node_modules/minipass-fetch
-!/tuf-js/node_modules/proc-log
-!/tuf-js/node_modules/ssri
-!/tuf-js/node_modules/unique-filename
-!/tuf-js/node_modules/unique-slug
+!/tuf-js/node_modules/@tufjs/
+/tuf-js/node_modules/@tufjs/*
+!/tuf-js/node_modules/@tufjs/models
 !/unique-filename
 !/unique-slug
 !/util-deprecate

node_modules/@sigstore/tuf/dist/appdata.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appDataPath = void 0;
+exports.appDataPath = appDataPath;
 /*
 Copyright 2023 The Sigstore Authors.
 
@@ -41,4 +41,3 @@ function appDataPath(name) {
  }
  }
 }
-exports.appDataPath = appDataPath;

node_modules/@sigstore/tuf/dist/client.js

@@ -79,7 +79,6 @@ function seedCache({ cachePath, mirrorURL, tufRootPath, forceInit, }) {
  fs_1.default.copyFileSync(tufRootPath, cachedRootPath);
  }
  else {
- /* eslint-disable @typescript-eslint/no-var-requires */
  const seeds = require('../seeds.json');
  const repoSeed = seeds[mirrorURL];
  if (!repoSeed) {

node_modules/@sigstore/tuf/dist/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TUFError = exports.initTUF = exports.getTrustedRoot = exports.DEFAULT_MIRROR_URL = void 0;
+exports.TUFError = exports.DEFAULT_MIRROR_URL = void 0;
+exports.getTrustedRoot = getTrustedRoot;
+exports.initTUF = initTUF;
 /*
 Copyright 2023 The Sigstore Authors.
 
@@ -31,14 +33,12 @@ options = {}) {
  const trustedRoot = await client.getTarget(TRUSTED_ROOT_TARGET);
  return protobuf_specs_1.TrustedRoot.fromJSON(JSON.parse(trustedRoot));
 }
-exports.getTrustedRoot = getTrustedRoot;
 async function initTUF(
 /* istanbul ignore next */
 options = {}) {
  const client = createClient(options);
  return client.refresh().then(() => client);
 }
-exports.initTUF = initTUF;
 // Create a TUF client with default options
 function createClient(options) {
  /* istanbul ignore next */

node_modules/@sigstore/tuf/dist/target.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readTarget = void 0;
+exports.readTarget = readTarget;
 /*
 Copyright 2023 The Sigstore Authors.
 
@@ -39,7 +39,6 @@ async function readTarget(tuf, targetPath) {
  });
  });
 }
-exports.readTarget = readTarget;
 // Returns the local path to the specified target. If the target is not yet
 // cached locally, the provided TUF Updater will be used to download and
 // cache the target.

node_modules/@sigstore/tuf/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@sigstore/tuf",
- "version": "2.3.4",
+ "version": "3.0.0",
  "description": "Client for the Sigstore TUF repository",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
@@ -28,14 +28,14 @@
  },
  "devDependencies": {
  "@sigstore/jest": "^0.0.0",
- "@tufjs/repo-mock": "^2.0.1",
+ "@tufjs/repo-mock": "^3.0.1",
  "@types/make-fetch-happen": "^10.0.4"
  },
  "dependencies": {
  "@sigstore/protobuf-specs": "^0.3.2",
- "tuf-js": "^2.2.1"
+ "tuf-js": "^3.0.1"
  },
  "engines": {
- "node": "^16.14.0 || >=18.0.0"
+ "node": "^18.17.0 || >=20.5.0"
  }
 }

node_modules/@sigstore/tuf/seeds.json

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+const rimraf = require('./')
+
+const path = require('path')
+
+const isRoot = arg => /^(\/|[a-zA-Z]:\\)$/.test(path.resolve(arg))
+const filterOutRoot = arg => {
+ const ok = preserveRoot === false || !isRoot(arg)
+ if (!ok) {
+ console.error(`refusing to remove ${arg}`)
+ console.error('Set --no-preserve-root to allow this')
+ }
+ return ok
+}
+
+let help = false
+let dashdash = false
+let noglob = false
+let preserveRoot = true
+const args = process.argv.slice(2).filter(arg => {
+ if (dashdash)
+ return !!arg
+ else if (arg === '--')
+ dashdash = true
+ else if (arg === '--no-glob' || arg === '-G')
+ noglob = true
+ else if (arg === '--glob' || arg === '-g')
+ noglob = false
+ else if (arg.match(/^(-+|\/)(h(elp)?|\?)$/))
+ help = true
+ else if (arg === '--preserve-root')
+ preserveRoot = true
+ else if (arg === '--no-preserve-root')
+ preserveRoot = false
+ else
+ return !!arg
+}).filter(arg => !preserveRoot || filterOutRoot(arg))
+
+const go = n => {
+ if (n >= args.length)
+ return
+ const options = noglob ? { glob: false } : {}
+ rimraf(args[n], options, er => {
+ if (er)
+ throw er
+ go(n+1)
+ })
+}
+
+if (help || args.length === 0) {
+ // If they didn't ask for help, then this is not a "success"
+ const log = help ? console.log : console.error
+ log('Usage: rimraf <path> [<path> ...]')
+ log('')
+ log(' Deletes all files and folders at "path" recursively.')
+ log('')
+ log('Options:')
+ log('')
+ log(' -h, --help Display this usage info')
+ log(' -G, --no-glob Do not expand glob patterns in arguments')
+ log(' -g, --glob Expand glob patterns in arguments (default)')
+ log(' --preserve-root Do not remove \'/\' (default)')
+ log(' --no-preserve-root Do not treat \'/\' specially')
+ log(' -- Stop parsing flags')
+ process.exit(help ? 0 : 1)
+} else
+ go(0)