Reverse option of neverBuiltDependencies

[Jack-Works]

• I'd be willing to implement this feature (contributing guide)

Describe the user story

There should be an onlyBuiltDependencies option. Only allows some scripts makes the install safer.

Describe the solution you'd like

Add an onlyBuiltDependencies like neverBuiltDependencies

[zkochan]

This doesn't make it completely secure to be honest. Let's say you add fsevents to onlyBuiltDependencies. Then someone breaks package foo and adds fsevents to its dependencies. But the fsevents in the dependencies will be a githosted dependency or a dependency from a different registry. fsevents will be executed because the name is right.

[Jack-Works]

This doesn't make it completely secure to be honest. Let's say you add fsevents to onlyBuiltDependencies. Then someone breaks package foo and adds fsevents to its dependencies. But the fsevents in the dependencies will be a githosted dependency or a dependency from a different registry. fsevents will be executed because the name is right.

Yes. I agree, this case is interesting and completely makes it unsafe.

@bentobox19 @kumavis @v-gjy @EtDu how do you think?

If I allowed fsevents to run post-install scripts, an evil dependency can declare it depends on a fake fsevents that installed from "git://" or .tar.gz and make this limit completely useless.

Maybe we also should limit the install source (only install from approved registry/git URL/HTTPs URL)?

[Jack-Works]

🤔 Thanks to .pnpmfile.cjs I can write my own approve list for an unusual installation source.

https://github.com/DimensionDev/Maskbook/pull/4867/files

I think this + neverBuiltDependencies can solve the problem.

[Jack-Works]

If I allowed fsevents to run post-install scripts, an evil dependency can declare it depends on a fake fsevents that installed from "git://" or a .tar.gz file and make this limit completely useless.

Having a new thought on this problem, what about we limit the package name like this?

"onlyBuiltDependencies": ["npm:fsevents"]

It will only run the build command if the package is made "fsevents" and it is installed directly from npm in form of "fsevents": "1.2.3".

"fsevents": "npm:my-evil-package@1.2.3" or "fsevents": "https://github.com/..." does not match the onlyBuiltDependencies rule.