feat: download only yarn.js from npm

config.json

@@ -149,7 +149,8 @@
           },
           "npmRegistry": {
             "type": "npm",
-            "package": "@yarnpkg/cli-dist"
+            "package": "@yarnpkg/cli-dist",
+            "bin": "bin/yarn.js"
           },
           "commands": {
             "use": [

sources/corepackUtils.ts

@@ -1,21 +1,21 @@
-import {createHash}                                            from 'crypto';
-import {once}                                                  from 'events';
-import {FileHandle}                                            from 'fs/promises';
-import fs                                                      from 'fs';
-import type {Dir}                                              from 'fs';
-import Module                                                  from 'module';
-import path                                                    from 'path';
-import semver                                                  from 'semver';
-import {setTimeout as setTimeoutPromise}                       from 'timers/promises';
-
-import * as engine                                             from './Engine';
-import * as debugUtils                                         from './debugUtils';
-import * as folderUtils                                        from './folderUtils';
-import * as httpUtils                                          from './httpUtils';
-import * as nodeUtils                                          from './nodeUtils';
-import * as npmRegistryUtils                                   from './npmRegistryUtils';
-import {RegistrySpec, Descriptor, Locator, PackageManagerSpec} from './types';
-import {BinList, BinSpec, InstallSpec}                         from './types';
+import {createHash}                                                          from 'crypto';
+import {once}                                                                from 'events';
+import {FileHandle}                                                          from 'fs/promises';
+import fs                                                                    from 'fs';
+import type {Dir}                                                            from 'fs';
+import Module                                                                from 'module';
+import path                                                                  from 'path';
+import semver                                                                from 'semver';
+import {setTimeout as setTimeoutPromise}                                     from 'timers/promises';
+
+import * as engine                                                           from './Engine';
+import * as debugUtils                                                       from './debugUtils';
+import * as folderUtils                                                      from './folderUtils';
+import * as httpUtils                                                        from './httpUtils';
+import * as nodeUtils                                                        from './nodeUtils';
+import * as npmRegistryUtils                                                 from './npmRegistryUtils';
+import {RegistrySpec, Descriptor, Locator, PackageManagerSpec, DownloadSpec} from './types';
+import {BinList, BinSpec, InstallSpec}                                       from './types';
 
 export function getRegistryFromPackageManagerSpec(spec: PackageManagerSpec) {
   return process.env.COREPACK_NPM_REGISTRY
@@ -132,6 +132,71 @@ function isValidBinSpec(x: unknown): x is BinSpec {
   return typeof x === `object` && x !== null && !Array.isArray(x) && Object.keys(x).length > 0;
 }
 
+async function download(installTarget: string, url: string, algo: string, binPath: string | null = null): Promise<DownloadSpec> {
+  // Creating a temporary folder inside the install folder means that we
+  // are sure it'll be in the same drive as the destination, so we can
+  // just move it there atomically once we are done
+
+  const tmpFolder = folderUtils.getTemporaryFolder(installTarget);
+  debugUtils.log(`Downloading to ${tmpFolder}`);
+
+  const stream = await httpUtils.fetchUrlStream(url);
+
+  const parsedUrl = new URL(url);
+  const ext = path.posix.extname(parsedUrl.pathname);
+
+  let outputFile: string | null = null;
+  let sendTo: any;
+
+  if (ext === `.tgz`) {
+    const {default: tar} = await import(`tar`);
+    sendTo = tar.x({
+      strip: 1,
+      cwd: tmpFolder,
+      filter: binPath ? path => {
+        const pos = path.indexOf(`/`);
+        if (pos === -1 || path.slice(pos + 1) !== binPath)
+          return false;
+
+        return true;
+      } : undefined,
+    });
+  } else if (ext === `.js`) {
+    outputFile = path.join(tmpFolder, path.posix.basename(parsedUrl.pathname));
+    sendTo = fs.createWriteStream(outputFile);
+  }
+  stream.pipe(sendTo);
+
+  const streamHash = stream.pipe(createHash(algo));
+  await once(sendTo, `finish`);
+
+  if (binPath) {
+    const downloadedBin = path.join(tmpFolder, binPath);
+    if (!fs.existsSync(downloadedBin))
+      throw new Error(`Cannot locate '${binPath}' in downloaded tarball`);
+
+    outputFile = path.join(tmpFolder, path.basename(downloadedBin));
+    await rename(downloadedBin, outputFile);
+
+    // Calculate the hash of the bin file
+    const fileStream = fs.createReadStream(outputFile);
+    const fileHash = fileStream.pipe(createHash(algo));
+    await once(fileStream, `close`);
+
+    return {
+      tmpFolder,
+      outputFile,
+      hash: fileHash.digest(`hex`),
+    };
+  }
+
+  return {
+    tmpFolder,
+    outputFile,
+    hash: streamHash.digest(`hex`),
+  };
+}
+
 export async function installVersion(installTarget: string, locator: Locator, {spec}: {spec: PackageManagerSpec}): Promise<InstallSpec> {
   const locatorIsASupportedPackageManager = isSupportedPackageManagerLocator(locator);
   const locatorReference = locatorIsASupportedPackageManager ? semver.parse(locator.reference)! : parseURLReference(locator);
@@ -159,12 +224,16 @@ export async function installVersion(installTarget: string, locator: Locator, {s
   }
 
   let url: string;
+  let binPath: string | null = null;
   if (locatorIsASupportedPackageManager) {
     url = spec.url.replace(`{}`, version);
     if (process.env.COREPACK_NPM_REGISTRY) {
       const registry = getRegistryFromPackageManagerSpec(spec);
       if (registry.type === `npm`) {
         url = await npmRegistryUtils.fetchTarballUrl(registry.package, version);
+        if (registry.bin) {
+          binPath = registry.bin;
+        }
       } else {
         url = url.replace(
           npmRegistryUtils.DEFAULT_NPM_REGISTRY_URL,
@@ -176,33 +245,9 @@ export async function installVersion(installTarget: string, locator: Locator, {s
     url = decodeURIComponent(version);
   }
 
-  // Creating a temporary folder inside the install folder means that we
-  // are sure it'll be in the same drive as the destination, so we can
-  // just move it there atomically once we are done
-
-  const tmpFolder = folderUtils.getTemporaryFolder(installTarget);
-  debugUtils.log(`Installing ${locator.name}@${version} from ${url} to ${tmpFolder}`);
-  const stream = await httpUtils.fetchUrlStream(url);
-
-  const parsedUrl = new URL(url);
-  const ext = path.posix.extname(parsedUrl.pathname);
-
-  let outputFile: string | null = null;
-
-  let sendTo: any;
-  if (ext === `.tgz`) {
-    const {default: tar} = await import(`tar`);
-    sendTo = tar.x({strip: 1, cwd: tmpFolder});
-  } else if (ext === `.js`) {
-    outputFile = path.join(tmpFolder, path.posix.basename(parsedUrl.pathname));
-    sendTo = fs.createWriteStream(outputFile);
-  }
-
-  stream.pipe(sendTo);
-
+  debugUtils.log(`Installing ${locator.name}@${version} from ${url}`);
   const algo = build[0] ?? `sha256`;
-  const hash = stream.pipe(createHash(algo));
-  await once(sendTo, `finish`);
+  const {tmpFolder, outputFile, hash: actualHash} = await download(installTarget, url, algo, binPath);
 
   let bin: BinSpec | BinList;
   const isSingleFile = outputFile !== null;
@@ -234,7 +279,6 @@ export async function installVersion(installTarget: string, locator: Locator, {s
     }
   }
 
-  const actualHash = hash.digest(`hex`);
   if (build[1] && actualHash !== build[1])
     throw new Error(`Mismatch hashes. Expected ${build[1]}, got ${actualHash}`);
 
@@ -299,6 +343,14 @@ export async function installVersion(installTarget: string, locator: Locator, {s
   };
 }
 
+async function rename(oldPath: fs.PathLike, newPath: fs.PathLike) {
+  if (process.platform === `win32`) {
+    await renameUnderWindows(oldPath, newPath);
+  } else {
+    await fs.promises.rename(oldPath, newPath);
+  }
+}
+
 async function renameUnderWindows(oldPath: fs.PathLike, newPath: fs.PathLike) {
   // Windows malicious file analysis blocks files currently under analysis, so we need to wait for file release
   const retries = 5;

sources/types.ts

@@ -25,6 +25,7 @@ export function isSupportedPackageManager(value: string): value is SupportedPack
 export interface NpmRegistrySpec {
   type: `npm`;
   package: string;
+  bin?: string;
 }
 
 export interface UrlRegistrySpec {
@@ -59,6 +60,12 @@ export interface InstallSpec {
   hash: string;
 }
 
+export interface DownloadSpec {
+  tmpFolder: string;
+  outputFile: string | null;
+  hash: string;
+}
+
 /**
  * The data structure found in config.json
  */