Change npm's lockfile registry URLs back to https:// after a wrapped run

core/src/aliasing/managers/bun.rs

@@ -11,4 +11,5 @@ pub static BUN: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
+    lockfile: None,
 };

core/src/aliasing/managers/cargo.rs

@@ -17,4 +17,5 @@ pub static CARGO: Manager = Manager {
             "source.firewall.registry=\"sparse+http://index.crates.io/\"",
         ],
     }],
+    lockfile: None,
 };

core/src/aliasing/managers/gem.rs

@@ -8,4 +8,5 @@ pub static GEM: Manager = Manager {
         when: &["install", "update", "fetch"],
         flags: &["--clear-sources", "--source", "http://rubygems.org/"],
     }],
+    lockfile: None,
 };

core/src/aliasing/managers/go.rs

@@ -11,4 +11,5 @@ pub static GO: Manager = Manager {
         ("GOFLAGS", "-mod=mod"),
     ],
     args: &[],
+    lockfile: None,
 };

core/src/aliasing/managers/mod.rs

@@ -36,6 +36,14 @@ pub struct Manager {
     pub command: &'static str,
     pub env: &'static [(&'static str, &'static str)],
     pub args: &'static [Args],
+    /// Where the manager records registry URLs, which then carry our http:// override.
+    pub lockfile: Option<Lockfile>,
+}
+
+/// What to do after a run about http:// registry URLs left in the lockfile at this path.
+pub enum Lockfile {
+    Restore(&'static str),
+    Warn(&'static str),
 }
 
 pub static MANAGERS: &[&Manager] =

core/src/aliasing/managers/npm.rs

@@ -1,4 +1,4 @@
-use super::{Manager, PROXY};
+use super::{Lockfile, Manager, PROXY};
 
 pub static NPM: Manager = Manager {
     command: "npm",
@@ -8,4 +8,5 @@ pub static NPM: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
+    lockfile: Some(Lockfile::Restore("package-lock.json")),
 };

core/src/aliasing/managers/pdm.rs

@@ -13,4 +13,5 @@ pub static PDM: Manager = Manager {
         ("PDM_PYPI_VERIFY_SSL", "false"),
     ],
     args: &[],
+    lockfile: None,
 };

core/src/aliasing/managers/pip.rs

@@ -12,5 +12,5 @@ pub static PIP: Manager = recipe("pip");
 pub static PIP3: Manager = recipe("pip3");
 
 const fn recipe(name: &'static str) -> Manager {
-    Manager { command: name, env: PIP_ENV, args: &[] }
+    Manager { command: name, env: PIP_ENV, args: &[], lockfile: None }
 }

core/src/aliasing/managers/pipenv.rs

@@ -13,4 +13,5 @@ pub static PIPENV: Manager = Manager {
         ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
+    lockfile: None,
 };

core/src/aliasing/managers/pnpm.rs

@@ -9,4 +9,5 @@ pub static PNPM: Manager = Manager {
         ("pnpm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
+    lockfile: None,
 };

core/src/aliasing/managers/uv.rs

@@ -1,7 +1,8 @@
-use super::{Manager, PROXY, PYPI_SIMPLE};
+use super::{Lockfile, Manager, PROXY, PYPI_SIMPLE};
 
 pub static UV: Manager = Manager {
     command: "uv",
     env: &[("HTTP_PROXY", PROXY), ("http_proxy", PROXY), ("UV_DEFAULT_INDEX", PYPI_SIMPLE)],
     args: &[],
+    lockfile: Some(Lockfile::Warn("uv.lock")),
 };

core/src/aliasing/mod.rs

@@ -6,9 +6,11 @@ mod windows;
 pub use forward::spawn;
 pub use managers::*;
 
+use crate::policies::registries::BUILT_IN;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 use std::process::Command;
+use tracing::{info, warn};
 
 pub struct Invocation {
     pub program: String,
@@ -50,10 +52,42 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     let status = command.status();
     #[cfg(windows)]
     let status = status.map_err(|error| windows::explain(error, &program));
-    Ok(status?.code().unwrap_or(1))
+    let code = status?.code().unwrap_or(1);
+    let manager = MANAGERS.iter().find(|manager| manager.command == invocation.program);
+    match manager.and_then(|manager| manager.lockfile.as_ref()) {
+        Some(Lockfile::Restore(lockfile)) => restore_https(lockfile, dir),
+        Some(Lockfile::Warn(lockfile)) => warn_if_plaintext(lockfile, dir),
+        None => {}
+    }
+    Ok(code)
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.
 fn resolve(program: &str) -> std::io::Result<PathBuf> {
     which::which(program).map_err(|e| Error::new(ErrorKind::NotFound, e))
 }
+
+fn warn_if_plaintext(lockfile: &str, dir: Option<&Path>) {
+    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
+    let Ok(text) = std::fs::read_to_string(path) else { return };
+    if BUILT_IN.iter().any(|registry| text.contains(&format!("http://{}/", registry.host()))) {
+        warn!("{lockfile} has http:// registry URLs; change them to https:// before committing");
+    }
+}
+
+fn restore_https(lockfile: &str, dir: Option<&Path>) {
+    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
+    let Ok(text) = std::fs::read_to_string(&path) else { return };
+    let mut fixed = text.clone();
+    for registry in BUILT_IN {
+        let host = registry.host();
+        fixed = fixed.replace(&format!("http://{host}/"), &format!("https://{host}/"));
+    }
+    if fixed == text {
+        return;
+    }
+    match std::fs::write(&path, fixed) {
+        Ok(()) => info!("changed {lockfile}'s registry URLs back to https://"),
+        Err(e) => warn!("could not change {lockfile}'s registry URLs back to https://: {e}"),
+    }
+}