shrinkwrap: update packageIntegrity for spec compliance

3 files changed, 54 insertions, 8 deletions

diff --git a/test/tap/shrinkwrap-empty-deps.js b/test/tap/shrinkwrap-empty-deps.js
index c4c218850..f2761a19b 100644
--- a/test/tap/shrinkwrap-empty-deps.js
+++ b/test/tap/shrinkwrap-empty-deps.js
@@ -7,8 +7,8 @@ const mr = require('npm-registry-mock')
 const npm = require('../../lib/npm.js')
 const osenv = require('osenv')
 const path = require('path')
+const pkgSri = require('../../lib/utils/package-integrity.js')
 const rimraf = require('rimraf')
-const ssri = require('ssri')
 const test = require('tap').test
 
 const pkg = path.resolve(__dirname, 'shrinkwrap-empty-deps')
@@ -56,9 +56,7 @@ test('returns a list of removed items', function (t) {
               'version': '0.0.0',
               'createdWith': `npm@${npm.version}`,
               'lockfileVersion': npm.lockfileVersion,
-              'packageIntegrity': ssri.fromData(JSON.stringify(json, null, 2), {
-                algorithms: ['sha512']
-              }).toString()
+              'packageIntegrity': pkgSri.hash(json)
             },
             JSON.parse(desired),
             'shrinkwrap handled empty deps without exploding'
diff --git a/test/tap/shrinkwrap-extra-metadata.js b/test/tap/shrinkwrap-extra-metadata.js
index 011f7a7a5..5c40faf5c 100644
--- a/test/tap/shrinkwrap-extra-metadata.js
+++ b/test/tap/shrinkwrap-extra-metadata.js
@@ -7,8 +7,8 @@ const mr = require('npm-registry-mock')
 const npm = require('../../lib/npm.js')
 const osenv = require('osenv')
 const path = require('path')
+const pkgSri = require('../../lib/utils/package-integrity.js')
 const rimraf = require('rimraf')
-const ssri = require('ssri')
 const test = require('tap').test
 
 const pkg = path.join(__dirname, path.basename(__filename, '.js'))
@@ -54,9 +54,7 @@ test('adds additional metadata fields from the pkglock spec', function (t) {
               'version': '0.0.0',
               'createdWith': `npm@${npm.version}`,
               'lockfileVersion': npm.lockfileVersion,
-              'packageIntegrity': ssri.fromData(JSON.stringify(json, null, 2), {
-                algorithms: ['sha512']
-              }).toString()
+              'packageIntegrity': pkgSri.hash(json)
             },
             JSON.parse(desired),
             'shrinkwrap wrote the expected metadata fields'
diff --git a/test/tap/shrinkwrap-package-integrity.js b/test/tap/shrinkwrap-package-integrity.js
new file mode 100644
index 000000000..6333757d7
--- /dev/null
+++ b/test/tap/shrinkwrap-package-integrity.js
@@ -0,0 +1,50 @@
+'use strict'
+
+const pkgsri = require('../../lib/utils/package-integrity.js')
+const ssri = require('ssri')
+const test = require('tap').test
+
+test('generates integrity according to spec', (t) => {
+  const pkgJson = {
+    'name': 'foo',
+    'version': '1.0.0',
+    'dependencies': {
+      'x': '1.0.0'
+    },
+    'devDependencies': {
+      'y': '1.0.0'
+    },
+    'optionalDependencies': {
+      'z': '1.0.0'
+    }
+  }
+  const integrity = pkgsri.hash(pkgJson)
+  t.ok(integrity && integrity.toString(), 'hash returned')
+  t.equal(
+    ssri.parse(integrity).toString(),
+    integrity,
+    'hash is a valid ssri string'
+  )
+  t.ok(pkgsri.check(pkgJson, integrity), 'same-data integrity check succeeds')
+  t.done()
+})
+
+test('updates if anything changes in package.json', (t) => {
+  const pkgJson = {
+    'name': 'foo',
+    'version': '1.0.0',
+    'dependencies': {
+      'x': '1.0.0'
+    },
+    'devDependencies': {
+      'y': '1.0.0'
+    },
+    'optionalDependencies': {
+      'z': '1.0.0'
+    }
+  }
+  const sri = pkgsri.hash(pkgJson)
+  pkgJson.version = '1.2.3'
+  t.equal(pkgsri.check(pkgJson, sri), false, 'no match after pkgJson change')
+  t.done()
+})