Verify integrity of dependencies in production with yarn

After https://github.com/mozilla/addons-frontend/issues/1391 we will be using yarn to install dependencies in production.

Let’s make sure all packages get installed without any surprises.

• A production install should never upgrade a package or its dependencies, even if a sub-dependency is declared with a loose version range. Please see this detailed example of what we should prevent.
• Verify the integrity of all packages. If one gets tampered with, the install step should fail. (Does yarn already do this by default? Maybe we need yarn check)

This issue is about preventing malware on NPM from creeping into a production build (see the eslint malware scenario as an example). It would still be possible for a developer to unknowingly introduce malware when upgrading a dependency – that problem is out of scope.

[kumar303]

Sorry if the requirements of this issue were vague. It was also confusing because it made some assumptions about yarn.lock that were untrue. I updated the description to better illustrate what I originally intended.

[willdurand]

I am closing this issue now that it has been verified.

If you want to verify it:

1. clone the demo project:

git clone https://github.com/willdurand/pkg-app

1. install the deps:

yarn install

1. run the script:

node index.js

If you remove the yarn.lock file and re-install the dependencies (yarn install), you’ll see an update of the sub-dependency (pkg-001). You can see the update by running node index.js again.

If you discard your changes (git checkout -- .), and re-install the deps, it will be back to the state at (3).