PeculiarVentures / attestation / 40665116110

60%

push

github

build: mark the libraries as side-effect free (#33)

common, marvell and yubico get "sideEffects": false. No module registers
state at import time: the only module-level work is the bundled root
certificates (new X509Certificate(...)) in certs.js, which the importing
modules use; Marvell resolves x509's algorithm provider from the tsyringe
container at call time and registers nothing itself. common's build is
type-only. The CLI keeps the default: its only module is the executable.

Checked with the packed tarballs (rolldown 1.2.15, esbuild 0.28.2, webpack
5.112.2, platform/target node, graphene-pk11 external), running every
bundle. Entry A imports only MarvellAttestationProvider, reads the fixture
evidence and verifies it with the generic and Google Cloud HSM profiles:
both pass with false, true and no sideEffects, and the size does not
change (464/499/581 KB), since the provider reaches every Marvell module.
Entry B constructs PivAttestationProvider: with false all three bundlers
drop the PKCS#11 token manager and its `graphene-pk11` import, which loads
the native pkcs11js addon at startup; with true or no field the import
stays in all three bundles (webpack also keeps PivTokenManager).

273 of 424 branches covered (64.39%)

Branch coverage included in aggregate %.

466 of 803 relevant lines covered (58.03%)

492.89 hits per line