load TUF seeds via require not require.resolve (#1014)

Signed-off-by: Brian DeHamer <bdehamer@github.com>
sigstore · Feb 15, 2024 · d40c443 · d40c443
1 parent 1e50cf6
commit d40c443
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/.changeset/lovely-waves-hug.md b/.changeset/lovely-waves-hug.md
@@ -0,0 +1,5 @@
+---
+"@sigstore/tuf": patch
+---
+
+Load TUF seeds via `require` instead of `require.resolve`
diff --git a/packages/tuf/src/client.ts b/packages/tuf/src/client.ts
@@ -23,7 +23,6 @@ import type { MakeFetchHappenOptions } from 'make-fetch-happen';
 
 export type Retry = MakeFetchHappenOptions['retry'];
 
-const TUF_SEEDS_PATH = require.resolve('../seeds.json');
 const TARGETS_DIR_NAME = 'targets';
 
 type RepoSeed = {
@@ -125,10 +124,8 @@ function seedCache({
     if (tufRootPath) {
       fs.copyFileSync(tufRootPath, cachedRootPath);
     } else {
-      // Load the embedded repo seeds
-      const seeds: RepoSeeds = JSON.parse(
-        fs.readFileSync(TUF_SEEDS_PATH).toString('utf-8')
-      );
+      /* eslint-disable @typescript-eslint/no-var-requires */
+      const seeds: RepoSeeds = require('../seeds.json');
       const repoSeed = seeds[mirrorURL];
 
       if (!repoSeed) {