Lavamoat build system integration for WebApp (#12242)

* lavamoat - add lavamoat to webapp background * test:e2e - add delay to resolve failure * test:e2e - add delay to resolve failure * build - add a switch for applying lavamoat, currently off for all * test/e2e - remove delays added for lavamoat * Revert "test/e2e - remove delays added for lavamoat" This reverts commit 79c3479f15c072ed362ba1d4f1af41ea11a17d63.
2024-10-22 11:22:43 +02:00 · 2021-10-05 12:06:31 -10:00 · 2021-10-05 12:06:31 -10:00 · cb174ff8e6
commit cb174ff8e6
parent 3985a65e36
12 changed files with 5006 additions and 62 deletions
--- a/app/background.html
+++ b/app/background.html
@ -6,12 +6,18 @@
  <body>
    <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
    <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{@if(it.useLavamoat)}}
+      <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>
+    {{#else}}
+      <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{/if}}
    {{@each(it.jsBundles) => val}}
-    <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
+      <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
    {{/each}}
    <script src="./chromereload.js" type="text/javascript" charset="utf-8"></script>
  </body>
--- a/app/home.html
+++ b/app/home.html
@ -12,12 +12,18 @@
    <div id="popover-content"></div>
    <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
    <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{@if(it.useLavamoat)}}
+      <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>
+    {{#else}}
+      <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{/if}}
    {{@each(it.jsBundles) => val}}
-    <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
+      <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
    {{/each}}
  </body>
 </html>
--- a/app/notification.html
+++ b/app/notification.html
@ -35,12 +35,18 @@
    <div id="popover-content"></div>
    <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
    <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{@if(it.useLavamoat)}}
+      <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>
+    {{#else}}
+      <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{/if}}
    {{@each(it.jsBundles) => val}}
-    <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
+      <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
    {{/each}}
  </body>
 </html>
--- a/app/popup.html
+++ b/app/popup.html
@ -12,12 +12,18 @@
    <div id="popover-content"></div>
    <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
    <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
-    <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{@if(it.useLavamoat)}}
+      <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>
+    {{#else}}
+      <script src="./lockdown-install.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-run.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
+      <script src="./runtime-cjs.js" type="text/javascript" charset="utf-8"></script>
+    {{/if}}
    {{@each(it.jsBundles) => val}}
-    <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
+      <script src="{{val}}" type="text/javascript" charset="utf-8"></script>
    {{/each}}
  </body>
 </html>
--- a/development/build/scripts.js
+++ b/development/build/scripts.js
@ -4,6 +4,7 @@ const { writeFileSync, readFileSync } = require('fs');
 const EventEmitter = require('events');
 const gulp = require('gulp');
 const watch = require('gulp-watch');
+const Vinyl = require('vinyl');
 const source = require('vinyl-source-stream');
 const buffer = require('vinyl-buffer');
 const log = require('fancy-log');
@ -20,7 +21,8 @@ const endOfStream = pify(require('end-of-stream'));
 const labeledStreamSplicer = require('labeled-stream-splicer').obj;
 const wrapInStream = require('pumpify').obj;
 const Sqrl = require('squirrelly');
-const lavaPack = require('@lavamoat/lavapack');
+const lavapack = require('@lavamoat/lavapack');
+const lavamoatBrowserify = require('lavamoat-browserify');
 const terser = require('terser');

 const bifyModuleGroups = require('bify-module-groups');
@ -260,7 +262,22 @@ function createFactoredBuild({
    // set bundle entries
    bundlerOpts.entries = [...entryFiles];

+    // setup lavamoat
+    // lavamoat will add lavapack but it will be removed by bify-module-groups
+    // we will re-add it later by installing a lavapack runtime
+    const lavamoatOpts = {
+      policy: path.resolve(__dirname, '../../lavamoat/browserify/policy.json'),
+      policyOverride: path.resolve(
+        __dirname,
+        '../../lavamoat/browserify/policy-override.json',
+      ),
+      writeAutoPolicy: process.env.WRITE_AUTO_POLICY,
+    };
+    Object.assign(bundlerOpts, lavamoatBrowserify.args);
+    bundlerOpts.plugin.push([lavamoatBrowserify, lavamoatOpts]);
+
    // setup bundle factoring with bify-module-groups plugin
+    // note: this will remove lavapack, but its ok bc we manually readd it later
    Object.assign(bundlerOpts, bifyModuleGroups.plugin.args);
    bundlerOpts.plugin = [...bundlerOpts.plugin, [bifyModuleGroups.plugin]];

@ -282,18 +299,24 @@ function createFactoredBuild({
          groupingMap: sizeGroupMap,
        }),
      );
-      pipeline.get('vinyl').unshift(
-        // convert each module group into a stream with a single vinyl file
-        streamFlatMap((moduleGroup) => {
-          const filename = `${moduleGroup.label}.js`;
-          const childStream = wrapInStream(
-            moduleGroup.stream,
-            lavaPack({ raw: true, hasExports: true, includePrelude: false }),
-            source(filename),
-          );
-          return childStream;
+      // converts each module group into a single vinyl file containing its bundle
+      const moduleGroupPackerStream = streamFlatMap((moduleGroup) => {
+        const filename = `${moduleGroup.label}.js`;
+        const childStream = wrapInStream(
+          moduleGroup.stream,
+          // we manually readd lavapack here bc bify-module-groups removes it
+          lavapack({ raw: true, hasExports: true, includePrelude: false }),
+          source(filename),
+        );
+        return childStream;
+      });
+      pipeline.get('vinyl').unshift(moduleGroupPackerStream, buffer());
+      // add lavamoat policy loader file to packer output
+      moduleGroupPackerStream.push(
+        new Vinyl({
+          path: 'policy-load.js',
+          contents: lavapack.makePolicyLoaderStream(lavamoatOpts),
        }),
-        buffer(),
      );
      // setup bundle destination
      browserPlatforms.forEach((platform) => {
@ -307,36 +330,58 @@ function createFactoredBuild({
      const commonSet = sizeGroupMap.get('common');
      // create entry points for each file
      for (const [groupLabel, groupSet] of sizeGroupMap.entries()) {
-        // skip "common" group, they are added tp all other groups
+        // skip "common" group, they are added to all other groups
        if (groupSet === commonSet) continue;

        switch (groupLabel) {
          case 'ui': {
-            renderHtmlFile('popup', groupSet, commonSet, browserPlatforms);
-            renderHtmlFile(
-              'notification',
+            renderHtmlFile({
+              htmlName: 'popup',
              groupSet,
              commonSet,
              browserPlatforms,
-            );
-            renderHtmlFile('home', groupSet, commonSet, browserPlatforms);
+              useLavamoat: false,
+            });
+            renderHtmlFile({
+              htmlName: 'notification',
+              groupSet,
+              commonSet,
+              browserPlatforms,
+              useLavamoat: false,
+            });
+            renderHtmlFile({
+              htmlName: 'home',
+              groupSet,
+              commonSet,
+              browserPlatforms,
+              useLavamoat: false,
+            });
            break;
          }
          case 'background': {
-            renderHtmlFile('background', groupSet, commonSet, browserPlatforms);
-            break;
-          }
-          case 'content-script': {
-            renderHtmlFile(
-              'trezor-usb-permissions',
+            renderHtmlFile({
+              htmlName: 'background',
              groupSet,
              commonSet,
              browserPlatforms,
-            );
+              useLavamoat: false,
+            });
+            break;
+          }
+          case 'content-script': {
+            renderHtmlFile({
+              htmlName: 'trezor-usb-permissions',
+              groupSet,
+              commonSet,
+              browserPlatforms,
+              useLavamoat: false,
+            });
            break;
          }
          default: {
-            throw new Error(`buildsys - unknown groupLabel "${groupLabel}"`);
+            throw new Error(
+              `build/scripts - unknown groupLabel "${groupLabel}"`,
+            );
          }
        }
      }
@ -637,13 +682,24 @@ function getEnvironment({ devMode, testing }) {
  return 'other';
 }

-function renderHtmlFile(htmlName, groupSet, commonSet, browserPlatforms) {
+function renderHtmlFile({
+  htmlName,
+  groupSet,
+  commonSet,
+  browserPlatforms,
+  useLavamoat,
+}) {
+  if (useLavamoat === undefined) {
+    throw new Error(
+      'build/scripts/renderHtmlFile - must specify "useLavamoat" option',
+    );
+  }
  const htmlFilePath = `./app/${htmlName}.html`;
  const htmlTemplate = readFileSync(htmlFilePath, 'utf8');
  const jsBundles = [...commonSet.values(), ...groupSet.values()].map(
    (label) => `./${label}.js`,
  );
-  const htmlOutput = Sqrl.render(htmlTemplate, { jsBundles });
+  const htmlOutput = Sqrl.render(htmlTemplate, { jsBundles, useLavamoat });
  browserPlatforms.forEach((platform) => {
    const dest = `./dist/${platform}/${htmlName}.html`;
    // we dont have a way of creating async events atm
--- a/development/build/static.js
+++ b/development/build/static.js
@ -159,6 +159,11 @@ function getCopyTargets(shouldIncludeLockdown) {
      src: require.resolve('@lavamoat/lavapack/src/runtime-cjs.js'),
      dest: `runtime-cjs.js`,
    },
+    {
+      // eslint-disable-next-line node/no-extraneous-require
+      src: require.resolve('@lavamoat/lavapack/src/runtime.js'),
+      dest: `runtime-lavamoat.js`,
+    },
    {
      src: `./app/phishing.html`,
      dest: `phishing.html`,
--- a/lavamoat/browserify/policy-override.json
+++ b/lavamoat/browserify/policy-override.json
@ -0,0 +1,55 @@
+{
+  "resources": {
+    "browser-resolve": {
+      "packages": {
+        "core-js": true
+      }
+    },
+    "babel-runtime": {
+      "packages": {
+        "@babel/runtime": true
+      }
+    },
+    "node-fetch": {
+      "globals": {
+        "fetch": true
+      }
+    },
+    "lodash": {
+      "globals": {
+        "setTimeout": true,
+        "clearTimeout": true
+      }
+    },
+    "@ethersproject/random": {
+      "globals": {
+        "crypto.getRandomValues": true
+      }
+    },
+    "browser-passworder": {
+      "globals": {
+        "crypto": true
+      }
+    },
+    "randombytes": {
+      "globals": {
+        "crypto.getRandomValues": true
+      }
+    },
+    "extensionizer": {
+      "globals": {
+        "console": true
+      }
+    },
+    "web3": {
+      "globals": {
+        "XMLHttpRequest": true
+      }
+    },
+    "storage": {
+      "globals": {
+        "localStorage": true
+      }
+    }
+  }
+}
--- a/lavamoat/browserify/policy.json
+++ b/lavamoat/browserify/policy.json
--- a/lavamoat/node/policy.json
+++ b/lavamoat/node/policy.json
@ -840,18 +840,22 @@
      "builtin": {
        "assert": true,
        "buffer.Buffer.from": true,
+        "fs.readFileSync": true,
        "path.join": true,
        "path.relative": true
      },
      "globals": {
        "__dirname": true,
-        "process.cwd": true
+        "process.cwd": true,
+        "setTimeout": true
      },
      "packages": {
        "JSONStream": true,
        "combine-source-map": true,
        "convert-source-map": true,
        "json-stable-stringify": true,
+        "lavamoat-core": true,
+        "readable-stream": true,
        "through2": true,
        "umd": true
      }
@ -1398,6 +1402,15 @@
        "buffer.Buffer": true
      }
    },
+    "clone-deep": {
+      "packages": {
+        "for-own": true,
+        "is-plain-object": true,
+        "kind-of": true,
+        "lazy-cache": true,
+        "shallow-clone": true
+      }
+    },
    "clone-regexp": {
      "packages": {
        "is-regexp": true
@ -1456,6 +1469,7 @@
    "concat-stream": {
      "globals": {
        "Buffer.concat": true,
+        "Buffer.from": true,
        "Buffer.isBuffer": true
      },
      "packages": {
@ -2812,6 +2826,70 @@
        "es6-weak-map": true
      }
    },
+    "lavamoat-browserify": {
+      "builtin": {
+        "fs.existsSync": true,
+        "fs.mkdirSync": true,
+        "fs.readFileSync": true,
+        "fs.writeFileSync": true,
+        "path.dirname": true,
+        "path.extname": true,
+        "path.resolve": true,
+        "util.callbackify": true
+      },
+      "globals": {
+        "console.warn": true,
+        "process.cwd": true
+      },
+      "packages": {
+        "@lavamoat/lavapack": true,
+        "concat-stream": true,
+        "duplexify": true,
+        "json-stable-stringify": true,
+        "lavamoat-core": true,
+        "readable-stream": true,
+        "through2": true
+      }
+    },
+    "lavamoat-core": {
+      "builtin": {
+        "events": true,
+        "fs.existsSync": true,
+        "fs.readFileSync": true,
+        "module.createRequire": true,
+        "module.createRequireFromPath": true,
+        "path.extname": true,
+        "path.join": true,
+        "path.sep": true
+      },
+      "globals": {
+        "__dirname": true,
+        "console.warn": true,
+        "define": true
+      },
+      "packages": {
+        "fromentries": true,
+        "json-stable-stringify": true,
+        "lavamoat-tofu": true,
+        "merge-deep": true,
+        "resolve": true
+      }
+    },
+    "lavamoat-tofu": {
+      "globals": {
+        "console.log": true
+      },
+      "packages": {
+        "@babel/parser": true,
+        "@babel/traverse": true
+      }
+    },
+    "lazy-cache": {
+      "globals": {
+        "process.env.TRAVIS": true,
+        "process.env.UNLAZY": true
+      }
+    },
    "lazystream": {
      "builtin": {
        "util.inherits": true
@ -2928,6 +3006,13 @@
        "timers-ext": true
      }
    },
+    "merge-deep": {
+      "packages": {
+        "arr-union": true,
+        "clone-deep": true,
+        "kind-of": true
+      }
+    },
    "merge-source-map": {
      "packages": {
        "source-map": true
@ -2992,6 +3077,12 @@
        "is-extendable": true
      }
    },
+    "mixin-object": {
+      "packages": {
+        "for-in": true,
+        "is-extendable": true
+      }
+    },
    "mkdirp": {
      "builtin": {
        "fs": true,
@ -3734,6 +3825,14 @@
        "split-string": true
      }
    },
+    "shallow-clone": {
+      "packages": {
+        "is-extendable": true,
+        "kind-of": true,
+        "lazy-cache": true,
+        "mixin-object": true
+      }
+    },
    "shasum": {
      "builtin": {
        "buffer.Buffer.isBuffer": true,
--- a/package.json
+++ b/package.json
@ -64,8 +64,10 @@
    "storybook:deploy": "storybook-to-ghpages --existing-output-dir storybook-build --remote storybook --branch master",
    "update-changelog": "auto-changelog update",
    "generate:migration": "./development/generate-migration.sh",
-    "lavamoat:auto": "lavamoat ./development/build/index.js --writeAutoPolicy",
-    "lavamoat:debug:build": "lavamoat ./development/build/index.js --writeAutoPolicyDebug"
+    "lavamoat:build:auto": "lavamoat ./development/build/index.js --writeAutoPolicy",
+    "lavamoat:debug:build": "lavamoat ./development/build/index.js --writeAutoPolicyDebug",
+    "lavamoat:background:auto": "WRITE_AUTO_POLICY=1 yarn build prod",
+    "lavamoat:auto": "yarn lavamoat:build:auto && yarn lavamoat:background:auto"
  },
  "resolutions": {
    "**/regenerator-runtime": "^0.13.7",
@ -217,7 +219,7 @@
    "@babel/preset-react": "^7.0.0",
    "@babel/register": "^7.5.5",
    "@lavamoat/allow-scripts": "^1.0.6",
-    "@lavamoat/lavapack": "^1.0.4",
+    "@lavamoat/lavapack": "^2.0.3",
    "@metamask/auto-changelog": "^2.1.0",
    "@metamask/eslint-config": "^6.0.0",
    "@metamask/eslint-config-jest": "^6.0.0",
@ -288,6 +290,7 @@
    "jsdom": "^11.2.0",
    "koa": "^2.7.0",
    "lavamoat": "^5.3.4",
+    "lavamoat-browserify": "^14.0.3",
    "lavamoat-viz": "^6.0.9",
    "lockfile-lint": "^4.0.0",
    "loose-envify": "^1.4.0",
@ -323,6 +326,7 @@
    "terser": "^5.7.0",
    "through2": "^4.0.2",
    "ttest": "^2.1.1",
+    "vinyl": "^2.2.1",
    "vinyl-buffer": "^1.0.1",
    "vinyl-source-stream": "^2.0.0",
    "vinyl-sourcemaps-apply": "^0.2.1",
--- a/test/e2e/tests/contract-interactions.spec.js
+++ b/test/e2e/tests/contract-interactions.spec.js
@ -32,6 +32,7 @@ describe('Deploy contract and call contract methods', function () {
        await driver.openNewPage('http://127.0.0.1:8080/');
        await driver.clickElement({ text: 'Connect', tag: 'button' });
        await driver.waitUntilXWindowHandles(3);
+        await driver.delay(5000);
        windowHandles = await driver.getAllWindowHandles();
        extension = windowHandles[0];
        dapp = await driver.switchToWindowWithTitle(
@ -86,6 +87,7 @@ describe('Deploy contract and call contract methods', function () {
        await driver.switchToWindow(dapp);
        await driver.clickElement('#depositButton');
        await driver.waitUntilXWindowHandles(3);
+        await driver.delay(5000);
        windowHandles = await driver.getAllWindowHandles();
        await driver.switchToWindowWithTitle(
          'MetaMask Notification',
@ -111,11 +113,13 @@ describe('Deploy contract and call contract methods', function () {
        await driver.switchToWindow(dapp);
        await driver.clickElement('#withdrawButton');
        await driver.waitUntilXWindowHandles(3);
+        await driver.delay(5000);
        windowHandles = await driver.getAllWindowHandles();
        await driver.switchToWindowWithTitle(
          'MetaMask Notification',
          windowHandles,
        );
+        await driver.delay(regularDelayMs);
        await driver.clickElement({ text: 'Confirm', tag: 'button' });
        await driver.waitUntilXWindowHandles(2);
        await driver.switchToWindow(extension);
--- a/yarn.lock
+++ b/yarn.lock
@ -2639,15 +2639,16 @@
    semver "^7.3.4"
    yargs "^16.2.0"

-"@lavamoat/lavapack@^1.0.4":
-  version "1.0.4"
-  resolved "https://registry.yarnpkg.com/@lavamoat/lavapack/-/lavapack-1.0.4.tgz#e72d6b29fa70da8236a127c1d95cb581cda6941e"
-  integrity sha512-Zhcn+eJyHIS4AAmN9IIjs8WCh12Q7NpFXXz0pI3Y54uknTdx5TPlwr3ARKf0jEXDOWNok/TuK2uPld54BSG/FQ==
+"@lavamoat/lavapack@^2.0.3":
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/@lavamoat/lavapack/-/lavapack-2.0.3.tgz#d535e23b4e98d21ac7aad57ef5019e64f1701117"
+  integrity sha512-7gpFnNaB4P15YsLf9/6Rn5EGAAg8s5CyVUZWy8bFHT+KaLzcRnjsbr1H5VehZkpU2xT0jWYHo1Rii7WmGdLQxg==
  dependencies:
    JSONStream "^1.3.5"
    combine-source-map "^0.8.0"
    convert-source-map "^1.7.0"
    json-stable-stringify "^1.0.1"
+    lavamoat-core "^11.0.0"
    through2 "^4.0.2"
    umd "^3.0.3"

@ -8272,7 +8273,7 @@ clone@2.1.1:
  resolved "https://registry.yarnpkg.com/clone/-/clone-2.1.1.tgz#d217d1e961118e3ac9a4b8bba3285553bf647cdb"
  integrity sha1-0hfR6WERjjrJpLi7oyhVU79kfNs=

-clone@2.1.2, clone@^2.0.0, clone@^2.1.1:
+clone@2.1.2, clone@^2.0.0, clone@^2.1.1, clone@^2.1.2:
  version "2.1.2"
  resolved "https://registry.yarnpkg.com/clone/-/clone-2.1.2.tgz#1b7f4b9f591f1e8f83670401600345a02887435f"
  integrity sha1-G39Ln1kfHo+DZwQBYANFoCiHQ18=
@ -8523,7 +8524,7 @@ concat-stream@^1.5.0, concat-stream@^1.5.1, concat-stream@^1.5.2, concat-stream@
    readable-stream "^2.2.2"
    typedarray "^0.0.6"

-"concat-stream@github:hugomrdias/concat-stream#feat/smaller":
+concat-stream@^2.0.0, "concat-stream@github:hugomrdias/concat-stream#feat/smaller":
  version "2.0.0"
  resolved "https://codeload.github.com/hugomrdias/concat-stream/tar.gz/057bc7b5d6d8df26c8cf00a3f151b6721a0a8034"
  dependencies:
@ -8654,7 +8655,7 @@ convert-source-map@^0.3.3:
  resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-0.3.5.tgz#f1d802950af7dd2631a1febe0596550c86ab3190"
  integrity sha1-8dgClQr33SYxof6+BZZVDIarMZA=

-convert-source-map@^1.0.0:
+convert-source-map@^1.0.0, convert-source-map@^1.8.0:
  version "1.8.0"
  resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.8.0.tgz#f3373c32d21b4d780dd8004514684fb791ca4369"
  integrity sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==
@ -17407,6 +17408,27 @@ latest-version@^5.0.0:
  dependencies:
    package-json "^6.3.0"

+lavamoat-browserify@^14.0.3:
+  version "14.0.3"
+  resolved "https://registry.yarnpkg.com/lavamoat-browserify/-/lavamoat-browserify-14.0.3.tgz#1f179ec34f18a433f6c8348d5e271b6a8e58bc09"
+  integrity sha512-TFRW6BV1n980g6rcKq90rjYyIbGumATc/7y6//qRXXBUSxRKAvTmyzVE19kNS5xdhWPlneDddf+YOZLwI8n1Gw==
+  dependencies:
+    "@lavamoat/lavapack" "^2.0.3"
+    JSONStream "^1.3.5"
+    clone "^2.1.2"
+    concat-stream "^2.0.0"
+    convert-source-map "^1.8.0"
+    duplexify "^4.1.1"
+    json-stable-stringify "^1.0.1"
+    lavamoat-core "^11.0.0"
+    merge-deep "^3.0.2"
+    offset-sourcemap-lines "^1.0.1"
+    pify "^4.0.1"
+    readable-stream "^3.6.0"
+    safe-buffer "^5.1.2"
+    through2 "^3.0.0"
+    umd "^3.0.3"
+
 lavamoat-core@^10.0.1:
  version "10.0.1"
  resolved "https://registry.yarnpkg.com/lavamoat-core/-/lavamoat-core-10.0.1.tgz#155bb4a50ace2e624941f14ca87705b171f6bba9"
@ -20472,6 +20494,13 @@ observable-webworkers@^1.0.0:
  resolved "https://registry.yarnpkg.com/observable-webworkers/-/observable-webworkers-1.0.0.tgz#dcbd484a9644d512accc351962c6e710313fbb68"
  integrity sha512-+cECwCR8IEh8UY5nefQVLO9Cydqpk1izO+o7BABmKjXfJZyEOzBWY3ss5jbOPM6KmEa9aQExvAtTW6tVTOsNAQ==

+offset-sourcemap-lines@^1.0.1:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/offset-sourcemap-lines/-/offset-sourcemap-lines-1.0.1.tgz#5854dff74b73fc06efcb61d7b721a8113d99be92"
+  integrity sha1-WFTf90tz/Abvy2HXtyGoET2ZvpI=
+  dependencies:
+    source-map "^0.5.0"
+
 on-finished@^2.3.0, on-finished@~2.3.0:
  version "2.3.0"
  resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.3.0.tgz#20f1336481b083cd75337992a16971aa2d906947"
@ -27778,6 +27807,18 @@ vinyl@^2.0.0, vinyl@^2.1.0, vinyl@^2.2.0:
    remove-trailing-separator "^1.0.1"
    replace-ext "^1.0.0"

+vinyl@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/vinyl/-/vinyl-2.2.1.tgz#23cfb8bbab5ece3803aa2c0a1eb28af7cbba1974"
+  integrity sha512-LII3bXRFBZLlezoG5FfZVcXflZgWP/4dCwKtxd5ky9+LOtM4CS3bIRQsmR1KMnMW07jpE8fqR2lcxPZ+8sJIcw==
+  dependencies:
+    clone "^2.1.1"
+    clone-buffer "^1.0.0"
+    clone-stats "^1.0.0"
+    cloneable-readable "^1.0.0"
+    remove-trailing-separator "^1.0.1"
+    replace-ext "^1.0.0"
+
 vm-browserify@^1.0.0, vm-browserify@^1.0.1:
  version "1.1.2"
  resolved "https://registry.yarnpkg.com/vm-browserify/-/vm-browserify-1.1.2.tgz#78641c488b8e6ca91a75f511e7a3b32a86e5dda0"
@ -28899,9 +28940,9 @@ yauzl@2.10.0, yauzl@^2.10.0:
    fd-slicer "~1.1.0"

 yazl@^2.1.0:
-  version "2.5.1"
-  resolved "https://registry.yarnpkg.com/yazl/-/yazl-2.5.1.tgz#a3d65d3dd659a5b0937850e8609f22fffa2b5c35"
-  integrity sha512-phENi2PLiHnHb6QBVot+dJnaAZ0xosj7p3fWl+znIjBDlnMI2PsZCJZ306BPTFOaHf5qdDEI8x5qFrSOBN5vrw==
+  version "2.4.3"
+  resolved "https://registry.yarnpkg.com/yazl/-/yazl-2.4.3.tgz#ec26e5cc87d5601b9df8432dbdd3cd2e5173a071"
+  integrity sha1-7CblzIfVYBud+EMtvdPNLlFzoHE=
  dependencies:
    buffer-crc32 "~0.2.3"