6 files changed, 32 insertions, 77 deletions
diff --git a/deps/npm/node_modules/cacache/lib/content/write.js b/deps/npm/node_modules/cacache/lib/content/write.js
index d799ae8837..b6f5c5623b 100644
--- a/deps/npm/node_modules/cacache/lib/content/write.js
+++ b/deps/npm/node_modules/cacache/lib/content/write.js
@@ -4,8 +4,8 @@ const events = require('events')
 
 const contentPath = require('./path')
 const fs = require('fs/promises')
-const moveFile = require('../util/move-file')
-const Minipass = require('minipass')
+const { moveFile } = require('@npmcli/fs')
+const { Minipass } = require('minipass')
 const Pipeline = require('minipass-pipeline')
 const Flush = require('minipass-flush')
 const path = require('path')
@@ -17,9 +17,6 @@ module.exports = write
 
 async function write (cache, data, opts = {}) {
   const { algorithms, size, integrity } = opts
-  if (algorithms && algorithms.length > 1) {
-    throw new Error('opts.algorithms only supports a single algorithm for now')
-  }
 
   if (typeof size === 'number' && data.length !== size) {
     throw sizeError(size, data.length)
@@ -30,16 +27,19 @@ async function write (cache, data, opts = {}) {
     throw checksumError(integrity, sri)
   }
 
-  const tmp = await makeTmp(cache, opts)
-  try {
-    await fs.writeFile(tmp.target, data, { flag: 'wx' })
-    await moveToDestination(tmp, cache, sri, opts)
-    return { integrity: sri, size: data.length }
-  } finally {
-    if (!tmp.moved) {
-      await fs.rm(tmp.target, { recursive: true, force: true })
+  for (const algo in sri) {
+    const tmp = await makeTmp(cache, opts)
+    const hash = sri[algo].toString()
+    try {
+      await fs.writeFile(tmp.target, data, { flag: 'wx' })
+      await moveToDestination(tmp, cache, hash, opts)
+    } finally {
+      if (!tmp.moved) {
+        await fs.rm(tmp.target, { recursive: true, force: true })
+      }
     }
   }
+  return { integrity: sri, size: data.length }
 }
 
 module.exports.stream = writeStream
@@ -161,8 +161,14 @@ async function moveToDestination (tmp, cache, sri, opts) {
   const destDir = path.dirname(destination)
 
   await fs.mkdir(destDir, { recursive: true })
-  await moveFile(tmp.target, destination)
-  tmp.moved = true
+  try {
+    await moveFile(tmp.target, destination, { overwrite: false })
+    tmp.moved = true
+  } catch (err) {
+    if (!err.message.startsWith('The destination file exists')) {
+      throw Object.assign(err, { code: 'EEXIST' })
+    }
+  }
 }
 
 function sizeError (expected, found) {
diff --git a/deps/npm/node_modules/cacache/lib/entry-index.js b/deps/npm/node_modules/cacache/lib/entry-index.js
index add15e3a22..722a37af5c 100644
--- a/deps/npm/node_modules/cacache/lib/entry-index.js
+++ b/deps/npm/node_modules/cacache/lib/entry-index.js
@@ -9,7 +9,7 @@ const {
   rm,
   writeFile,
 } = require('fs/promises')
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 const path = require('path')
 const ssri = require('ssri')
 const uniqueFilename = require('unique-filename')
@@ -109,12 +109,12 @@ async function compact (cache, key, matchFn, opts = {}) {
 module.exports.insert = insert
 
 async function insert (cache, key, integrity, opts = {}) {
-  const { metadata, size } = opts
+  const { metadata, size, time } = opts
   const bucket = bucketPath(cache, key)
   const entry = {
     key,
     integrity: integrity && ssri.stringify(integrity),
-    time: Date.now(),
+    time: time || Date.now(),
     size,
     metadata,
   }
diff --git a/deps/npm/node_modules/cacache/lib/get.js b/deps/npm/node_modules/cacache/lib/get.js
index 272ddb6292..80ec206c7e 100644
--- a/deps/npm/node_modules/cacache/lib/get.js
+++ b/deps/npm/node_modules/cacache/lib/get.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const Collect = require('minipass-collect')
-const Minipass = require('minipass')
+const { Minipass } = require('minipass')
 const Pipeline = require('minipass-pipeline')
 
 const index = require('./entry-index')
diff --git a/deps/npm/node_modules/cacache/lib/util/glob.js b/deps/npm/node_modules/cacache/lib/util/glob.js
index 38b5459c59..3132a4da65 100644
--- a/deps/npm/node_modules/cacache/lib/util/glob.js
+++ b/deps/npm/node_modules/cacache/lib/util/glob.js
@@ -1,6 +1,6 @@
 'use strict'
 
-const glob = require('glob')
+const { glob } = require('glob')
 
 const globify = (pattern) => pattern.split('//').join('/')
 module.exports = (path, options) => glob(globify(path), options)
diff --git a/deps/npm/node_modules/cacache/lib/util/move-file.js b/deps/npm/node_modules/cacache/lib/util/move-file.js
deleted file mode 100644
index eb3ba76107..0000000000
--- a/deps/npm/node_modules/cacache/lib/util/move-file.js
+++ /dev/null
@@ -1,56 +0,0 @@
-'use strict'
-
-const fs = require('fs/promises')
-const { moveFile: move } = require('@npmcli/fs')
-const pinflight = require('promise-inflight')
-
-module.exports = moveFile
-
-async function moveFile (src, dest) {
-  const isWindows = process.platform === 'win32'
-
-  // This isn't quite an fs.rename -- the assumption is that
-  // if `dest` already exists, and we get certain errors while
-  // trying to move it, we should just not bother.
-  //
-  // In the case of cache corruption, users will receive an
-  // EINTEGRITY error elsewhere, and can remove the offending
-  // content their own way.
-  //
-  // Note that, as the name suggests, this strictly only supports file moves.
-  try {
-    await fs.link(src, dest)
-  } catch (err) {
-    if (isWindows && err.code === 'EPERM') {
-      // XXX This is a really weird way to handle this situation, as it
-      // results in the src file being deleted even though the dest
-      // might not exist.  Since we pretty much always write files to
-      // deterministic locations based on content hash, this is likely
-      // ok (or at worst, just ends in a future cache miss).  But it would
-      // be worth investigating at some time in the future if this is
-      // really what we want to do here.
-    } else if (err.code === 'EEXIST' || err.code === 'EBUSY') {
-      // file already exists, so whatever
-    } else {
-      throw err
-    }
-  }
-  try {
-    await Promise.all([
-      fs.unlink(src),
-      !isWindows && fs.chmod(dest, '0444'),
-    ])
-  } catch (e) {
-    return pinflight('cacache-move-file:' + dest, async () => {
-      await fs.stat(dest).catch((err) => {
-        if (err.code !== 'ENOENT') {
-          // Something else is wrong here. Bail bail bail
-          throw err
-        }
-      })
-      // file doesn't already exist! let's try a rename -> copy fallback
-      // only delete if it successfully copies
-      return move(src, dest)
-    })
-  }
-}
diff --git a/deps/npm/node_modules/cacache/lib/verify.js b/deps/npm/node_modules/cacache/lib/verify.js
index 33f566c12a..62e85c9464 100644
--- a/deps/npm/node_modules/cacache/lib/verify.js
+++ b/deps/npm/node_modules/cacache/lib/verify.js
@@ -100,7 +100,11 @@ async function garbageCollect (cache, opts) {
       return
     }
 
-    liveContent.add(entry.integrity.toString())
+    // integrity is stringified, re-parse it so we can get each hash
+    const integrity = ssri.parse(entry.integrity)
+    for (const algo in integrity) {
+      liveContent.add(integrity[algo].toString())
+    }
   })
   await new Promise((resolve, reject) => {
     indexStream.on('end', resolve).on('error', reject)
@@ -220,6 +224,7 @@ async function rebuildBucket (cache, bucket, stats, opts) {
       await index.insert(cache, entry.key, entry.integrity, {
         metadata: entry.metadata,
         size: entry.size,
+        time: entry.time,
       })
       stats.totalEntries++
     } catch (err) {