@arcships/light-ocr-runtime 0.1.6 → 0.1.8

package/package.json

@@ -4,7 +4,7 @@
   },
   "description": "Model-free Node.js runtime for light-ocr",
   "engines": {
-    "node": "^22.0.0 || ^24.0.0"
+    "node": ">=22.0.0"
   },
   "exports": {
     ".": {
@@ -28,12 +28,14 @@
   "module": "./src/index.mjs",
   "name": "@arcships/light-ocr-runtime",
   "optionalDependencies": {
-    "@arcships/light-ocr-darwin-arm64": "0.5.6",
-    "@arcships/light-ocr-darwin-x64": "0.5.6",
-    "@arcships/light-ocr-linux-arm64-gnu": "0.5.6",
-    "@arcships/light-ocr-linux-x64-gnu": "0.5.6",
-    "@arcships/light-ocr-win32-arm64": "0.5.6",
-    "@arcships/light-ocr-win32-x64": "0.5.6"
+    "@arcships/light-ocr-darwin-arm64": "0.5.8",
+    "@arcships/light-ocr-darwin-x64": "0.5.8",
+    "@arcships/light-ocr-linux-arm64-gnu": "0.5.8",
+    "@arcships/light-ocr-linux-arm64-musl": "0.5.8",
+    "@arcships/light-ocr-linux-x64-gnu": "0.5.8",
+    "@arcships/light-ocr-linux-x64-musl": "0.5.8",
+    "@arcships/light-ocr-win32-arm64": "0.5.8",
+    "@arcships/light-ocr-win32-x64": "0.5.8"
   },
   "publishConfig": {
     "access": "public",
@@ -45,5 +47,5 @@
   },
   "type": "commonjs",
   "types": "./src/index.d.ts",
-  "version": "0.1.6"
+  "version": "0.1.8"
 }

package/src/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-const { loadNative } = require('./load-native.cjs');
+const { loadNative, platformIdentity } = require('./load-native.cjs');
 
 class OcrError extends Error {
   constructor(code, message, detail) {
@@ -174,4 +174,4 @@ async function createEngine(options) {
   }
 }
 
-module.exports = { createEngine, OcrError, loadNative };
+module.exports = { createEngine, OcrError, loadNative, platformIdentity };

package/src/index.d.ts

@@ -289,4 +289,15 @@ export interface DetectionResult {
   readonly timingUs: TimingUs;
 }
 
+/** Resolved host platform identity used to select the native package. */
+export interface PlatformIdentity {
+  readonly id: string;
+  readonly os: string;
+  readonly architecture: string;
+  /** Present for Linux hosts; `"glibc"` or `"musl"`. */
+  readonly libc?: 'glibc' | 'musl';
+}
+
+export function platformIdentity(): PlatformIdentity;
+
 export function createEngine(options: CreateEngineOptions): Promise<OcrEngine>;

package/src/index.mjs

@@ -2,3 +2,4 @@ import cjs from './index.cjs';
 
 export const createEngine = cjs.createEngine;
 export const OcrError = cjs.OcrError;
+export const platformIdentity = cjs.platformIdentity;

package/src/load-native.cjs

@@ -1,9 +1,101 @@
 'use strict';
 
+const { spawnSync } = require('node:child_process');
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
 
+// macOS-only integrity relaxation for downstream re-signing.
+//
+// macOS packaging pipelines re-sign the native payload with a Developer ID
+// (or ad-hoc) identity, and osx-sign rewrites the LC_CODE_SIGNATURE blob of
+// every Mach-O under Contents --force. That changes both file size and
+// sha256, so the strict descriptor comparison alone rejects otherwise intact
+// binaries. On macOS only, a Mach-O whose signature verifies AND whose
+// signing identity matches the host process is accepted as an equivalent
+// integrity proof: same TeamIdentifier as process.execPath, or both sides
+// ad-hoc signed. Ad-hoc signatures are reproducible by anyone, so this
+// relaxation stays macOS-only and documented; win32/linux payloads are never
+// re-signed and keep the strict bytes+sha256 gate.
+
+const MACHO_MAGIC = new Set([
+  0xfeedface, // 32-bit big-endian
+  0xcefaedfe, // 32-bit little-endian
+  0xfeedfacf, // 64-bit big-endian
+  0xcffaedfe, // 64-bit little-endian
+  0xcafebabe, // universal (fat) big-endian
+  0xbebafeca, // universal (fat) little-endian
+]);
+
+function isMachO(filename) {
+  const fd = fs.openSync(filename, 'r');
+  try {
+    const magic = Buffer.allocUnsafe(4);
+    if (fs.readSync(fd, magic, 0, 4, 0) !== 4) return false;
+    return MACHO_MAGIC.has(magic.readUInt32BE(0));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function codesignOutput(filename) {
+  const result = spawnSync('codesign', ['-dv', '--verbose=4', filename], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.error || result.status !== 0) return null;
+  return `${result.stdout}\n${result.stderr}`;
+}
+
+// Returns { teamIdentifier, adhoc } for a readable signature, or null when
+// the file carries no readable signature (unsigned, corrupt, not Mach-O).
+function codesignIdentity(filename) {
+  const output = codesignOutput(filename);
+  if (!output) return null;
+  if (/^Signature=adhoc\s*$/m.test(output)) {
+    return { teamIdentifier: null, adhoc: true };
+  }
+  const teamLine = output.match(/^TeamIdentifier=(.*)$/m);
+  const teamIdentifier = teamLine ? teamLine[1].trim() : '';
+  if (teamIdentifier && teamIdentifier !== 'not set') {
+    return { teamIdentifier, adhoc: false };
+  }
+  return null;
+}
+
+function codesignVerifies(filename) {
+  const result = spawnSync('codesign', ['--verify', '--strict', filename], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return !result.error && result.status === 0;
+}
+
+let hostCodesignIdentityCache;
+
+function hostCodesignIdentity() {
+  if (hostCodesignIdentityCache === undefined) {
+    hostCodesignIdentityCache = codesignIdentity(process.execPath);
+  }
+  return hostCodesignIdentityCache;
+}
+
+// Accept a re-signature only when it was made with the same identity as the
+// host process: identical TeamIdentifier, or both sides ad-hoc signed.
+function signerMatchesHost(artifactIdentity, host = hostCodesignIdentity()) {
+  if (!artifactIdentity || !host) return false;
+  if (artifactIdentity.adhoc && host.adhoc) return true;
+  return !artifactIdentity.adhoc && !host.adhoc &&
+    artifactIdentity.teamIdentifier === host.teamIdentifier;
+}
+
+function acceptsSignedMacOSMutation(filename) {
+  if (process.platform !== 'darwin') return false;
+  if (!isMachO(filename)) return false;
+  if (!codesignVerifies(filename)) return false;
+  return signerMatchesHost(codesignIdentity(filename));
+}
+
 function adapterError(code, message, detail, cause) {
   const error = new Error(message, cause === undefined ? undefined : { cause });
   error.name = 'OcrError';
@@ -12,6 +104,22 @@ function adapterError(code, message, detail, cause) {
   return error;
 }
 
+// Detect musl Linux (Alpine and friends). Only reached when the host does not
+// report glibcVersionRuntime through process.report. The musl dynamic linker
+// path is the primary signal; the ldd output check covers hosts with a
+// non-standard loader location.
+function isMuslLinux() {
+  if (process.platform !== 'linux') return false;
+  const loader = process.arch === 'arm64'
+    ? '/lib/ld-musl-aarch64.so.1'
+    : '/lib/ld-musl-x86_64.so.1';
+  if (fs.existsSync(loader)) return true;
+  const ldd = spawnSync('ldd', ['--version'], { encoding: 'utf8', timeout: 5000 });
+  if (ldd.error) return false;
+  const output = `${ldd.stdout || ''}${ldd.stderr || ''}`;
+  return output.toLowerCase().includes('musl');
+}
+
 function platformIdentity() {
   const key = `${process.platform}-${process.arch}`;
   const identities = {
@@ -25,9 +133,12 @@ function platformIdentity() {
     if (report?.header?.glibcVersionRuntime) {
       return { id: 'linux-x64', os: 'linux', architecture: 'x86_64', libc: 'glibc' };
     }
+    if (isMuslLinux()) {
+      return { id: 'linux-x64-musl', os: 'linux', architecture: 'x86_64', libc: 'musl' };
+    }
     throw adapterError(
       'unsupported_platform',
-      'light-ocr currently supports Linux x64 with glibc only',
+      'light-ocr currently supports Linux x64 with glibc or musl only',
       key,
     );
   }
@@ -36,9 +147,12 @@ function platformIdentity() {
     if (report?.header?.glibcVersionRuntime) {
       return { id: 'linux-arm64', os: 'linux', architecture: 'arm64', libc: 'glibc' };
     }
+    if (isMuslLinux()) {
+      return { id: 'linux-arm64-musl', os: 'linux', architecture: 'arm64', libc: 'musl' };
+    }
     throw adapterError(
       'unsupported_platform',
-      'light-ocr currently supports Linux arm64 with glibc only',
+      'light-ocr currently supports Linux arm64 with glibc or musl only',
       key,
     );
   }
@@ -57,6 +171,8 @@ function platformPackage() {
     'windows-x64': '@arcships/light-ocr-win32-x64',
     'linux-x64': '@arcships/light-ocr-linux-x64-gnu',
     'linux-arm64': '@arcships/light-ocr-linux-arm64-gnu',
+    'linux-x64-musl': '@arcships/light-ocr-linux-x64-musl',
+    'linux-arm64-musl': '@arcships/light-ocr-linux-arm64-musl',
   };
   return packages[platformIdentity().id];
 }
@@ -108,12 +224,23 @@ function verifyArtifact(root, artifact, field) {
   if (!stats.isFile() || stats.isSymbolicLink()) {
     throw adapterError('package_load_failed', 'Descriptor artifact is not a regular file', artifact.path);
   }
-  if (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 1 || stats.size !== artifact.bytes) {
+  if (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 1) {
     throw adapterError('package_load_failed', 'Descriptor artifact byte count mismatch', artifact.path);
   }
-  if (!/^[a-f0-9]{64}$/.test(artifact.sha256 || '') || sha256(filename) !== artifact.sha256) {
+  if (!/^[a-f0-9]{64}$/.test(artifact.sha256 || '')) {
     throw adapterError('package_load_failed', 'Descriptor artifact hash mismatch', artifact.path);
   }
+  if (stats.size !== artifact.bytes) {
+    if (!acceptsSignedMacOSMutation(filename)) {
+      throw adapterError('package_load_failed', 'Descriptor artifact byte count mismatch', artifact.path);
+    }
+    return filename;
+  }
+  if (sha256(filename) !== artifact.sha256) {
+    if (!acceptsSignedMacOSMutation(filename)) {
+      throw adapterError('package_load_failed', 'Descriptor artifact hash mismatch', artifact.path);
+    }
+  }
   return filename;
 }
 
@@ -496,4 +623,11 @@ function loadNative() {
   }
 }
 
-module.exports = { loadNative, validateRuntimeDescriptor };
+const macOSSignature = Object.freeze({
+  isMachO,
+  codesignIdentity,
+  codesignVerifies,
+  signerMatchesHost,
+});
+
+module.exports = { loadNative, validateRuntimeDescriptor, macOSSignature, platformIdentity };

package/src/metadata.cjs

@@ -1,3 +1,3 @@
 'use strict';
 
-module.exports = Object.freeze({ coreVersion: '0.5.6' });
+module.exports = Object.freeze({ coreVersion: '0.5.8' });