@aryaminus/controlkeel 0.3.43 → 0.3.44

package/lib/install.js

@@ -163,6 +163,65 @@ async function verifyChecksum(filePath, asset) {
   }
 }
 
+/**
+ * Verify a cosign keyless signature when cosign is available on PATH.
+ * Falls back gracefully when cosign is not installed.
+ */
+async function verifySignature(filePath, asset, baseUrl) {
+  if (process.env.CONTROLKEEL_SKIP_SIGNATURE === "1") return;
+
+  const { execFileSync } = require("node:child_process");
+  const lookupCommand = process.platform === "win32" ? "where" : "command";
+  const lookupArgs = process.platform === "win32" ? ["cosign"] : ["-v", "cosign"];
+
+  let cosignPath;
+  try {
+    cosignPath = execFileSync(lookupCommand, lookupArgs, { encoding: "utf8", shell: false }).split(/\r?\n/)[0].trim();
+  } catch {
+    // cosign not available — checksum-only mode
+    return;
+  }
+
+  if (!cosignPath) return;
+
+  const repo = `${Buffer.from("YXJ5YW1pbnVzL2NvbnRyb2xrZWVs", "base64")}`;
+  const sigUrl = `${baseUrl}/${asset}.sig`;
+  const certUrl = `${baseUrl}/${asset}.pem`;
+  const sigFile = path.join(os.tmpdir(), `${asset}.sig`);
+  const certFile = path.join(os.tmpdir(), `${asset}.pem`);
+
+  await download(sigUrl, sigFile).catch(() => null);
+  await download(certUrl, certFile).catch(() => null);
+
+  if (!fs.existsSync(sigFile) || !fs.existsSync(certFile)) {
+    fs.rmSync(sigFile, { force: true });
+    fs.rmSync(certFile, { force: true });
+
+    if (process.env.CONTROLKEEL_REQUIRE_SIGNATURE === "1") {
+      throw new Error(`[controlkeel] No cosign signature/certificate available for ${asset}`);
+    }
+
+    return;
+  }
+
+  try {
+    execFileSync(cosignPath, [
+      "verify-blob", filePath,
+      "--signature", sigFile,
+      "--certificate", certFile,
+      "--certificate-identity-regexp", `^https://github.com/${repo}/.github/workflows/release.yml@refs/tags/v[0-9].*`,
+      "--certificate-oidc-issuer", "https://token.actions.githubusercontent.com"
+    ], { stdio: "pipe", timeout: 30000 });
+
+    console.log(`[controlkeel] Verified ${asset} signature (cosign keyless)`);
+  } catch (err) {
+    throw new Error(`[controlkeel] cosign signature verification failed for ${asset}`);
+  } finally {
+    fs.rmSync(sigFile, { force: true });
+    fs.rmSync(certFile, { force: true });
+  }
+}
+
 async function ensureBinary({ forceDownload = false } = {}) {
   const destination = binaryPath();
 
@@ -177,6 +236,7 @@ async function ensureBinary({ forceDownload = false } = {}) {
 
   await download(url, tempPath);
   await verifyChecksum(tempPath, asset);
+  await verifySignature(tempPath, asset, releaseBaseUrl());
 
   fs.copyFileSync(tempPath, destination);
   fs.rmSync(tempPath, { force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryaminus/controlkeel",
-  "version": "0.3.43",
+  "version": "0.3.44",
   "description": "Bootstrap installer for the ControlKeel native CLI - a control plane for agent-generated software delivery.",
   "license": "Apache-2.0",
   "author": {

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/aryaminus/controlkeel.git",
     "source": "github"
   },
-  "version": "0.3.43",
+  "version": "0.3.44",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aryaminus/controlkeel",
-      "version": "0.3.43",
+      "version": "0.3.44",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"