@blamejs/core 0.15.16 → 0.15.17

package/lib/queue.js

@@ -938,14 +938,16 @@ function enqueueFlow(spec) {
     { queueName: spec.queueName, flowId: flowId, childCount: spec.children.length },
     async function () {
       var jobs = [];
-      // Two-pass insert: first pass enqueues all children with their
-      // names attached so the second pass can write dependsOn jobIds
-      // resolved by name. Children with deps land at MAX_SAFE_INTEGER
-      // availableAt automatically (see queue-local enqueue logic).
+      // Two-pass insert: first pass enqueues all children (so the second pass
+      // can resolve dependsOn names → sibling jobIds); a deps-bearing child is
+      // PARKED at enqueue time by passing its dependsOn through, so it is never
+      // leaseable in the window between the two passes (a concurrent consumer
+      // could otherwise lease it before its deps run). The second pass only
+      // rewrites the parked child's dependsOn from names to the resolved jobIds.
       var nameToJobId = {};
       for (var p = 0; p < spec.children.length; p++) {
         var ch = spec.children[p];
-        // Hold off setting dependsOn until we know all sibling jobIds.
+        var hasDeps = Array.isArray(ch.dependsOn) && ch.dependsOn.length > 0;
         var enqOpts = {
           backend:       flowBackend.name,
           flowId:        flowId,
@@ -954,10 +956,12 @@ function enqueueFlow(spec) {
           classification: ch.classification || null,
           traceId:       ch.traceId || null,
           maxAttempts:   ch.maxAttempts,
-          // dependsOn intentionally omitted on first pass — will be patched
-          // in via the backend's patchFlowDeps after all jobIds are known.
-          // Root children (no deps) are immediately leaseable; deps-bearing
-          // children get parked at MAX_SAFE_INTEGER via the second pass.
+          // Park a deps-bearing child immediately (queue-local parks when
+          // opts.dependsOn is present); the second pass replaces these dep
+          // NAMES with the resolved sibling jobIds, keeping it parked until
+          // completion bumps availableAt. Root children (no deps) stay
+          // immediately leaseable.
+          dependsOn:     hasDeps ? ch.dependsOn : undefined,
         };
         var result = await enqueue(spec.queueName, ch.payload, enqOpts);
         nameToJobId[ch.name] = result.jobId;

package/lib/self-update-standalone-verifier.js

@@ -116,6 +116,49 @@ function _detectAlg(pubkeyPem) {
                   "(need ecdsa-p384, ed25519, or ml-dsa-87)");
 }
 
+// _looksLikeDerEcdsa — true iff `sig` is a structurally-well-formed ASN.1
+// DER ECDSA signature: SEQUENCE { INTEGER r, INTEGER s }. We dispatch the
+// dsaEncoding by STRUCTURE, never by length: a P-384 DER signature whose r
+// and s both encode short can total exactly 96 bytes — the same length as a
+// raw IEEE-P1363 P-384 signature (48-byte r || 48-byte s) — so a length-only
+// test mis-decodes the valid DER signature as raw and spuriously rejects an
+// otherwise-valid update. This is a shape check only; cryptographic validity
+// is still decided by the single verifier.verify() call below.
+//
+// DER layout: 0x30 <seqLen> 0x02 <rLen> <r...> 0x02 <sLen> <s...>, where each
+// declared length must exactly frame the bytes that follow (definite-form,
+// short or long encoding) and the SEQUENCE body must consume the whole sig.
+function _readDerLen(buf, off) {
+  if (off >= buf.length) return null;
+  var first = buf[off];
+  if (first < 0x80) return { len: first, next: off + 1 };   // short form
+  var numBytes = first & 0x7f;
+  if (numBytes === 0 || numBytes > 4) return null;           // indefinite / oversized: reject
+  if (off + 1 + numBytes > buf.length) return null;
+  var len = 0;
+  for (var i = 0; i < numBytes; i++) len = (len * 256) + buf[off + 1 + i];
+  return { len: len, next: off + 1 + numBytes };
+}
+function _readDerInteger(buf, off) {
+  if (off >= buf.length || buf[off] !== 0x02) return null;   // INTEGER tag
+  var l = _readDerLen(buf, off + 1);
+  if (l === null || l.len === 0) return null;
+  var end = l.next + l.len;
+  if (end > buf.length) return null;
+  return { next: end };
+}
+function _looksLikeDerEcdsa(sig) {
+  if (sig.length < 8 || sig[0] !== 0x30) return false;       // SEQUENCE tag
+  var seq = _readDerLen(sig, 1);
+  if (seq === null) return false;
+  if (seq.next + seq.len !== sig.length) return false;       // body must frame to end
+  var r = _readDerInteger(sig, seq.next);
+  if (r === null) return false;
+  var s = _readDerInteger(sig, r.next);
+  if (s === null) return false;
+  return s.next === sig.length;                              // exactly two INTEGERs, no trailing bytes
+}
+
 /**
  * @primitive b.selfUpdate.standaloneVerifier.verify
  * @signature b.selfUpdate.standaloneVerifier.verify(assetPath, signaturePath, pubkeyPem)
@@ -285,13 +328,32 @@ function verify(assetPath, signaturePath, pubkeyPem) {
 
   var ok = false;
   if (alg === "ecdsa-p384") {
-    // P-384 IEEE-P1363 sigs are exactly 96 bytes (48-byte r || 48-byte s).
-    // P-384 DER sigs are variable (~100-104 bytes — ASN.1 SEQUENCE
-    // wrapping two INTEGERs). Detect by length so we only call
-    // verifier.verify ONCE — calling it a second time after a failed
-    // verify returns stale state and silently passes tampered assets.
-    // 96 = P-384 IEEE-P1363 signature length; protocol constant, not a byte-size.
-    var dsaEncoding = signature.length === 96 ? "ieee-p1363" : "der";   // IEEE-P1363 P-384 signature length
+    // Pick the ECDSA signature encoding by STRUCTURE, not by length. A P-384
+    // DER signature whose r and s both encode short can total exactly 96
+    // bytes — the same length as a raw IEEE-P1363 P-384 signature (48-byte r
+    // || 48-byte s) — so a length-only test mis-decodes the valid DER
+    // signature as raw and spuriously rejects an otherwise-valid update.
+    //
+    // A well-formed ASN.1 DER ECDSA signature is a SEQUENCE { INTEGER r,
+    // INTEGER s }; raw IEEE-P1363 is exactly 2*coordLen bytes (coordLen =
+    // 48 for the P-384 field). If it parses as DER, treat as DER; else if it
+    // is exactly 2*coordLen, treat as raw; else fail closed. We call
+    // verifier.verify() ONCE — a second call after a failed verify returns
+    // stale state and can silently pass tampered assets.
+    var coordLen = 48;   // P-384 field element width in bytes; protocol constant, not a byte-size cap
+    var dsaEncoding;
+    if (_looksLikeDerEcdsa(signature)) {
+      dsaEncoding = "der";
+    } else if (signature.length === coordLen * 2) {
+      dsaEncoding = "ieee-p1363";
+    } else {
+      // assetFd was already closed by the read loop's `finally`; this is a
+      // pure fail-closed refusal, same as the `if (!ok)` path below.
+      throw new Error("standalone-verifier.verify: ecdsa-p384 signature is neither a " +
+                      "well-formed DER SEQUENCE nor a raw " + (coordLen * 2) +
+                      "-byte IEEE-P1363 pair (length " + signature.length +
+                      ") — refusing to guess the encoding");
+    }
     ok = verifier.verify({ key: key, dsaEncoding: dsaEncoding }, signature);
   } else if (alg === "ed25519") {
     // fullBuf may be shorter than allocated (sparse files / size-races);

package/lib/self-update.js

@@ -297,6 +297,13 @@ function _matchAsset(name, pattern, fallback) {
  * with conservative fallbacks. Throws SelfUpdateError on a non-2xx
  * upstream, malformed JSON, or unexpected shape.
  *
+ * Each matched asset / signature is reported as
+ * `{ name, url, size, digest }`. `digest` carries the release API's
+ * published `assets[].digest` (e.g. `"sha256:<hex>"`) verbatim when the
+ * upstream supplies it, or `null` when absent — a consumer can use it
+ * for a defense-in-depth in-flight integrity check of the downloaded
+ * bytes alongside the detached-signature verify.
+ *
  * @opts
  *   releasesUrl:      string,    // required — feed URL
  *   currentVersion:   string,    // required — e.g. "0.8.43" or "v0.8.43"
@@ -446,11 +453,13 @@ async function poll(opts) {
     var a = assets[i] || {};
     if (typeof a.name !== "string" || typeof a.browser_download_url !== "string") continue;
     if (signatureMatch === null && _matchAsset(a.name, opts.signaturePattern, /\.sig$|\.asc$|\.sig\.bin$/i)) {
-      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                         digest: typeof a.digest === "string" ? a.digest : null };
       continue;
     }
     if (assetMatch === null && _matchAsset(a.name, opts.assetPattern, /\.(tar\.gz|tgz|zip|node|exe|bin)$/i)) {
-      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                     digest: typeof a.digest === "string" ? a.digest : null };
     }
   }
 

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.1",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:f359a782ac57e3ff56ac71083d17f5c082f88ab49d645fc2bede398b47adebdb"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-05-13T00:00:00Z",
+      "bundledAt": "2026-06-22T00:00:00Z",
       "hashes": {
-        "server": "sha256:927884952ea8857ba3608eefe617f3c8acd63ad94be7b0bfb7586632cfc59560",
-        "data_js": "sha256:c2f67f5e7f7306eb5ec26548ea275673c652cfdd830b909fd63ed2b39e4838f6"
+        "server": "sha256:0adddeb62057d8d40799dffb29fe14f65dd009259afe02eb2f0b4602b791aae6",
+        "data_js": "sha256:82af512cacf0fd2c60925e63f877b69477b1b2f7bb5af698fd862af61369902e"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-06-13_21-47-18_UTC
-// COMMIT: 9186eeeda85cef35b1551d00731464939c765cab
+// VERSION: 2026-06-22_11-46-12_UTC
+// COMMIT: 27a7b5d881b91def306422e6cc243f05c49f3a58
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -14721,6 +14721,10 @@ mittwaldserver.info
 typo3server.info
 project.space
 
+// MKM : https://mkm.fan/
+// Submitted by Kashi Ahmer <admin@mkm.fan>
+mkm.fan
+
 // Mocha : https://getmocha.com
 // Submitted by Ben Reinhart <security@getmocha.com>
 mocha.app