@dk/hipp 0.1.13 → 0.1.15

package/README.md

@@ -175,16 +175,8 @@ PERFORMANCE OF THIS SOFTWARE.
 ```json
 {
   "origin": "git@github.com:dmytri/hipp.git",
-  "tag": "v0.1.13"
+  "tag": "v0.1.15",
+  "hash": "cee8b863e598809fe8a194c1f102c857a0698e8158bef9e39493b31da6411226",
+  "signature": "Hc5fpg5Kg67ztJBdbtM3DvdrccL1e0KEyYwenwVIHLqcCNadXT9oatpgkO9dFaaGkCMUfttMGtWv8iJtYy+tBg=="
 }
 ```
-
-```npx @dk/hipp @dk/hipp@0.1.13```
-<!-- HIPP-MANIFEST -->
-```json
-{
-  "hash": "0157b775d49e9715e954bc9838f5017632c0fd2e2418d814b0e2bbb92abe3fc3",
-  "signature": "jyq8xJjFAt5HtqQWPPHw52A2ph7zVxEYD1QClEY3jRFcVFdUlaJj+sGatgP/FChjaI57HZM8flYUvl2r1DA5Dw=="
-}
-```
-<!-- /HIPP-MANIFEST -->

package/hipp.js

@@ -123,46 +123,7 @@ function buildSignData(hash, origin, tag) {
   return `${hash}\n${origin}\n${tag}\n`;
 }
 
-const MANIFEST_START = '<!-- HIPP-MANIFEST -->';
-const MANIFEST_END = '<!-- /HIPP-MANIFEST -->';
-
-function appendManifestToReadme(readmeContent, manifest) {
-  return `${readmeContent}${MANIFEST_START}\n\`\`\`json\n${manifest}\n\`\`\`\n${MANIFEST_END}\n`;
-}
-
-function extractManifestFromReadme(readmeContent) {
-  const startIdx = readmeContent.indexOf(MANIFEST_START);
-  if (startIdx === -1) return null;
-  const endIdx = readmeContent.indexOf(MANIFEST_END, startIdx);
-  if (endIdx === -1) return null;
-  const content = readmeContent.slice(startIdx + MANIFEST_START.length, endIdx).trim();
-  const match = content.match(/^```json\n(.+)\n```$/s);
-  if (!match) return null;
-  return match[1];
-}
-
-function stripManifestFromReadme(readmeContent) {
-  const startIdx = readmeContent.indexOf(MANIFEST_START);
-  const endIdx = readmeContent.indexOf(MANIFEST_END, startIdx);
-  if (startIdx === -1 || endIdx === -1) return readmeContent;
-
-  const endLineIdx = readmeContent.indexOf('\n', endIdx);
-  const endOfManifest = endLineIdx !== -1 ? endLineIdx + 1 : readmeContent.length;
-
-  const beforeWithNewline = readmeContent.slice(0, startIdx);
-  const lastNewlineBefore = beforeWithNewline.lastIndexOf('\n');
-  const before = lastNewlineBefore !== -1 ? beforeWithNewline.slice(0, lastNewlineBefore) : beforeWithNewline;
-
-  const after = readmeContent.slice(endOfManifest);
-  return before + '\n' + after;
-}
-
-function computeReadmeHash(readmeContent) {
-  const stripped = stripManifestFromReadme(readmeContent);
-  return sha256(stripped);
-}
-
-function extractJsonMetaFromReadme(readmeContent) {
+function findLastJsonBlock(readmeContent) {
   const lines = readmeContent.split('\n');
   let jsonStart = -1;
   let braceCount = 0;
@@ -186,7 +147,7 @@ function extractJsonMetaFromReadme(readmeContent) {
         const jsonStr = lines.slice(jsonStart, i + 1).join('\n');
         try {
           const parsed = JSON.parse(jsonStr);
-          if (parsed.origin && parsed.tag) {
+          if (parsed.origin && parsed.tag && parsed.hash && parsed.signature) {
             lastValid = parsed;
           }
         } catch {
@@ -199,6 +160,26 @@ function extractJsonMetaFromReadme(readmeContent) {
   return lastValid;
 }
 
+function packAndHash(stageDir) {
+  const result = spawnSync('npm', ['pack'], {
+    cwd: stageDir,
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+
+  if (result.status !== 0) {
+    throw new Error(`npm pack failed: ${result.stderr}`);
+  }
+
+  const tarballName = result.stdout.trim().split('\n').pop();
+  const tarballPath = path.join(stageDir, tarballName);
+
+  const tarballContent = fs.readFileSync(tarballPath);
+  fs.unlinkSync(tarballPath);
+
+  return { tarballName, tarballHash: sha256(tarballContent) };
+}
+
 function safeStageName(name) {
   return name.replace(/[^a-zA-Z0-9._-]/g, '-');
 }
@@ -490,23 +471,12 @@ async function runVerify(packageSpec) {
     }
 
     const stagedReadme = fs.readFileSync(stagedReadmePath, 'utf8');
-    const jsonMeta = extractJsonMetaFromReadme(stagedReadme);
-    if (!jsonMeta || !jsonMeta.origin || !jsonMeta.tag) {
-      fail(`❌ JSON meta (origin/tag) not found in README`);
-    }
-
-    const manifestStr = extractManifestFromReadme(stagedReadme);
-    if (!manifestStr) {
-      fail(`❌ Manifest not found in README`);
-    }
-
-    const manifest = parseManifest(manifestStr);
-    if (!manifest || !manifest.hash || !manifest.signature) {
-      fail(`❌ Invalid manifest format`);
+    const manifest = findLastJsonBlock(stagedReadme);
+    if (!manifest || !manifest.origin || !manifest.tag || !manifest.hash || !manifest.signature) {
+      fail(`❌ Manifest not found or invalid in README`);
     }
 
-    const originUrl = jsonMeta.origin;
-    const tag = jsonMeta.tag;
+    const { origin: originUrl, tag, hash: npmHash, signature } = manifest;
 
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `hipp-verify-git-`));
     const stageDir = fs.mkdtempSync(path.join(os.tmpdir(), `hipp-verify-stage-`));
@@ -526,26 +496,17 @@ async function runVerify(packageSpec) {
       const trackedFiles = getTrackedFilesFromDir(tmpDir);
       copyTrackedFilesFromDir(stageDir, tmpDir, trackedFiles);
 
-      const stagedReadmePath = path.join(stageDir, 'README.md');
-      if (!fs.existsSync(stagedReadmePath)) {
-        fail(`❌ README.md not found in git at tag ${tag}`);
-      }
-
-      let stagedReadme = fs.readFileSync(stagedReadmePath, 'utf8');
-      const verifyBlock = '```npx @dk/hipp ' + pkgName + '@' + tag + '```';
-      const jsonMetaStr = '```json\n{\n  "origin": "' + originUrl + '",\n  "tag": "' + tag + '"\n}\n```';
-      stagedReadme = stagedReadme.trimEnd() + '\n\n' + jsonMetaStr + '\n\n' + verifyBlock + '\n';
-
-      const stagedHash = computeReadmeHash(stagedReadme);
+      log.info(`📦 Packing to verify content hash...`);
+      const { tarballHash } = packAndHash(stageDir);
 
-      if (stagedHash !== manifest.hash) {
+      if (tarballHash !== npmHash) {
         fail(`❌ Hash mismatch: git content does not match npm manifest`);
       }
 
-      log.success(`🔒 Content hash verified: ${manifest.hash.slice(0, 12)}...`);
+      log.success(`🔒 Content hash verified: ${npmHash.slice(0, 12)}...`);
 
-      const signData = buildSignData(manifest.hash, originUrl, tag);
-      const signatureValid = verifySignature(signData, manifest.signature, publicKey);
+      const signData = buildSignData(npmHash, originUrl, tag);
+      const signatureValid = verifySignature(signData, signature, publicKey);
 
       if (!signatureValid) {
         fail(`❌ Signature verification failed`);
@@ -642,10 +603,9 @@ async function run() {
 
     const { privateKey } = loadOrGenerateKeys();
 
-    const stagedPkgPath = path.join(stageDir, 'package.json');
-    const stagedPkg = JSON.parse(fs.readFileSync(stagedPkgPath, 'utf8'));
-    stagedPkg.version = version;
-    fs.writeFileSync(stagedPkgPath, JSON.stringify(stagedPkg, null, 2) + '\n');
+    log.info(`📦 Packing to compute content hash...`);
+    const { tarballHash } = packAndHash(stageDir);
+    log.success(`🔒 Content hash: ${tarballHash.slice(0, 12)}...`);
 
     const stagedReadmePath = path.join(stageDir, 'README.md');
     let stagedReadme = '';
@@ -653,18 +613,24 @@ async function run() {
       stagedReadme = fs.readFileSync(stagedReadmePath, 'utf8');
     }
 
-    const verifyBlock = '```npx @dk/hipp ' + pkg.name + '@' + version + '```';
-    const jsonMetaStr = '```json\n{\n  "origin": "' + provenance.remoteUrl + '",\n  "tag": "' + rawTag + '"\n}\n```';
-    stagedReadme = stagedReadme.trimEnd() + '\n\n' + jsonMetaStr + '\n\n' + verifyBlock + '\n';
-
-    const readmeHash = computeReadmeHash(stagedReadme);
-    const dataToSign = buildSignData(readmeHash, provenance.remoteUrl, rawTag);
+    const dataToSign = buildSignData(tarballHash, provenance.remoteUrl, rawTag);
     const signature = signContent(dataToSign, privateKey);
-    const manifest = createManifest(readmeHash, signature);
-    stagedReadme = appendManifestToReadme(stagedReadme, manifest);
 
+    const manifestJson = {
+      origin: provenance.remoteUrl,
+      tag: rawTag,
+      hash: tarballHash,
+      signature: signature,
+    };
+
+    stagedReadme = stagedReadme.trimEnd() + '\n\n```json\n' + JSON.stringify(manifestJson, null, 2) + '\n```\n';
     fs.writeFileSync(stagedReadmePath, stagedReadme);
 
+    const stagedPkgPath = path.join(stageDir, 'package.json');
+    const stagedPkg = JSON.parse(fs.readFileSync(stagedPkgPath, 'utf8'));
+    stagedPkg.version = version;
+    fs.writeFileSync(stagedPkgPath, JSON.stringify(stagedPkg, null, 2) + '\n');
+
     log.success('🔏 Manifest signed.');
 
     log.info('🔥 Ignition...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dk/hipp",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "High Integrity Package Publisher",
   "main": "hipp.js",
   "bin": {