@dk/hipp 0.1.19 → 0.1.21

package/README.md

@@ -109,32 +109,36 @@ The manifest contains:
 {
   "origin": "git@github.com:dk/your-package.git",
   "tag": "v1.0.0",
+  "revision": "<git-commit-hash>",
   "hash": "<sha256-of-tarball>",
   "signature": "<base64-ed25519-signature>",
   "name": "Jane Developer",
-  "email": "jane@example.com"
+  "email": "jane@example.com",
+  "npm": "10.2.4",
+  "node": "v20.11.0"
 }
 ```
 
 **Step 2: Clone git and verify**
 
 3. Clone the repository at the tagged commit (using origin/tag from manifest)
-4. Stage all tracked files
-5. Run `npm pack` to create a tarball
-6. Compute SHA256 hash of the clean tarball
-7. Compare with the `hash` field from the npm manifest
+4. Verify the cloned commit hash matches the `revision` field in manifest
+5. Stage all tracked files
+6. Run `npm pack` to create a tarball
+7. Compute SHA256 hash of the clean tarball
+8. Compare with the `hash` field from the npm manifest
 
 **Step 3: Verify signature**
 
-8. Read `hipp.pub` from the cloned repository
-9. Verify the signature was created by signing:
-   `hash + "\n" + origin + "\n" + tag + "\n" + name + "\n" + email`
+9. Read `hipp.pub` from the cloned repository
+10. Verify the signature was created by signing:
+    `hash + "\n" + origin + "\n" + tag + "\n" + revision + "\n" + name + "\n" + email`
 
 **Step 4: Rebuild verification**
 
-10. Append the manifest to the staged README
-11. Update the staged `package.json` version to match the tag
-12. Run `npm pack` again and verify the hash matches the npm tarball
+11. Append the manifest to the staged README
+12. Update the staged `package.json` version to match the tag
+13. Run `npm pack` again and verify the hash matches the npm tarball
 
 ### Three Verification Checks
 
@@ -216,16 +220,19 @@ PERFORMANCE OF THIS SOFTWARE.
 Verify this package with [@dk/hipp](https://www.npmjs.com/package/@dk/hipp):
 
 ```bash
-npx @dk/hipp verify @dk/hipp@0.1.19
+npx @dk/hipp verify @dk/hipp@0.1.21
 ```
 
 ```json
 {
-  "origin": "git@github.com:dmytri/hipp.git",
-  "tag": "v0.1.19",
-  "hash": "adcdd07b563c5667d405b36ee1e391710e1baf4ee9434b1fd2f5a11c2acdecf0",
-  "signature": "MdkA4AbDX4ofShqXKJxwWX+x+RWQJU16WpSkFvHU8LihgdIBJbsyNvzIfrjm+3cll2FdR5u3+/dwv+a0rHbUDw==",
+  "origin": "https://github.com/dmytri/hipp.git",
+  "tag": "v0.1.21",
+  "revision": "0a0be44db52e62d425959bda9f640049005c8809",
+  "hash": "50de72f67534fe6d9054c5b0cfab317aa1620d258cb291bd1dc65d60a43d77d8",
+  "signature": "m0+8tk8kM835KJcTeHPZPG20XLh4rEtyISoJB54aV8LknEmJVM5yRG6syq+Kg0AAP6VcJMmNrpMG9jOeDkyoBQ==",
   "name": "Dmytri Kleiner",
-  "email": "dev@dmytri.to"
+  "email": "dev@dmytri.to",
+  "npm": "11.12.1",
+  "node": "v25.8.2"
 }
 ```

package/hipp.js

@@ -33,6 +33,14 @@ function getGitUserInfo() {
   return { name, email };
 }
 
+function sshToHttpsUrl(sshUrl) {
+  const match = sshUrl.match(/^git@([^:]+):(.+\.git)$/);
+  if (match) {
+    return `https://${match[1]}/${match[2]}`;
+  }
+  return sshUrl;
+}
+
 function runCmd(cmd, args, options = {}) {
   const result = spawnSync(cmd, args, {
     encoding: 'utf8',
@@ -121,8 +129,8 @@ function verifySignature(data, signature, publicKey) {
   }, Buffer.from(signature, 'base64'));
 }
 
-function buildSignData(hash, origin, tag, name, email) {
-  return `${hash}\n${origin}\n${tag}\n${name}\n${email}\n`;
+function buildSignData(hash, origin, tag, revision, name, email) {
+  return `${hash}\n${origin}\n${tag}\n${revision}\n${name}\n${email}\n`;
 }
 
 function findLastJsonBlock(readmeContent) {
@@ -463,11 +471,11 @@ async function runVerify(packageSpec) {
 
     const npmReadme = fs.readFileSync(npmReadmePath, 'utf8');
     manifest = findLastJsonBlock(npmReadme);
-    if (!manifest || !manifest.origin || !manifest.tag || !manifest.hash || !manifest.signature || !manifest.name || !manifest.email) {
+    if (!manifest || !manifest.origin || !manifest.tag || !manifest.revision || !manifest.hash || !manifest.signature || !manifest.name || !manifest.email) {
       fail(`❌ Manifest not found or invalid in README`);
     }
 
-    const { origin: originUrl, tag, signature, name, email } = manifest;
+    const { origin: originUrl, tag, revision, signature, name, email, npm: npmVer, node: nodeVer } = manifest;
 
     log.info(`🌿 Cloning git origin at tag ${tag}...`);
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `hipp-verify-git-`));
@@ -476,6 +484,12 @@ async function runVerify(packageSpec) {
     try {
       git(['clone', '--branch', tag, '--depth', '1', originUrl, tmpDir], { stdio: 'pipe' });
 
+      const clonedRevision = git(['rev-parse', 'HEAD'], { cwd: tmpDir });
+      if (clonedRevision !== revision) {
+        fail(`❌ Revision mismatch: manifest claims ${revision.slice(0, 12)} but tag points to ${clonedRevision.slice(0, 12)}`);
+      }
+      log.success(`🏷️  Revision verified: ${revision.slice(0, 12)}...`);
+
       const publicKeyPath = path.join(tmpDir, 'hipp.pub');
       if (!fs.existsSync(publicKeyPath)) {
         fail(`❌ hipp.pub not found in git at tag ${tag}`);
@@ -498,7 +512,7 @@ async function runVerify(packageSpec) {
       log.success(`🔒 Manifest hash verified`);
 
       log.info(`🔍 Check 1: Verifying signature...`);
-      const signData = buildSignData(manifest.hash, originUrl, tag, name, email);
+      const signData = buildSignData(manifest.hash, originUrl, tag, revision, name, email);
       const signatureValid = verifySignature(signData, signature, publicKey);
       if (!signatureValid) {
         fail(`❌ Signature verification failed`);
@@ -540,6 +554,9 @@ async function runVerify(packageSpec) {
       log.info(`📍 Publisher: ${name} <${email}>`);
       log.info(`📍 Origin: ${originUrl}`);
       log.info(`📍 Tag: ${tag}`);
+      if (npmVer && nodeVer) {
+        log.info(`ℹ️  npm: ${npmVer} | node: ${nodeVer}`);
+      }
     } finally {
       fs.rmSync(tmpDir, { recursive: true, force: true });
       fs.rmSync(stageDir, { recursive: true, force: true });
@@ -638,16 +655,23 @@ async function run() {
     }
 
     const { name, email } = getGitUserInfo();
-    const dataToSign = buildSignData(tarballHash, provenance.remoteUrl, rawTag, name, email);
+    const revision = refInfo.head;
+    const npmVersion = runCmd('npm', ['--version']).stdout.trim();
+    const nodeVersion = process.version;
+    const originUrl = sshToHttpsUrl(provenance.remoteUrl);
+    const dataToSign = buildSignData(tarballHash, originUrl, rawTag, revision, name, email);
     const signature = signContent(dataToSign, privateKey);
 
     const manifestJson = {
-      origin: provenance.remoteUrl,
+      origin: originUrl,
       tag: rawTag,
+      revision: revision,
       hash: tarballHash,
       signature: signature,
       name: name,
       email: email,
+      npm: npmVersion,
+      node: nodeVersion,
     };
 
     stagedReadme = stagedReadme.trimEnd() + '\n\n## Verify\n\n' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dk/hipp",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "High Integrity Package Publisher",
   "main": "hipp.js",
   "bin": {