@dynomate/cli 0.0.10 → 0.1.0

package/README.md

@@ -1,10 +1,12 @@
 # @dynomate/cli
 
-This package installs the native Dynomate command-line client. Test releases use
-the npm `next` tag:
+This package installs the native Dynomate command-line client. For current
+installation and download instructions, see
+[Dynomate CLI installation](https://dynomate.io/docs/cli/installation/).
+Test releases use the npm `next` tag:
 
 ```bash
-npm install --global @dynomate/cli@next
+npm install --global --ignore-scripts=false --allow-scripts=@dynomate/cli @dynomate/cli@next
 dynomate-cli --version
 ```
 
@@ -18,26 +20,28 @@ Run the same install command again to upgrade. The package exposes only
 - 64-bit GNU/Linux (`x64`) with glibc 2.35 or newer (Ubuntu 22.04 baseline)
 - 64-bit Windows (`x64`)
 
-Installation downloads the archive for the current platform from the immutable
-release at
-`https://releases.dynomate.io/cli/dynomate-cli-v<version>/`. The installer reads
-that release's `SHA256SUMS`, verifies the archive before extracting it, and then
-atomically installs only the `dynomate-cli` executable.
-
-Install scripts are required. If npm is run with `--ignore-scripts`, the native
-executable is not downloaded and the launcher exits with instructions to
-reinstall normally. The installer also needs HTTPS access to
-`releases.dynomate.io`.
-
-If install scripts cannot run, download the archive for your platform and the
-[SHA256SUMS](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/SHA256SUMS)
-manifest directly, verify it, and invoke `dynomate-cli` (`dynomate-cli.exe` on
-Windows) yourself:
-
-- [macOS Apple Silicon](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-aarch64-apple-darwin.tar.gz)
-- [macOS Intel](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-apple-darwin.tar.gz)
-- [GNU/Linux x64](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-unknown-linux-gnu.tar.gz)
-- [Windows x64](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-pc-windows-msvc.zip)
+Installation downloads the archive for the current platform from an immutable
+Dynomate release. Before trusting an archive hash, the installer verifies that
+release's detached `manifest.sig`
+over the exact `manifest.json` bytes with the public key packaged in this npm
+package. It validates the authenticated target, filename, size, and SHA-256,
+then atomically installs only the `dynomate-cli` executable.
+
+Install scripts are required. npm 12 blocks dependency lifecycle scripts unless
+they are explicitly approved. A saved `ignore-scripts=true` setting also skips
+them unless it is overridden for this install. If the native executable is
+missing, the launcher exits with status 1, performs no network request, and
+points to the installation guide. The installer needs HTTPS access to the
+Dynomate release service during installation.
+
+For other installation methods, use the
+[CLI installation guide](https://dynomate.io/docs/cli/installation/). The release
+host is used by the installer to fetch authenticated native archives.
+
+Test releases stay on the npm `next` dist-tag. A release operator promotes a
+validated version to `latest` only after the native release and npm package
+have passed the release runbook; users should not assume `latest` points at a
+test release.
 
 ## License
 

package/keys/dynomate-cli-2026-01.pem

@@ -0,0 +1,11 @@
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAjUtWOzCuBpSntIpltpQs
+0cXxDyWXL8Y4jAlTYy8iiRvy07e9046rOqGoff90EEslCgQqLjGhHtQRWjQrnnlC
+GBHf+DPR0V0Q9QI0hZcnOFdWAxg79eVFwNc/RexhU6Zw8KqsvrDkREmSkPSK0MTl
+2nrw/JyKSH0QmTdAonIuZ3rp0oSVq66VQALAJ8/q0qpO2mok+JH4DnEAvORfvu6n
+oQxaL0191I3uVuAOiOcAgpWGhTpfPTo0RmKdtEyzBYRFgetz+On8OaOky+M4GtME
+8c65KbEDXq+KReMUmv69JT3mHawH8ZLG3KHI4Kg52ZbQL9B+beWvitWjMaWXuwAv
+IL8A5nNzhziKjyFdnK4sW8u8LSKnPy4rh57drzFDxWmGjk4IsS1332zx3yy3JuO9
+ZZL9CGpWRyKLeGGMZhLVRtsTyMhHhgIeamQITxTpU33Ir7oQV8zHsc7K/IA8j/RG
+z0dXsEvS43Fu68A6kXPrdo/AGwuYv41Y7i9TnLGWrkdFAgMBAAE=
+-----END PUBLIC KEY-----

package/lib/archive.js

@@ -1,6 +1,9 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { gunzipSync, inflateRawSync } from "node:zlib";
 
+const MAX_EXECUTABLE_BYTES = 512 * 1024 * 1024;
+const MAX_TAR_OUTPUT_BYTES = MAX_EXECUTABLE_BYTES + 1024 * 1024;
+
 function basename(path) {
   return path.replaceAll("\\", "/").split("/").filter(Boolean).at(-1);
 }
@@ -17,7 +20,7 @@ function oneExecutable(matches, executableName) {
 }
 
 function extractTarGz(buffer, executableName) {
-  const tar = gunzipSync(buffer);
+  const tar = gunzipSync(buffer, { maxOutputLength: MAX_TAR_OUTPUT_BYTES });
   const matches = [];
   for (let offset = 0; offset + 512 <= tar.length;) {
     const header = tar.subarray(offset, offset + 512);
@@ -41,6 +44,7 @@ function extractTarGz(buffer, executableName) {
     if (!Number.isSafeInteger(size) || dataEnd > tar.length) throw new Error("Archive contains a truncated tar entry");
     if (basename(name) === executableName) {
       if (type !== 0 && type !== 48) throw new Error(`Archive entry ${name} is not a regular file`);
+      if (size > MAX_EXECUTABLE_BYTES) throw new Error(`Archive entry ${name} exceeds the extraction limit`);
       matches.push(Buffer.from(tar.subarray(dataStart, dataEnd)));
     }
     offset = dataStart + Math.ceil(size / 512) * 512;
@@ -83,6 +87,7 @@ function extractZip(buffer, executableName) {
     if (basename(name) === executableName) {
       if (flags & 1) throw new Error("Encrypted ZIP entries are not supported");
       if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || localOffset === 0xffffffff) throw new Error("ZIP64 archives are not supported");
+      if (uncompressedSize === 0 || uncompressedSize > MAX_EXECUTABLE_BYTES) throw new Error(`ZIP entry ${name} exceeds the extraction limit`);
       if (localOffset + 30 > buffer.length || buffer.readUInt32LE(localOffset) !== 0x04034b50) throw new Error("ZIP local header is invalid");
       const localNameLength = buffer.readUInt16LE(localOffset + 26);
       const localExtraLength = buffer.readUInt16LE(localOffset + 28);
@@ -90,7 +95,11 @@ function extractZip(buffer, executableName) {
       const end = start + compressedSize;
       if (end > buffer.length) throw new Error("Archive contains a truncated ZIP entry");
       const compressed = buffer.subarray(start, end);
-      const data = method === 0 ? Buffer.from(compressed) : method === 8 ? inflateRawSync(compressed) : null;
+      const data = method === 0
+        ? Buffer.from(compressed)
+        : method === 8
+          ? inflateRawSync(compressed, { maxOutputLength: MAX_EXECUTABLE_BYTES })
+          : null;
       if (!data) throw new Error(`Unsupported ZIP compression method: ${method}`);
       if (data.length !== uncompressedSize || crc32(data) !== expectedCrc) throw new Error(`ZIP entry ${name} failed integrity validation`);
       matches.push(data);

package/lib/compatibility.js

@@ -0,0 +1,54 @@
+import { execFileSync } from "node:child_process";
+import { release as osRelease } from "node:os";
+
+const MINIMUM_GLIBC = [2, 35];
+
+function parseVersion(value) {
+  const match = /(?:^|\s)(\d+)\.(\d+)(?:\D|$)/.exec(value || "");
+  return match ? [Number(match[1]), Number(match[2])] : null;
+}
+
+function atLeast(actual, minimum) {
+  return actual[0] > minimum[0] || (actual[0] === minimum[0] && actual[1] >= minimum[1]);
+}
+
+export function detectLinuxLibc({ report, run = execFileSync } = {}) {
+  const runtimeReport = report === undefined ? process.report?.getReport?.() : report;
+  const runtimeVersion = runtimeReport?.header?.glibcVersionRuntime;
+  const sharedObjects = runtimeReport?.sharedObjects || [];
+  if (sharedObjects.some((entry) => /(?:^|\/)ld-musl[^/]*\.so/i.test(entry))) return { family: "musl" };
+  if (runtimeVersion) return { family: "glibc", version: runtimeVersion };
+
+  for (const [command, args] of [["getconf", ["GNU_LIBC_VERSION"]], ["ldd", ["--version"]]]) {
+    try {
+      const output = String(run(command, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }));
+      if (/musl/i.test(output)) return { family: "musl" };
+      const version = parseVersion(output);
+      if (version && /glibc|gnu libc|gnu c library|^glibc/i.test(output.trim())) {
+        return { family: "glibc", version: version.join(".") };
+      }
+    } catch {
+      // Try the next conservative probe.
+    }
+  }
+  return { family: "unknown" };
+}
+
+export function assertPlatformCompatibility({ platform = process.platform, arch = process.arch, report, run, kernelRelease = osRelease() } = {}) {
+  if (platform === "darwin") {
+    if (!["arm64", "x64"].includes(arch)) throw new Error(`Unsupported platform: ${platform}/${arch}`);
+    const darwinMajor = Number.parseInt(kernelRelease.split(".")[0], 10);
+    if (!Number.isInteger(darwinMajor) || darwinMajor < 20) throw new Error("Dynomate CLI requires macOS 11 or newer.");
+  } else if (platform === "linux") {
+    if (arch !== "x64") throw new Error(`Unsupported platform: ${platform}/${arch}`);
+    const libc = detectLinuxLibc({ report, run });
+    if (libc.family === "musl") throw new Error("Dynomate CLI does not support musl Linux (including Alpine); glibc 2.35 or newer is required.");
+    const version = libc.family === "glibc" ? parseVersion(libc.version) : null;
+    if (!version) throw new Error("Could not identify the system C library; Dynomate CLI requires glibc 2.35 or newer.");
+    if (!atLeast(version, MINIMUM_GLIBC)) throw new Error(`Dynomate CLI requires glibc 2.35 or newer; detected ${libc.version}.`);
+  } else if (platform === "win32") {
+    if (arch !== "x64") throw new Error(`Unsupported platform: ${platform}/${arch}`);
+  } else {
+    throw new Error(`Unsupported platform: ${platform}/${arch}`);
+  }
+}

package/lib/install.js

@@ -1,21 +1,14 @@
-import { chmod, mkdir, mkdtemp, rename, rm, stat } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, rename, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { extractExecutable } from "./archive.js";
-import { downloadFile, downloadText } from "./network.js";
+import { assertPlatformCompatibility } from "./compatibility.js";
+import { MAX_MANIFEST_BYTES, MAX_SIGNATURE_BYTES, selectManifestArtifact, validateManifest, verifyManifestBytes } from "./manifest.js";
+import { downloadBuffer, downloadFile } from "./network.js";
 import { nativeBinaryPath } from "./paths.js";
-import { parseChecksumManifest, releaseDescriptor } from "./release.js";
-
-async function exists(path) {
-  try {
-    await stat(path);
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  }
-}
+import { releaseDescriptor } from "./release.js";
 
 export async function installNative(options = {}) {
+  assertPlatformCompatibility(options);
   const descriptor = releaseDescriptor(options);
   const destination = options.destination || nativeBinaryPath(descriptor);
   const parent = dirname(destination);
@@ -23,31 +16,24 @@ export async function installNative(options = {}) {
   const temporaryDirectory = await mkdtemp(join(parent, ".install-"));
   const archivePath = join(temporaryDirectory, descriptor.archiveName);
   const stagedBinary = join(temporaryDirectory, descriptor.executable);
-  const backup = `${destination}.previous-${process.pid}`;
-  let movedExisting = false;
   try {
-    const manifest = await downloadText(descriptor.checksumUrl);
-    const expectedHash = parseChecksumManifest(manifest, descriptor.archiveName);
-    const actualHash = await downloadFile(descriptor.archiveUrl, archivePath);
-    if (actualHash !== expectedHash) {
-      throw new Error(`Checksum mismatch for ${descriptor.archiveName}: expected ${expectedHash}, received ${actualHash}`);
+    const networkOptions = { allowInsecure: options.allowInsecure === true };
+    const manifestBytes = await downloadBuffer(descriptor.manifestUrl, { ...networkOptions, maxBytes: MAX_MANIFEST_BYTES, label: "Release manifest" });
+    const signatureBytes = await downloadBuffer(descriptor.signatureUrl, { ...networkOptions, maxBytes: MAX_SIGNATURE_BYTES, label: "Manifest signature" });
+    const verifyReleaseManifest = options.verifyManifest || verifyManifestBytes;
+    const authenticated = await verifyReleaseManifest(manifestBytes, signatureBytes, { keyRing: options.keyRing });
+    const manifest = validateManifest(authenticated, descriptor);
+    const artifact = selectManifestArtifact(manifest, descriptor.triple);
+    const { sha256: actualHash } = await downloadFile(descriptor.archiveUrl, archivePath, { ...networkOptions, expectedBytes: artifact.size });
+    if (actualHash !== artifact.sha256) {
+      throw new Error(`Checksum mismatch for ${descriptor.archiveName}: expected ${artifact.sha256}, received ${actualHash}`);
     }
     await extractExecutable(archivePath, descriptor.format, descriptor.executable, stagedBinary);
     if (descriptor.platform !== "win32") await chmod(stagedBinary, 0o755);
-    if (await exists(destination)) {
-      await rm(backup, { force: true });
-      await rename(destination, backup);
-      movedExisting = true;
-    }
-    try {
-      await rename(stagedBinary, destination);
-    } catch (error) {
-      if (movedExisting) await rename(backup, destination);
-      movedExisting = false;
-      throw error;
-    }
-    if (movedExisting) await rm(backup, { force: true });
-    return { destination, descriptor, sha256: actualHash };
+    // The staging directory lives beside the destination, so this is one
+    // same-filesystem atomic replacement. Never vacate the live path first.
+    await rename(stagedBinary, destination);
+    return { destination, descriptor, sha256: actualHash, manifest };
   } finally {
     await rm(temporaryDirectory, { recursive: true, force: true });
   }

package/lib/launcher.js

@@ -8,7 +8,7 @@ export async function ensureNativeBinary(binary = nativeBinaryPath()) {
     await access(binary, process.platform === "win32" ? constants.F_OK : constants.X_OK);
   } catch {
     throw new Error(
-      "The native Dynomate CLI is not installed. Reinstall @dynomate/cli without --ignore-scripts, or use a direct archive from https://releases.dynomate.io/cli/.",
+      "The native Dynomate CLI installation is incomplete. npm may not have run this package's install script. See https://dynomate.io/docs/cli/installation/ for installation and repair instructions.",
     );
   }
   return binary;

package/lib/manifest.js

@@ -0,0 +1,91 @@
+import { constants, createPublicKey, verify } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { MANIFEST_KEY_ID, PACKAGE_VERSION, RELEASE_TAG, TARGETS } from "./release.js";
+
+export const MAX_MANIFEST_BYTES = 256 * 1024;
+export const MAX_SIGNATURE_BYTES = 16 * 1024;
+export const MAX_ARTIFACT_BYTES = 512 * 1024 * 1024;
+export const DEFAULT_KEY_RING = new Map([[MANIFEST_KEY_ID, new URL("../keys/dynomate-cli-2026-01.pem", import.meta.url)]]);
+
+function fail(message) { throw new Error(`Invalid signed release manifest: ${message}`); }
+
+function requireExactKeys(value, expected, label) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) fail(`${label} contains unsupported or missing fields`);
+}
+
+function decodeSignature(bytes) {
+  const text = Buffer.from(bytes).toString("ascii");
+  if (!/^[A-Za-z0-9+/]+={0,2}\n$/.test(text)) throw new Error("Invalid manifest signature encoding");
+  const signature = Buffer.from(text.slice(0, -1), "base64");
+  if (`${signature.toString("base64")}\n` !== text) throw new Error("Invalid manifest signature encoding");
+  return signature;
+}
+
+export async function loadKeyRing(keyRing = DEFAULT_KEY_RING) {
+  try {
+    return new Map(await Promise.all([...keyRing].map(async ([keyId, value]) => [keyId, value instanceof URL ? await readFile(value, "utf8") : value])));
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error("The trusted Dynomate manifest public key is not packaged; refusing an unauthenticated installation.", { cause: error });
+    throw error;
+  }
+}
+
+export async function verifyManifestBytes(manifestBytes, signatureBytes, { keyRing = DEFAULT_KEY_RING } = {}) {
+  const signature = decodeSignature(signatureBytes);
+  const keys = await loadKeyRing(keyRing);
+  if (keys.size === 0) throw new Error("Release manifest signature verification failed: trusted key ring is empty");
+  const authenticatedBy = [];
+  for (const [keyId, publicKey] of keys) {
+    const key = createPublicKey(publicKey);
+    if (key.asymmetricKeyType !== "rsa" || key.asymmetricKeyDetails?.modulusLength !== 3072) {
+      throw new Error(`Trusted manifest key ${keyId} must be RSA-3072`);
+    }
+    if (verify("RSA-SHA256", manifestBytes, { key, padding: constants.RSA_PKCS1_PADDING }, signature)) authenticatedBy.push(keyId);
+  }
+  if (authenticatedBy.length !== 1) throw new Error("Release manifest signature verification failed");
+  let manifest;
+  try { manifest = JSON.parse(Buffer.from(manifestBytes).toString("utf8")); }
+  catch { throw new Error("Authenticated release manifest is not valid JSON"); }
+  if (manifest.keyId !== authenticatedBy[0]) fail("keyId does not match the signing key");
+  return manifest;
+}
+
+export function validateManifest(manifest, { version = PACKAGE_VERSION, tag = RELEASE_TAG } = {}) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) fail("root must be an object");
+  requireExactKeys(manifest, ["schemaVersion", "keyId", "version", "tag", "artifacts"], "root");
+  if (manifest.schemaVersion !== 1) fail("unsupported schemaVersion");
+  if (manifest.keyId !== MANIFEST_KEY_ID) fail(`unsupported keyId ${String(manifest.keyId)}`);
+  if (manifest.version !== version) fail(`version must be ${version}`);
+  if (manifest.tag !== tag) fail(`tag must be ${tag}`);
+  if (!Array.isArray(manifest.artifacts) || manifest.artifacts.length !== TARGETS.size) fail(`artifacts must contain exactly ${TARGETS.size} entries`);
+  const expectedByTriple = new Map([...TARGETS.values()].map((target) => [target.triple, target]));
+  const targets = new Set();
+  const filenames = new Set();
+  for (const artifact of manifest.artifacts) {
+    if (!artifact || typeof artifact !== "object" || Array.isArray(artifact)) fail("artifact must be an object");
+    const expected = expectedByTriple.get(artifact.target);
+    if (!expected) fail(`unexpected target ${String(artifact.target)}`);
+    if (targets.has(artifact.target)) fail(`duplicate target ${artifact.target}`);
+    targets.add(artifact.target);
+    const artifactKeys = ["target", "platform", "architecture", "format", "filename", "size", "sha256"];
+    if (expected.libc) artifactKeys.push("libc", "minimumLibcVersion");
+    requireExactKeys(artifact, artifactKeys, `artifact ${artifact.target}`);
+    const filename = `${tag}-${expected.triple}.${expected.format}`;
+    if (artifact.platform !== expected.manifestPlatform || artifact.architecture !== expected.architecture || artifact.format !== expected.format || artifact.filename !== filename) fail(`metadata does not match target ${artifact.target}`);
+    if ((artifact.libc ?? undefined) !== expected.libc || (artifact.minimumLibcVersion ?? undefined) !== expected.minimumLibcVersion) fail(`libc metadata does not match target ${artifact.target}`);
+    if (filenames.has(artifact.filename)) fail(`duplicate filename ${artifact.filename}`);
+    filenames.add(artifact.filename);
+    if (!/^[a-f0-9]{64}$/.test(artifact.sha256)) fail(`invalid sha256 for ${artifact.target}`);
+    if (!Number.isSafeInteger(artifact.size) || artifact.size <= 0 || artifact.size > MAX_ARTIFACT_BYTES) fail(`invalid size for ${artifact.target}`);
+  }
+  for (const triple of expectedByTriple.keys()) if (!targets.has(triple)) fail(`missing target ${triple}`);
+  return manifest;
+}
+
+export function selectManifestArtifact(manifest, triple) {
+  const matches = manifest.artifacts.filter((artifact) => artifact.target === triple);
+  if (matches.length !== 1) fail(`expected exactly one artifact for ${triple}`);
+  return matches[0];
+}

package/lib/network.js

@@ -2,16 +2,16 @@ import { createWriteStream } from "node:fs";
 import { createHash } from "node:crypto";
 import { get as httpGet } from "node:http";
 import { get as httpsGet } from "node:https";
+import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
 const MAX_REDIRECTS = 5;
-const MAX_MANIFEST_BYTES = 1024 * 1024;
 const REQUEST_TIMEOUT_MS = 30_000;
 
-function open(url, redirects = 0) {
+function open(url, { redirects = 0, allowInsecure = false } = {}) {
   return new Promise((resolve, reject) => {
     const parsed = new URL(url);
-    const get = parsed.protocol === "https:" ? httpsGet : parsed.protocol === "http:" ? httpGet : null;
+    const get = parsed.protocol === "https:" ? httpsGet : allowInsecure && parsed.protocol === "http:" ? httpGet : null;
     if (!get) return reject(new Error(`Unsupported download protocol: ${parsed.protocol}`));
     const request = get(parsed, { headers: { "user-agent": "@dynomate/cli installer" } }, (response) => {
       const status = response.statusCode ?? 0;
@@ -22,7 +22,7 @@ function open(url, redirects = 0) {
         if (parsed.protocol === "https:" && redirected.protocol !== "https:") {
           return reject(new Error(`Refusing insecure redirect while downloading ${url}`));
         }
-        return resolve(open(redirected.href, redirects + 1));
+        return resolve(open(redirected.href, { redirects: redirects + 1, allowInsecure }));
       }
       if (status !== 200) {
         response.resume();
@@ -37,25 +37,48 @@ function open(url, redirects = 0) {
   });
 }
 
-export async function downloadText(url) {
-  const response = await open(url);
+export async function downloadBuffer(url, { maxBytes, allowInsecure = false, label = "response" } = {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("A positive download limit is required");
+  const response = await open(url, { allowInsecure });
+  const declaredLength = Number(response.headers["content-length"]);
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    response.destroy();
+    throw new Error(`${label} is larger than the ${maxBytes}-byte limit`);
+  }
   const chunks = [];
   let length = 0;
   for await (const chunk of response) {
     length += chunk.length;
-    if (length > MAX_MANIFEST_BYTES) {
+    if (length > maxBytes) {
       response.destroy();
-      throw new Error(`Checksum manifest is larger than ${MAX_MANIFEST_BYTES} bytes`);
+      throw new Error(`${label} is larger than the ${maxBytes}-byte limit`);
     }
     chunks.push(chunk);
   }
-  return Buffer.concat(chunks).toString("utf8");
+  return Buffer.concat(chunks);
 }
 
-export async function downloadFile(url, destination) {
-  const response = await open(url);
+export async function downloadFile(url, destination, { expectedBytes, allowanceBytes = 64 * 1024, allowInsecure = false } = {}) {
+  if (!Number.isSafeInteger(expectedBytes) || expectedBytes <= 0) throw new Error("A positive signed artifact size is required");
+  const response = await open(url, { allowInsecure });
+  const maximumBytes = expectedBytes + allowanceBytes;
+  const declaredLength = Number(response.headers["content-length"]);
+  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
+    response.destroy();
+    throw new Error(`Artifact exceeds its signed size allowance (${maximumBytes} bytes)`);
+  }
   const hash = createHash("sha256");
-  response.on("data", (chunk) => hash.update(chunk));
-  await pipeline(response, createWriteStream(destination, { flags: "wx", mode: 0o600 }));
-  return hash.digest("hex");
+  const output = createWriteStream(destination, { flags: "wx", mode: 0o600 });
+  let receivedBytes = 0;
+  const limiter = new Transform({
+    transform(chunk, _encoding, callback) {
+      receivedBytes += chunk.length;
+      if (receivedBytes > maximumBytes) return callback(new Error(`Artifact exceeds its signed size allowance (${maximumBytes} bytes)`));
+      hash.update(chunk);
+      callback(null, chunk);
+    },
+  });
+  await pipeline(response, limiter, output);
+  if (receivedBytes !== expectedBytes) throw new Error(`Artifact size mismatch: expected ${expectedBytes} bytes, received ${receivedBytes}`);
+  return { sha256: hash.digest("hex"), receivedBytes };
 }

package/lib/release.js

@@ -5,12 +5,14 @@ const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.me
 export const PACKAGE_VERSION = packageJson.version;
 export const RELEASE_TAG = `dynomate-cli-v${PACKAGE_VERSION}`;
 export const DEFAULT_RELEASE_BASE_URL = "https://releases.dynomate.io/cli";
+export const MANIFEST_KEY_ID = "dynomate-cli-2026-01";
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*)?$/;
 
-const TARGETS = new Map([
-  ["darwin-arm64", { triple: "aarch64-apple-darwin", format: "tar.gz", executable: "dynomate-cli" }],
-  ["darwin-x64", { triple: "x86_64-apple-darwin", format: "tar.gz", executable: "dynomate-cli" }],
-  ["linux-x64", { triple: "x86_64-unknown-linux-gnu", format: "tar.gz", executable: "dynomate-cli" }],
-  ["win32-x64", { triple: "x86_64-pc-windows-msvc", format: "zip", executable: "dynomate-cli.exe" }],
+export const TARGETS = new Map([
+  ["darwin-arm64", { triple: "aarch64-apple-darwin", manifestPlatform: "macos", architecture: "arm64", format: "tar.gz", executable: "dynomate-cli" }],
+  ["darwin-x64", { triple: "x86_64-apple-darwin", manifestPlatform: "macos", architecture: "x64", format: "tar.gz", executable: "dynomate-cli" }],
+  ["linux-x64", { triple: "x86_64-unknown-linux-gnu", manifestPlatform: "linux", architecture: "x64", libc: "glibc", minimumLibcVersion: "2.35", format: "tar.gz", executable: "dynomate-cli" }],
+  ["win32-x64", { triple: "x86_64-pc-windows-msvc", manifestPlatform: "windows", architecture: "x64", format: "zip", executable: "dynomate-cli.exe" }],
 ]);
 
 export function selectTarget(platform = process.platform, arch = process.arch) {
@@ -29,7 +31,7 @@ export function releaseDescriptor({
   baseUrl = process.env.DYNOMATE_CLI_RELEASE_BASE_URL || DEFAULT_RELEASE_BASE_URL,
   version = PACKAGE_VERSION,
 } = {}) {
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+  if (!SEMVER_PATTERN.test(version)) {
     throw new Error(`Invalid package version: ${version}`);
   }
   const target = selectTarget(platform, arch);
@@ -42,24 +44,7 @@ export function releaseDescriptor({
     tag,
     archiveName,
     archiveUrl: `${releaseUrl}/${archiveName}`,
-    checksumUrl: `${releaseUrl}/SHA256SUMS`,
+    manifestUrl: `${releaseUrl}/manifest.json`,
+    signatureUrl: `${releaseUrl}/manifest.sig`,
   };
 }
-
-export function parseChecksumManifest(text, archiveName) {
-  const matches = [];
-  for (const line of text.split(/\r?\n/)) {
-    if (!line.trim()) continue;
-    const match = /^([a-fA-F0-9]{64})\s+\*?(.+?)\s*$/.exec(line);
-    if (!match) throw new Error("Invalid SHA256SUMS manifest");
-    if (match[2] === archiveName) matches.push(match[1].toLowerCase());
-  }
-  if (matches.length !== 1) {
-    throw new Error(
-      matches.length === 0
-        ? `SHA256SUMS does not contain ${archiveName}`
-        : `SHA256SUMS contains duplicate entries for ${archiveName}`,
-    );
-  }
-  return matches[0];
-}

package/package.json

@@ -1,17 +1,16 @@
 {
   "name": "@dynomate/cli",
-  "version": "0.0.10",
+  "version": "0.1.0",
   "description": "Installer and launcher for the native Dynomate CLI",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Bagio-labs/hammer.git",
-    "directory": "packages/cli"
+    "url": "https://github.com/dynomate/dynomate-cli"
   },
-  "homepage": "https://dynomate.io",
+  "homepage": "https://dynomate.io/docs/cli/installation/",
   "bugs": {
-    "url": "https://github.com/Bagio-labs/hammer/issues"
+    "url": "https://github.com/dynomate/dynomate-cli/issues"
   },
   "publishConfig": {
     "access": "public",
@@ -26,6 +25,7 @@
   "files": [
     "bin/",
     "lib/",
+    "keys/",
     "scripts/",
     "LICENSE",
     "README.md"