@effectstream/grafana-loki 0.103.1 → 0.103.2

package/README.md

@@ -38,6 +38,26 @@ land in Loki, queryable from a local Grafana. Out of the box you get
 component-tagged (`ComponentNames`) logs without writing any collector
 config.
 
+## Integrity
+
+`bin-wrapper` has no checksum support and discards the archive after extracting,
+so this package hashes the **extracted `loki`** and refuses to run anything
+that is not one of the pinned v3.5.8 builds. Set `GRAFANA_LOKI_SKIP_CHECKSUM=1` to bypass when
+deliberately running a local build.
+
+Digests live in `checksums.js` and the check is `@effectstream/binary-checksum`,
+shared with the other verified wrappers. Every entry is **upstream-verified**:
+the archive each digest came from was matched against the checksum the vendor
+publishes before the binary inside it was hashed, so the digest traces back to
+something the vendor stands behind rather than to whatever a download happened to
+return.
+
+Regenerate after a version bump:
+
+```bash
+bun scripts/generate-binary-checksums.ts grafana-loki
+```
+
 ## Links
 
 - Docs: https://effectstream.github.io/docs/packages/binaries/grafana-loki

package/checksums.js

@@ -0,0 +1,26 @@
+// GENERATED FILE. Do not edit by hand.
+// Regenerate with: bun scripts/generate-binary-checksums.ts grafana-loki
+//
+// SHA-256 of the extracted binary in each pinned v3.5.8 asset.
+//
+// 'upstream-verified' means the archive this digest came from matched the
+// checksum the vendor publishes, so the digest is traceable to the vendor.
+// 'self-recorded' means no upstream manifest was available: the digest pins the
+// artifact against later mutation but does not attest that it was ever good.
+export const CHECKSUM_VERSION = '3.5.8';
+
+export const CHECKSUMS = {
+  'linux-x64': 'a9c70d81ae983ca47defe8eff65bf833eee0932114fbfaa9556b1633ac0235f2',
+  'linux-arm64': 'e4021bcd7591412be792d89f4c462c0690296256d00a77e1cb81fb48456994cb',
+  'darwin-x64': 'dcf8904270401a53ee7e5e8a2f37a8e0a3f552aa465109e50431d20eaf839ca5',
+  'darwin-arm64': '1f589bdc06492fd74c970832f7aab54a22326eaf0b37b356512447166efe9425',
+  'win32-x64': 'ec530b5553b9da016ba8f0570d8b49b615fa75891dff4385194717f844ccfa32',
+};
+
+export const CHECKSUM_PROVENANCE = {
+  'linux-x64': 'upstream-verified',
+  'linux-arm64': 'upstream-verified',
+  'darwin-x64': 'upstream-verified',
+  'darwin-arm64': 'upstream-verified',
+  'win32-x64': 'upstream-verified',
+};

package/index.js

@@ -4,6 +4,8 @@ import BinWrapper from '@xhmikosr/bin-wrapper';
 import { spawn } from 'node:child_process';
 import process from 'node:process';
 import fs from 'node:fs';
+import { verifyBinaryChecksum } from '@effectstream/binary-checksum';
+import { CHECKSUMS } from './checksums.js';
 
 console.log(`Starting Grafana Loki on ${platform()} ${arch()}`);
 
@@ -58,6 +60,22 @@ const bin = new BinWrapper()
 
 
 async function runBinary(args = []) {
+	// Download and verify BEFORE `bin.run`. `bin.run()` resolves the binary and
+	// then executes it (the `.version()` constraint above makes it exec
+	// `--version` to check), so calling it first would run an unverified binary
+	// and leave the integrity check with nothing left to protect.
+	if (!fs.existsSync(bin.path())) {
+		await bin.download();
+	}
+	const flavour = verifyBinaryChecksum({
+		binaryPath: bin.path(),
+		checksums: CHECKSUMS,
+		packageName: 'grafana-loki',
+		skipEnvVar: 'GRAFANA_LOKI_SKIP_CHECKSUM',
+		version,
+	});
+	console.log(`[grafana-loki] verified loki v${version} (${flavour})`);
+
 	// Check if the binary is installed working.
 	await bin.run(['--version']);
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@effectstream/grafana-loki",
-  "version": "0.103.1",
+  "version": "0.103.2",
   "license": "(MIT OR Apache-2.0)",
+  "type": "module",
   "description": "Grafana Loki binary wrapper for EffectStream",
   "main": "index.js",
   "bin": {
@@ -11,6 +12,7 @@
     "start": "node index.js"
   },
   "dependencies": {
+    "@effectstream/binary-checksum": "0.103.2",
     "@xhmikosr/bin-wrapper": "^13.2.0"
   },
   "homepage": "https://effectstream.github.io/docs/",