@effectstream/solana-node 0.103.0 → 0.103.2

package/README.md

@@ -6,7 +6,7 @@ cluster for local development. Downloads a pinned build into
 `vendor/bin/solana-test-validator` on first use so the orchestrator can boot it
 without each developer installing the Solana CLI.
 
-- Pinned Agave release, verified by SHA-256 before it is ever executed.
+- Pinned Agave release (3.0.14), verified by SHA-256 before it is ever executed.
 - Exposes a `solana-node` bin plus a programmatic `run()`.
 - Consumed by `@effectstream/sync`'s `SolanaFetcher` via JSON-RPC on `:8899`.
 - Used by the orchestrator's `launchSolana` step for end-to-end local testing.
@@ -58,11 +58,14 @@ so this package hashes the **extracted binary** and refuses to run anything that
 isn't one of the pinned official builds. Set `SOLANA_NODE_SKIP_CHECKSUM=1` to
 bypass when deliberately testing a locally-built validator.
 
-Regenerate the digests whenever the pinned version changes:
+Digests live in `checksums.js` and the check itself is
+`@effectstream/binary-checksum`, shared with the other verified wrappers.
 
-```bash
-shasum -a 256 packages/binaries/solana-node/vendor/bin/solana-test-validator
-```
+These three digests are **self-recorded**: they were hashed from a download on a
+maintainer's machine, which pins the artifact against later mutation but does not
+attest that it was correct to begin with. Regenerating them through
+`scripts/generate-binary-checksums.ts`, so an Agave-published checksum backs them
+the way bitcoin-core and the Grafana wrappers now are, is open work.
 
 ## Networking
 

package/checksums.js

@@ -0,0 +1,25 @@
+// NOT a generated file, unlike the other `checksums.js` in packages/binaries.
+//
+// These three digests predate `scripts/generate-binary-checksums.ts` and are
+// preserved verbatim from the original hand-recorded table. They are deliberately
+// NOT relabelled 'upstream-verified': that claim means the archive was matched
+// against a checksum the vendor publishes, and nobody has done that for these.
+// Their real provenance is "recorded from a download on one maintainer's machine",
+// which pins the artifact against later mutation and attests nothing about origin.
+//
+// Regenerating them through the script, so Agave's published sums actually back
+// them, is worthwhile follow-up work. Until then this file states what is known
+// rather than implying more.
+export const CHECKSUM_VERSION = '3.0.14';
+
+export const CHECKSUMS = {
+  'linux-x64': '80f3bc0e3fa6a3090e69bafbfe00b249eaa655c5874ac83aebb6acdb157140ab',
+  'darwin-x64': '2a4a5ad21f7cd50021fa55948710ee2f3559d9cccf95f7a31094e45c27023b52',
+  'darwin-arm64': 'ab00c9a189341ef61402efce1a27713bb1b0ffb941715cea56ed5aa133992fe1',
+};
+
+export const CHECKSUM_PROVENANCE = {
+  'linux-x64': 'self-recorded',
+  'darwin-x64': 'self-recorded',
+  'darwin-arm64': 'self-recorded',
+};

package/index.js

@@ -1,8 +1,9 @@
 import BinWrapper from '@xhmikosr/bin-wrapper';
+import { verifyBinaryChecksum } from '@effectstream/binary-checksum';
+import { CHECKSUMS } from './checksums.js';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 
@@ -56,58 +57,23 @@ const bin = new BinWrapper()
 
 export default bin;
 
-/**
- * SHA-256 of the extracted `solana-test-validator` in each published v3.0.14
- * asset. bin-wrapper has no integrity support and discards the archive after
- * extracting, so this verifies the binary we are about to execute rather than
- * the tarball. Regenerate on every `version` bump with:
- *
- *   shasum -a 256 packages/binaries/solana-node/vendor/bin/solana-test-validator
- *
- * Deliberately matched as a SET rather than by `os.arch()`. Asset selection goes
- * through bin-wrapper -> os-filter-obj -> arch, and the reported architecture
- * has not always agreed with `os.arch()`: arch@2.x had no notion of arm64 at all
- * (`darwin` was hardcoded to 'x64'), which is why every Mac used to download the
- * x86_64 build and run it under Rosetta. The root `overrides` now force arch@3,
- * so selection is correct today — but membership in the pinned set is immune to
- * that class of mismatch (including deliberate emulation) while still proving
- * the binary is one of the three official builds, which is the property that
- * matters here.
- */
-const CHECKSUMS = {
-  'linux-x64': '80f3bc0e3fa6a3090e69bafbfe00b249eaa655c5874ac83aebb6acdb157140ab',
-  'darwin-x64': '2a4a5ad21f7cd50021fa55948710ee2f3559d9cccf95f7a31094e45c27023b52',
-  'darwin-arm64': 'ab00c9a189341ef61402efce1a27713bb1b0ffb941715cea56ed5aa133992fe1',
-};
-
 /**
  * Fail closed if the downloaded validator isn't one of the builds we pinned.
- * Set SOLANA_NODE_SKIP_CHECKSUM=1 to bypass when intentionally testing a
- * locally-built validator.
+ * Digests live in ./checksums.js. Set SOLANA_NODE_SKIP_CHECKSUM=1 to bypass when
+ * intentionally testing a locally-built validator.
+ *
+ * The set-membership rationale (rather than a lookup by `os.arch()`) now lives
+ * with the shared helper in @effectstream/binary-checksum, since it applies to
+ * every wrapper and not just this one.
  */
 function verifyChecksum(binaryPath) {
-  if (process.env.SOLANA_NODE_SKIP_CHECKSUM === '1') {
-    console.warn('[solana-node] checksum verification skipped (SOLANA_NODE_SKIP_CHECKSUM=1)');
-    return;
-  }
-  const actual = crypto
-    .createHash('sha256')
-    .update(fs.readFileSync(binaryPath))
-    .digest('hex');
-
-  const match = Object.entries(CHECKSUMS).find(([, digest]) => digest === actual);
-  if (!match) {
-    throw new Error(
-      `[solana-node] checksum mismatch for ${binaryPath}\n` +
-      `  got      ${actual}\n` +
-      `  expected one of:\n` +
-      Object.entries(CHECKSUMS)
-        .map(([platform, digest]) => `    ${digest}  (${platform})`)
-        .join('\n') +
-      `\nThis is not a pinned v${version} build. Refusing to run it.`,
-    );
-  }
-  return match[0];
+  return verifyBinaryChecksum({
+    binaryPath,
+    checksums: CHECKSUMS,
+    packageName: 'solana-node',
+    skipEnvVar: 'SOLANA_NODE_SKIP_CHECKSUM',
+    version,
+  });
 }
 
 export async function run(options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effectstream/solana-node",
-  "version": "0.103.0",
+  "version": "0.103.2",
   "type": "module",
   "main": "./index.js",
   "bin": {
@@ -10,6 +10,7 @@
     "start": "node index.js"
   },
   "dependencies": {
+    "@effectstream/binary-checksum": "0.103.2",
     "@xhmikosr/bin-wrapper": "^5.0.0"
   },
   "homepage": "https://effectstream.github.io/docs/",