@lpm-registry/cli 0.41.1 → 0.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.41.1",
+	"version": "0.43.0",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {
@@ -61,12 +61,13 @@
 		"xcode": "^3.0.1"
 	},
 	"optionalDependencies": {
-		"@lpm-registry/cli-darwin-arm64": "0.41.1",
-		"@lpm-registry/cli-darwin-x64": "0.41.1",
-		"@lpm-registry/cli-linux-x64": "0.41.1",
-		"@lpm-registry/cli-linux-arm64": "0.41.1",
-		"@lpm-registry/cli-win32-x64": "0.41.1",
-		"keytar": "^7.9.0"
+		"@lpm-registry/cli-darwin-arm64": "0.43.0",
+		"@lpm-registry/cli-darwin-x64": "0.43.0",
+		"@lpm-registry/cli-linux-x64": "0.43.0",
+		"@lpm-registry/cli-linux-arm64": "0.43.0",
+		"@lpm-registry/cli-win32-x64": "0.43.0",
+		"keytar": "^7.9.0",
+		"sigstore": "^3.0.0"
 	},
 	"type": "module",
 	"engines": {

package/scripts/__tests__/install-binary.test.js

@@ -0,0 +1,346 @@
+/**
+ * Tier-2 integrity-gate tests for scripts/install-binary.js.
+ *
+ * The suite mocks the network primitives (`download`, `downloadToBuffer`,
+ * `sha256File`, `tryVerifyManifestSignature`) via the dependency-injection
+ * `deps` parameter on `tryGitHubDownload`. No real network calls fire.
+ *
+ * Coverage:
+ *   - happy path: manifest SHA matches → binary installed.
+ *   - manifest 404 → return null (falls through to JS CLI fallback).
+ *   - SHA mismatch → return null + tmp file cleaned up.
+ *   - manifest missing the platform binary entry → return null.
+ *   - Sigstore verifier rejected → return null.
+ *   - Sigstore package unavailable → SHA-only path runs, WARN logged.
+ *   - Sigstore verified → both gates surface.
+ *   - LPM_INSTALL_INSECURE=1 → all integrity skipped, install proceeds.
+ *
+ * Pure-helper coverage:
+ *   - parseManifestEntry: canonical, malformed, missing-platform.
+ */
+
+import crypto from "node:crypto"
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
+
+import {
+	download,
+	downloadToBuffer,
+	parseManifestEntry,
+	tryGitHubDownload,
+} from "../install-binary.js"
+
+function sha256(bytes) {
+	return crypto.createHash("sha256").update(bytes).digest("hex")
+}
+
+describe("parseManifestEntry", () => {
+	it("returns the SHA for a matching filename", () => {
+		const manifest =
+			"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  lpm-darwin-arm64\n" +
+			"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb  lpm-linux-x64\n"
+		expect(parseManifestEntry(manifest, "lpm-linux-x64")).toBe(
+			"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+		)
+	})
+
+	it("returns null when the filename is not enumerated", () => {
+		const manifest =
+			"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  lpm-darwin-arm64\n"
+		expect(parseManifestEntry(manifest, "lpm-linux-x64")).toBeNull()
+	})
+
+	it("returns null on malformed lines (short digest)", () => {
+		const manifest = "abc  lpm-linux-x64\n"
+		expect(parseManifestEntry(manifest, "lpm-linux-x64")).toBeNull()
+	})
+
+	it("returns null on malformed lines (non-hex)", () => {
+		const manifest =
+			"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz  lpm-linux-x64\n"
+		expect(parseManifestEntry(manifest, "lpm-linux-x64")).toBeNull()
+	})
+
+	it("returns null on malformed lines (single-space separator)", () => {
+		const manifest =
+			"0000000000000000000000000000000000000000000000000000000000000000 lpm-linux-x64\n"
+		expect(parseManifestEntry(manifest, "lpm-linux-x64")).toBeNull()
+	})
+
+	it("strips trailing carriage returns for Windows-format manifests", () => {
+		const manifest =
+			"1111111111111111111111111111111111111111111111111111111111111111  lpm-darwin-arm64\r\n"
+		expect(parseManifestEntry(manifest, "lpm-darwin-arm64")).toBe(
+			"1111111111111111111111111111111111111111111111111111111111111111",
+		)
+	})
+
+	it("lowercases hex digests", () => {
+		const manifest =
+			"ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890  X\n"
+		expect(parseManifestEntry(manifest, "X")).toBe(
+			"abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
+		)
+	})
+})
+
+describe("tryGitHubDownload", () => {
+	let tmpBinDir
+	let assetBytes
+	let assetSha
+	let manifestText
+	let priorInsecure
+
+	beforeEach(() => {
+		tmpBinDir = fs.mkdtempSync(path.join(os.tmpdir(), "lpm-install-binary-"))
+		assetBytes = Buffer.from("native-binary-fixture-bytes")
+		assetSha = sha256(assetBytes)
+		manifestText = `${assetSha}  lpm-linux-x64\n`
+		priorInsecure = process.env.LPM_INSTALL_INSECURE
+		delete process.env.LPM_INSTALL_INSECURE
+		// Stub console.log so the test output stays clean. Replace
+		// per-test so individual cases can re-bind to capture lines.
+		vi.spyOn(console, "log").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		fs.rmSync(tmpBinDir, { recursive: true, force: true })
+		if (priorInsecure === undefined) {
+			delete process.env.LPM_INSTALL_INSECURE
+		} else {
+			process.env.LPM_INSTALL_INSECURE = priorInsecure
+		}
+		vi.restoreAllMocks()
+	})
+
+	function mkDeps(overrides = {}) {
+		return {
+			destDir: tmpBinDir,
+			download: vi.fn(async (_url, dest) => {
+				fs.writeFileSync(dest, assetBytes)
+			}),
+			downloadToBuffer: vi.fn(async url => {
+				if (url.endsWith("SHA256SUMS.txt")) {
+					return Buffer.from(manifestText, "utf-8")
+				}
+				if (url.endsWith("SHA256SUMS.txt.sigstore")) {
+					return Buffer.from("dummy-bundle-bytes")
+				}
+				throw Object.assign(new Error("not mocked"), { statusCode: 404 })
+			}),
+			sha256File: vi.fn(async filePath => sha256(fs.readFileSync(filePath))),
+			tryVerifyManifestSignature: vi.fn(async () => "unavailable"),
+			...overrides,
+		}
+	}
+
+	it("installs the verified binary when SHA matches and Sigstore is unavailable", async () => {
+		const deps = mkDeps()
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeTruthy()
+		expect(fs.existsSync(result)).toBe(true)
+		// The installed bytes must match the verified bytes — guards
+		// against a regression that "verifies" but installs garbage.
+		expect(fs.readFileSync(result)).toEqual(assetBytes)
+		expect(deps.downloadToBuffer).toHaveBeenCalledTimes(2)
+		expect(deps.sha256File).toHaveBeenCalledTimes(1)
+	})
+
+	it("returns null when the manifest is 404 (predates signed-install gate)", async () => {
+		const deps = mkDeps({
+			downloadToBuffer: vi.fn(async url => {
+				if (url.endsWith("SHA256SUMS.txt")) {
+					throw Object.assign(new Error("HTTP 404"), { statusCode: 404 })
+				}
+				return Buffer.from("never reached")
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeNull()
+		// Asset must NOT have been fetched once we know the manifest
+		// is missing — releases that predate the gate are install-via-
+		// manual-link, not silently downgraded to unsigned.
+		expect(deps.download).not.toHaveBeenCalled()
+	})
+
+	it("returns null and cleans up the tmp file when SHA mismatches", async () => {
+		const wrongSha =
+			"0000000000000000000000000000000000000000000000000000000000000000"
+		const deps = mkDeps({
+			downloadToBuffer: vi.fn(async url => {
+				if (url.endsWith("SHA256SUMS.txt")) {
+					return Buffer.from(`${wrongSha}  lpm-linux-x64\n`, "utf-8")
+				}
+				return Buffer.from("dummy-bundle-bytes")
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeNull()
+		expect(deps.download).toHaveBeenCalledTimes(1)
+		// destDir must be empty — the rejected binary's tmp file must be
+		// cleaned up so no partially-downloaded asset survives the gate.
+		expect(fs.readdirSync(tmpBinDir)).toEqual([])
+	})
+
+	it("returns null when the manifest does not enumerate the platform binary", async () => {
+		const deps = mkDeps({
+			downloadToBuffer: vi.fn(async url => {
+				if (url.endsWith("SHA256SUMS.txt")) {
+					return Buffer.from(`${assetSha}  lpm-some-other-platform\n`, "utf-8")
+				}
+				return Buffer.from("dummy-bundle-bytes")
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeNull()
+	})
+
+	it("returns null when Sigstore verifier explicitly rejects the bundle", async () => {
+		const deps = mkDeps({
+			tryVerifyManifestSignature: vi.fn(async () => "rejected"),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeNull()
+		expect(deps.download).not.toHaveBeenCalled()
+	})
+
+	it("degrades to SHA-only with WARN when sigstore package is unavailable", async () => {
+		const logSpy = vi.spyOn(console, "log")
+		const deps = mkDeps({
+			tryVerifyManifestSignature: vi.fn(async () => "unavailable"),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeTruthy()
+		const warned = logSpy.mock.calls.some(args =>
+			String(args[0] ?? "").includes(
+				"optional 'sigstore' package not available",
+			),
+		)
+		expect(warned).toBe(true)
+	})
+
+	it("emits Sigstore verified message when verifier succeeds", async () => {
+		const logSpy = vi.spyOn(console, "log")
+		const deps = mkDeps({
+			tryVerifyManifestSignature: vi.fn(async () => "verified"),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeTruthy()
+		const verifiedLine = logSpy.mock.calls.some(args =>
+			String(args[0] ?? "").includes("Verified Sigstore signature on manifest"),
+		)
+		expect(verifiedLine).toBe(true)
+	})
+
+	it("skips ALL integrity checks under LPM_INSTALL_INSECURE=1 with a loud WARN", async () => {
+		process.env.LPM_INSTALL_INSECURE = "1"
+		const logSpy = vi.spyOn(console, "log")
+		// downloadToBuffer must NOT be called when insecure mode is on —
+		// the manifest fetch is part of the integrity flow that gets
+		// skipped wholesale.
+		const deps = mkDeps({
+			downloadToBuffer: vi.fn(async () => {
+				throw new Error(
+					"manifest fetch must not run under LPM_INSTALL_INSECURE=1",
+				)
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeTruthy()
+		expect(fs.readFileSync(result)).toEqual(assetBytes)
+		const warned = logSpy.mock.calls.some(args =>
+			String(args[0] ?? "").includes("LPM_INSTALL_INSECURE=1"),
+		)
+		expect(warned).toBe(true)
+		expect(deps.downloadToBuffer).not.toHaveBeenCalled()
+	})
+
+	it("returns null and cleans up if the asset download fails", async () => {
+		const deps = mkDeps({
+			download: vi.fn(async () => {
+				throw new Error("network down")
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeNull()
+	})
+
+	it("treats a missing Sigstore bundle as opportunistic skip (SHA gate still runs)", async () => {
+		const logSpy = vi.spyOn(console, "log")
+		// Bundle fetch fails; manifest succeeds. SHA gate still runs.
+		const deps = mkDeps({
+			downloadToBuffer: vi.fn(async url => {
+				if (url.endsWith("SHA256SUMS.txt")) {
+					return Buffer.from(manifestText, "utf-8")
+				}
+				throw Object.assign(new Error("HTTP 404"), { statusCode: 404 })
+			}),
+			tryVerifyManifestSignature: vi.fn(async () => {
+				throw new Error("must not be called when bundle is absent")
+			}),
+		})
+		const result = await tryGitHubDownload("0.42.0", "lpm-linux-x64", deps)
+		expect(result).toBeTruthy()
+		expect(deps.tryVerifyManifestSignature).not.toHaveBeenCalled()
+		// SHA-only path was the floor — no Sigstore line printed.
+		const sigstoreLine = logSpy.mock.calls.some(args =>
+			String(args[0] ?? "").includes("Verified Sigstore signature"),
+		)
+		expect(sigstoreLine).toBe(false)
+	})
+})
+
+/**
+ * HTTPS-only transport hardening. The integrity gate's SHA / Sigstore
+ * verification only protects what's on the wire — a redirect that
+ * downgrades transport to plaintext would let an on-path attacker
+ * intercept the bytes that later get hashed and force the unsigned-
+ * fallback warning path.
+ *
+ * Mitigation has two layers:
+ *
+ *   1. Entry check on both helpers refuses any non-`https://` URL.
+ *   2. The redirect handler re-enters the same function with the
+ *      resolved Location, so a `Location: http://…` triggers the
+ *      same entry check on the recursive call. No real HTTPS server
+ *      is needed to prove this — the property is structural.
+ *
+ * A regression guard asserts that `node:http` is no longer imported,
+ * so the dual-client selector that triggered the audit finding can't
+ * silently come back via a future refactor.
+ */
+describe("Tier-2 transport hardening (HTTPS-only)", () => {
+	it("download() rejects non-HTTPS initial URLs", async () => {
+		await expect(download("http://example.com/x", "/tmp/x")).rejects.toThrow(
+			/refusing non-HTTPS transport/,
+		)
+	})
+
+	it("downloadToBuffer() rejects non-HTTPS initial URLs", async () => {
+		await expect(
+			downloadToBuffer("http://example.com/x", 1024),
+		).rejects.toThrow(/refusing non-HTTPS transport/)
+	})
+
+	it("rejects ftp://, file://, javascript:, and other non-https schemes", async () => {
+		for (const scheme of ["ftp", "file", "javascript", "data"]) {
+			await expect(
+				downloadToBuffer(`${scheme}://payload`, 1024),
+			).rejects.toThrow(/refusing non-HTTPS transport/)
+		}
+	})
+
+	it("does not import node:http (regression guard for the dual-client selector)", () => {
+		const src = fs.readFileSync(
+			path.join(
+				path.dirname(new URL(import.meta.url).pathname),
+				"..",
+				"install-binary.js",
+			),
+			"utf-8",
+		)
+		expect(src).not.toMatch(/from\s+["']node:http["']/)
+	})
+})

package/scripts/install-binary.js

@@ -5,55 +5,50 @@
  *
  * Runs as a postinstall hook. Resolution order:
  *
- * 1. optionalDependencies — platform package installed by npm (fastest, cached)
- * 2. GitHub Releases — direct download if optionalDependencies missing (--no-optional)
- * 3. Graceful fallback — JS CLI handles commands if binary unavailable
+ * 1. optionalDependencies — platform package installed by npm (fastest, cached).
+ *    Integrity story: npm provenance attestation, verified by the npm registry
+ *    at install time. No extra check needed here.
+ * 2. GitHub Releases — direct download if optionalDependencies missing
+ *    (--no-optional, corporate proxies blocking scoped packages, resolution
+ *    failure). Integrity story: every byte is anchored to a Sigstore-signed
+ *    `SHA256SUMS.txt` manifest published per release. The `sigstore` npm
+ *    package is consulted as an optional dependency — when resolvable, full
+ *    Sigstore bundle verification runs; when not, SHA-256 against the signed
+ *    manifest is the floor. Fail-closed on any integrity gate.
+ * 3. Graceful fallback — JS CLI handles commands if Tier 2 returns null.
  *
  * After resolving the binary, hard-links it over bin/lpm.js so subsequent
  * runs execute the native binary directly (zero Node.js overhead).
  *
- * Follows the esbuild pattern: https://github.com/evanw/esbuild
+ * Set `LPM_INSTALL_INSECURE=1` to skip every Tier-2 integrity check (escape
+ * valve for emergency installs from releases that predate the signed-install
+ * gate). Emits a loud WARN on every use.
+ *
+ * Follows the esbuild postinstall pattern: https://github.com/evanw/esbuild
  */
 
 import { execSync } from "node:child_process"
+import crypto from "node:crypto"
 import fs from "node:fs"
-import http from "node:http"
 import https from "node:https"
 import { createRequire } from "node:module"
 import os from "node:os"
 import path from "node:path"
-import { fileURLToPath } from "node:url"
+import { fileURLToPath, pathToFileURL } from "node:url"
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const pkgDir = path.join(__dirname, "..")
 const binDir = path.join(pkgDir, "bin")
 const require = createRequire(import.meta.url)
 
-// Platform → { package name, binary filename in package }
 const PLATFORMS = {
-	"darwin-arm64": {
-		pkg: "@lpm-registry/cli-darwin-arm64",
-		binary: "lpm",
-	},
-	"darwin-x64": {
-		pkg: "@lpm-registry/cli-darwin-x64",
-		binary: "lpm",
-	},
-	"linux-x64": {
-		pkg: "@lpm-registry/cli-linux-x64",
-		binary: "lpm",
-	},
-	"linux-arm64": {
-		pkg: "@lpm-registry/cli-linux-arm64",
-		binary: "lpm",
-	},
-	"win32-x64": {
-		pkg: "@lpm-registry/cli-win32-x64",
-		binary: "lpm.exe",
-	},
+	"darwin-arm64": { pkg: "@lpm-registry/cli-darwin-arm64", binary: "lpm" },
+	"darwin-x64": { pkg: "@lpm-registry/cli-darwin-x64", binary: "lpm" },
+	"linux-x64": { pkg: "@lpm-registry/cli-linux-x64", binary: "lpm" },
+	"linux-arm64": { pkg: "@lpm-registry/cli-linux-arm64", binary: "lpm" },
+	"win32-x64": { pkg: "@lpm-registry/cli-win32-x64", binary: "lpm.exe" },
 }
 
-// GitHub Releases fallback URLs
 const GITHUB_RELEASES =
 	"https://github.com/lpm-dev/rust-client/releases/download"
 const GITHUB_BINARY_NAMES = {
@@ -64,7 +59,17 @@ const GITHUB_BINARY_NAMES = {
 	"win32-x64": "lpm-win32-x64.exe",
 }
 
-async function main() {
+const MANIFEST_MAX_BYTES = 64 * 1024
+const BUNDLE_MAX_BYTES = 1024 * 1024
+const ASSET_MAX_BYTES = 256 * 1024 * 1024
+
+const SIGSTORE_IDENTITY = {
+	certificateIdentityRegExp:
+		"^https://github\\.com/lpm-dev/rust-client/\\.github/workflows/release\\.yml@.+",
+	certificateOIDCIssuer: "https://token.actions.githubusercontent.com",
+}
+
+export async function main() {
 	const platform = `${process.platform}-${os.arch()}`
 	const platformInfo = PLATFORMS[platform]
 
@@ -79,10 +84,8 @@ async function main() {
 		fs.readFileSync(path.join(pkgDir, "package.json"), "utf-8"),
 	)
 
-	// ── Tier 1: Try optionalDependencies (platform package) ──────────
 	let binaryPath = tryOptionalDependency(platformInfo)
 
-	// ── Tier 2: Direct download from GitHub Releases ─────────────────
 	if (!binaryPath) {
 		const githubBinaryName = GITHUB_BINARY_NAMES[platform]
 		if (githubBinaryName) {
@@ -95,30 +98,20 @@ async function main() {
 		return
 	}
 
-	// ── Hard-link optimization ───────────────────────────────────────
-	// Replace bin/lpm.js with a hard link to the native binary.
-	// After this, `lpm` on PATH IS the Rust binary — zero Node.js overhead.
 	if (process.platform !== "win32") {
 		tryHardLink(binaryPath)
 	} else {
-		// Windows: copy instead of hard-link (npm creates .cmd shims)
 		tryCopyBinary(binaryPath)
 	}
 }
 
-/**
- * Tier 1: Resolve binary from optionalDependencies platform package.
- * Returns the path to the binary, or null if not found.
- */
 function tryOptionalDependency(platformInfo) {
 	try {
-		// require.resolve finds the package in node_modules
 		const pkgJsonPath = require.resolve(`${platformInfo.pkg}/package.json`)
-		const pkgDir = path.dirname(pkgJsonPath)
-		const binaryPath = path.join(pkgDir, platformInfo.binary)
+		const platformPkgDir = path.dirname(pkgJsonPath)
+		const binaryPath = path.join(platformPkgDir, platformInfo.binary)
 
 		if (fs.existsSync(binaryPath)) {
-			// Verify the binary is executable
 			try {
 				execSync(`"${binaryPath}" --version`, {
 					stdio: "ignore",
@@ -133,55 +126,162 @@ function tryOptionalDependency(platformInfo) {
 			}
 		}
 	} catch {
-		// Package not installed (--no-optional, or resolution failed)
+		// Package not installed (--no-optional, or resolution failed).
 	}
 
 	return null
 }
 
 /**
- * Tier 2: Download binary directly from GitHub Releases.
- * Returns the path to the downloaded binary, or null on failure.
+ * Tier 2: download binary from GitHub Releases with end-to-end integrity.
+ *
+ * Returns the path to the verified, executable binary on success, or null
+ * on any failure (manifest 404, SHA mismatch, Sigstore rejection, network
+ * error). `null` falls through to the JS CLI fallback in `main` — Tier 2
+ * never silently installs an unverified binary.
+ *
+ * Exported for testability — `vi.mock` of the network calls drives this
+ * function directly.
  */
-async function tryGitHubDownload(version, githubBinaryName) {
-	const url = `${GITHUB_RELEASES}/v${version}/${githubBinaryName}`
+export async function tryGitHubDownload(version, githubBinaryName, deps = {}) {
+	const downloadFn = deps.download || download
+	const downloadToBufferFn = deps.downloadToBuffer || downloadToBuffer
+	const sha256FileFn = deps.sha256File || sha256File
+	const verifyFn = deps.tryVerifyManifestSignature || tryVerifyManifestSignature
+	const destDir = deps.destDir || binDir
+	const insecure = process.env.LPM_INSTALL_INSECURE === "1"
+
+	const manifestUrl = `${GITHUB_RELEASES}/v${version}/SHA256SUMS.txt`
+	const bundleUrl = `${GITHUB_RELEASES}/v${version}/SHA256SUMS.txt.sigstore`
+	const assetUrl = `${GITHUB_RELEASES}/v${version}/${githubBinaryName}`
+
+	let manifestBody = null
+	let bundleBody = null
+
+	if (insecure) {
+		console.log(
+			"[lpm] WARN: LPM_INSTALL_INSECURE=1 — skipping ALL integrity verification on Tier-2 download",
+		)
+	} else {
+		try {
+			manifestBody = await downloadToBufferFn(manifestUrl, MANIFEST_MAX_BYTES)
+		} catch (err) {
+			if (err && err.statusCode === 404) {
+				console.log(
+					`[lpm] ERROR: release v${version} does not ship SHA256SUMS.txt — this release predates LPM's signed-install gate.`,
+				)
+				console.log(
+					`[lpm]        Install manually from https://github.com/lpm-dev/rust-client/releases/v${version}`,
+				)
+				console.log(
+					"[lpm]        Or set LPM_INSTALL_INSECURE=1 to skip integrity verification (NOT recommended).",
+				)
+			} else {
+				console.log(
+					`[lpm] ERROR: could not fetch signed manifest: ${err.message}`,
+				)
+			}
+			return null
+		}
+		try {
+			bundleBody = await downloadToBufferFn(bundleUrl, BUNDLE_MAX_BYTES)
+		} catch {
+			// Bundle 404 / fetch failure is not an attack signal by itself —
+			// the SHA-256 gate against the manifest still runs. cosign /
+			// sigstore verification is opportunistic on this channel.
+			bundleBody = null
+		}
+
+		if (bundleBody) {
+			const verdict = await verifyFn(manifestBody, bundleBody)
+			if (verdict === "verified") {
+				console.log(
+					"[lpm] Verified Sigstore signature on manifest (identity-pinned to release.yml)",
+				)
+			} else if (verdict === "rejected") {
+				// Verifier ran and refused — strong attack signal.
+				console.log(
+					"[lpm] ERROR: Sigstore verifier rejected the manifest signature.",
+				)
+				console.log(
+					"[lpm]        Refusing to install. See https://github.com/lpm-dev/rust-client/issues",
+				)
+				return null
+			} else {
+				// Optional `sigstore` package not resolvable — degrade to
+				// SHA-only with a loud WARN so the user knows what to
+				// install for the stronger posture.
+				console.log(
+					"[lpm] WARN: optional 'sigstore' package not available; falling back to SHA-256 against the signed manifest only.",
+				)
+				console.log(
+					"[lpm]       For Sigstore verification, run `npm install --include=optional` or unblock the sigstore package.",
+				)
+			}
+		}
+	}
+
 	const destName = process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin"
-	const destPath = path.join(binDir, destName)
+	const destPath = path.join(destDir, destName)
+	const tmpPath = `${destPath}.tmp.${process.pid}`
+
+	try {
+		console.log("[lpm] Downloading native binary from GitHub Releases...")
+		await downloadFn(assetUrl, tmpPath, 0, ASSET_MAX_BYTES)
+	} catch (err) {
+		console.log(`[lpm] Download failed: ${err.message}. Using JS CLI fallback.`)
+		safeUnlink(tmpPath)
+		return null
+	}
+
+	if (manifestBody) {
+		const actualSha = await sha256FileFn(tmpPath)
+		const expectedSha = parseManifestEntry(
+			manifestBody.toString("utf-8"),
+			githubBinaryName,
+		)
+		if (!expectedSha) {
+			console.log(
+				`[lpm] ERROR: manifest does not enumerate ${githubBinaryName}; release-pipeline bug.`,
+			)
+			safeUnlink(tmpPath)
+			return null
+		}
+		if (actualSha !== expectedSha) {
+			console.log(`[lpm] ERROR: SHA-256 mismatch for ${githubBinaryName}`)
+			console.log(
+				`[lpm]        expected: ${expectedSha} (from signed manifest)`,
+			)
+			console.log(`[lpm]        actual:   ${actualSha}`)
+			console.log("[lpm]        Refusing to install — strong tampering signal.")
+			safeUnlink(tmpPath)
+			return null
+		}
+		console.log(`[lpm] Verified SHA-256: ${actualSha}`)
+	}
 
 	try {
-		console.log(`[lpm] Platform package not found. Downloading from GitHub...`)
-		await download(url, destPath)
+		fs.renameSync(tmpPath, destPath)
 		fs.chmodSync(destPath, 0o755)
-		console.log("[lpm] Native binary downloaded from GitHub Releases.")
-		return destPath
 	} catch (err) {
-		console.log(`[lpm] GitHub download failed: ${err.message}. Using JS CLI.`)
-		// Clean up partial download
-		if (fs.existsSync(destPath)) fs.unlinkSync(destPath)
+		console.log(`[lpm] Could not install verified binary: ${err.message}`)
+		safeUnlink(tmpPath)
 		return null
 	}
+
+	console.log("[lpm] Native binary installed from GitHub Releases.")
+	return destPath
 }
 
-/**
- * Hard-link the native binary over bin/lpm.js (Unix only).
- *
- * After this, the `lpm` symlink on PATH points directly to the Rust binary.
- * Node.js is never started. Zero overhead.
- *
- * We keep lpm.js.bak as the JS fallback — if the hard link is broken
- * (npm rebuild, etc.), the JS wrapper can be restored.
- */
 function tryHardLink(binaryPath) {
 	const shimPath = path.join(binDir, "lpm.js")
 	const backupPath = path.join(binDir, "lpm.js.bak")
 
 	try {
-		// Back up the JS shim (only if not already backed up)
 		if (fs.existsSync(shimPath) && !fs.existsSync(backupPath)) {
 			fs.copyFileSync(shimPath, backupPath)
 		}
 
-		// Replace JS shim with hard link to native binary
 		if (fs.existsSync(shimPath)) {
 			fs.unlinkSync(shimPath)
 		}
@@ -189,8 +289,6 @@ function tryHardLink(binaryPath) {
 
 		console.log("[lpm] Hard-linked native binary (zero Node.js overhead)")
 	} catch (err) {
-		// Hard link failed (cross-device mount, permissions, etc.)
-		// Restore JS shim — it will delegate at runtime (50ms overhead)
 		if (fs.existsSync(backupPath) && !fs.existsSync(shimPath)) {
 			fs.copyFileSync(backupPath, shimPath)
 		}
@@ -198,10 +296,6 @@ function tryHardLink(binaryPath) {
 	}
 }
 
-/**
- * Copy binary to bin/ directory (Windows fallback).
- * npm on Windows creates .cmd shims, so hard-linking doesn't work the same way.
- */
 function tryCopyBinary(binaryPath) {
 	const destPath = path.join(binDir, "lpm-bin.exe")
 	try {
@@ -214,41 +308,264 @@ function tryCopyBinary(binaryPath) {
 
 /**
  * Download a file from a URL, following redirects (GitHub → S3).
+ *
+ * HTTPS-only end-to-end: the entry check rejects any non-`https://`
+ * URL, and redirect Locations are resolved against the current URL
+ * before re-entering the function — so an attacker-controlled mirror
+ * cannot downgrade transport mid-chain via `Location: http://…`.
+ *
+ * Streams to disk with a per-response byte cap so a compromised mirror
+ * cannot exhaust disk by serving an unbounded body. The 5-redirect cap
+ * is preserved from the pre-integrity-gate shape.
+ *
+ * Exported for testability.
  */
-function download(url, dest, redirects = 0) {
+export function download(url, dest, redirects = 0, maxBytes = ASSET_MAX_BYTES) {
 	if (redirects > 5) return Promise.reject(new Error("Too many redirects"))
-
-	const client = url.startsWith("https") ? https : http
+	if (!url.startsWith("https://")) {
+		return Promise.reject(
+			new Error(
+				`refusing non-HTTPS transport: ${url} (Tier-2 download requires HTTPS end-to-end)`,
+			),
+		)
+	}
 
 	return new Promise((resolve, reject) => {
-		client
-			.get(url, res => {
-				if (
-					res.statusCode >= 300 &&
-					res.statusCode < 400 &&
-					res.headers.location
-				) {
-					resolve(download(res.headers.location, dest, redirects + 1))
+		const req = https.get(url, res => {
+			if (
+				res.statusCode >= 300 &&
+				res.statusCode < 400 &&
+				res.headers.location
+			) {
+				res.resume()
+				let nextUrl
+				try {
+					nextUrl = new URL(res.headers.location, url).href
+				} catch {
+					reject(
+						new Error(`invalid redirect Location: ${res.headers.location}`),
+					)
 					return
 				}
+				resolve(download(nextUrl, dest, redirects + 1, maxBytes))
+				return
+			}
+
+			if (res.statusCode !== 200) {
+				const err = new Error(`HTTP ${res.statusCode}`)
+				err.statusCode = res.statusCode
+				res.resume()
+				reject(err)
+				return
+			}
+
+			const advertised = Number(res.headers["content-length"])
+			if (Number.isFinite(advertised) && advertised > maxBytes) {
+				res.resume()
+				reject(
+					new Error(
+						`response advertises ${advertised} bytes; cap of ${maxBytes} would be exceeded`,
+					),
+				)
+				return
+			}
+
+			let received = 0
+			const out = fs.createWriteStream(dest)
+			res.on("data", chunk => {
+				received += chunk.length
+				if (received > maxBytes) {
+					out.destroy()
+					res.destroy()
+					safeUnlink(dest)
+					reject(
+						new Error(
+							`response body exceeded cap of ${maxBytes} bytes mid-stream`,
+						),
+					)
+				}
+			})
+			res.pipe(out)
+			out.on("finish", () => {
+				out.close()
+				resolve()
+			})
+			out.on("error", reject)
+		})
+		req.on("error", reject)
+	})
+}
+
+/**
+ * Buffered variant of [`download`] — fetches a bounded body into memory
+ * and returns it as a Buffer. Used for the manifest + Sigstore bundle,
+ * both of which are small and must be inspected as a whole before any
+ * other byte is honored.
+ *
+ * HTTPS-only: identical transport-hardening posture as [`download`].
+ *
+ * Exported for testability.
+ */
+export function downloadToBuffer(url, maxBytes, redirects = 0) {
+	if (redirects > 5) return Promise.reject(new Error("Too many redirects"))
+	if (!url.startsWith("https://")) {
+		return Promise.reject(
+			new Error(
+				`refusing non-HTTPS transport: ${url} (Tier-2 download requires HTTPS end-to-end)`,
+			),
+		)
+	}
 
-				if (res.statusCode !== 200) {
-					reject(new Error(`HTTP ${res.statusCode}`))
+	return new Promise((resolve, reject) => {
+		const req = https.get(url, res => {
+			if (
+				res.statusCode >= 300 &&
+				res.statusCode < 400 &&
+				res.headers.location
+			) {
+				res.resume()
+				let nextUrl
+				try {
+					nextUrl = new URL(res.headers.location, url).href
+				} catch {
+					reject(
+						new Error(`invalid redirect Location: ${res.headers.location}`),
+					)
 					return
 				}
+				resolve(downloadToBuffer(nextUrl, maxBytes, redirects + 1))
+				return
+			}
 
-				const out = fs.createWriteStream(dest)
-				res.pipe(out)
-				out.on("finish", () => {
-					out.close()
-					resolve()
-				})
-				out.on("error", reject)
+			if (res.statusCode !== 200) {
+				const err = new Error(`HTTP ${res.statusCode}`)
+				err.statusCode = res.statusCode
+				res.resume()
+				reject(err)
+				return
+			}
+
+			const advertised = Number(res.headers["content-length"])
+			if (Number.isFinite(advertised) && advertised > maxBytes) {
+				res.resume()
+				reject(
+					new Error(
+						`response advertises ${advertised} bytes; cap of ${maxBytes} would be exceeded`,
+					),
+				)
+				return
+			}
+
+			const chunks = []
+			let received = 0
+			res.on("data", chunk => {
+				received += chunk.length
+				if (received > maxBytes) {
+					res.destroy()
+					reject(
+						new Error(
+							`response body exceeded cap of ${maxBytes} bytes mid-stream`,
+						),
+					)
+					return
+				}
+				chunks.push(chunk)
 			})
-			.on("error", reject)
+			res.on("end", () => resolve(Buffer.concat(chunks)))
+			res.on("error", reject)
+		})
+		req.on("error", reject)
+	})
+}
+
+/**
+ * Compute the SHA-256 of a file as a lowercase hex string, streaming
+ * the file so we never buffer the whole asset in memory.
+ *
+ * Exported for testability.
+ */
+export function sha256File(filePath) {
+	return new Promise((resolve, reject) => {
+		const hash = crypto.createHash("sha256")
+		const stream = fs.createReadStream(filePath)
+		stream.on("data", chunk => hash.update(chunk))
+		stream.on("end", () => resolve(hash.digest("hex")))
+		stream.on("error", reject)
 	})
 }
 
-main().catch(() => {
-	// Silently fail — JS CLI fallback will handle all commands
-})
+/**
+ * Look up the SHA-256 for `filename` in a parsed SHA256SUMS.txt body.
+ *
+ * Format: `<64-hex>  <filename>\n` per line, two ASCII spaces between
+ * digest and name (GNU coreutils default; macOS shasum -a 256 matches).
+ * Malformed lines return null — a malformed manifest is an integrity
+ * failure, not a silent miss; callers should refuse to install.
+ *
+ * Exported for testability.
+ */
+export function parseManifestEntry(manifestText, filename) {
+	const lines = manifestText.split("\n")
+	for (const raw of lines) {
+		const line = raw.replace(/\r$/, "")
+		if (line.length === 0) continue
+		const idx = line.indexOf("  ")
+		if (idx !== 64) return null
+		const digest = line.slice(0, 64).toLowerCase()
+		if (!/^[0-9a-f]{64}$/.test(digest)) return null
+		const name = line.slice(idx + 2).trim()
+		if (name.length === 0) return null
+		if (name === filename) return digest
+	}
+	return null
+}
+
+function safeUnlink(p) {
+	try {
+		if (fs.existsSync(p)) fs.unlinkSync(p)
+	} catch {
+		// Best-effort.
+	}
+}
+
+/**
+ * Verify a Sigstore bundle against a manifest body using the optional
+ * `sigstore` package. Returns:
+ *
+ *   "verified"    — bundle verified under the lpm-dev/rust-client
+ *                   release.yml identity pin.
+ *   "rejected"    — sigstore package present and refused the bundle.
+ *   "unavailable" — sigstore package not resolvable (--no-optional,
+ *                   firewalled, install failure). Caller degrades to
+ *                   SHA-only.
+ *
+ * Exported for testability.
+ */
+export async function tryVerifyManifestSignature(manifestBody, bundleBody) {
+	let sigstore
+	try {
+		sigstore = await import("sigstore")
+	} catch {
+		return "unavailable"
+	}
+	try {
+		const bundle = JSON.parse(bundleBody.toString("utf-8"))
+		await sigstore.verify(bundle, manifestBody, SIGSTORE_IDENTITY)
+		return "verified"
+	} catch {
+		return "rejected"
+	}
+}
+
+// Only run `main` when this module is executed as a script (the
+// postinstall hook). Test files that `import { tryGitHubDownload, … }`
+// from this module should not trigger a real install attempt during
+// suite setup.
+const invokedAsScript =
+	process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
+
+if (invokedAsScript) {
+	main().catch(() => {
+		// Silently fail — JS CLI fallback will handle all commands.
+	})
+}