@mmmnt/flmnt 1.7.0 → 1.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mmmnt/flmnt",
-	"version": "1.7.0",
+	"version": "1.9.1",
 	"description": "flmnt CLI — installs the platform-native flmnt binary.",
 	"type": "module",
 	"license": "Apache-2.0",

package/scripts/install.js

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import {
 	chmodSync,
 	mkdirSync,
@@ -11,7 +12,7 @@ import {
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { assetName, binaryName, downloadURL, shouldInstall, target } from '../src/platform.js';
+import { assetName, binaryName, checksumsURL, downloadURL, expectedChecksum, shouldInstall, target } from '../src/platform.js';
 
 const REPO = 'mmmnt/flmnt-cli';
 
@@ -34,6 +35,20 @@ async function main() {
 	}
 	const buf = Buffer.from(await res.arrayBuffer());
 
+	// Verify the download against the published release checksums before trusting the binary.
+	const sumsRes = await fetch(checksumsURL(REPO, pkg.version), { redirect: 'follow' });
+	if (!sumsRes.ok) {
+		throw new Error(`checksum download failed: HTTP ${sumsRes.status}`);
+	}
+	const expected = expectedChecksum(await sumsRes.text(), asset);
+	if (!expected) {
+		throw new Error(`no published checksum for ${asset}`);
+	}
+	const actual = createHash('sha256').update(buf).digest('hex');
+	if (actual !== expected) {
+		throw new Error(`checksum mismatch for ${asset}: expected ${expected}, got ${actual}`);
+	}
+
 	const tmp = mkdtempSync(path.join(os.tmpdir(), 'flmnt-'));
 	try {
 		const archivePath = path.join(tmp, asset);

package/src/platform.js

@@ -33,6 +33,21 @@ export function downloadURL(repo, version, asset) {
 	return `https://github.com/${repo}/releases/download/v${version}/${asset}`;
 }
 
+export function checksumsURL(repo, version) {
+	return `https://github.com/${repo}/releases/download/v${version}/flmnt_${version}_checksums.txt`;
+}
+
+// Extract the expected sha256 for `asset` from a goreleaser checksums.txt (lines: "<hash>  <asset>").
+export function expectedChecksum(checksumsText, asset) {
+	for (const line of checksumsText.split('\n')) {
+		const [hash, name] = line.trim().split(/\s+/);
+		if (name === asset) {
+			return hash;
+		}
+	}
+	return null;
+}
+
 export function shouldInstall(version, env) {
 	if (env.FLMNT_SKIP_DOWNLOAD) {
 		return false;