@onreza/nrz 0.36.1 → 0.36.3

package/README.md

@@ -33,14 +33,25 @@ nrz upgrade --channel beta
 
 **Linux/macOS:**
 ```bash
-curl -fsSL https://raw.githubusercontent.com/onreza/nrz-cli/main/install.sh | bash
+installer="$(mktemp)"
+curl -fsSL https://raw.githubusercontent.com/onreza/nrz-cli/main/install.sh -o "$installer"
+less "$installer"  # optional: review before running
+bash "$installer"
+rm -f "$installer"
 ```
 
 **Windows (PowerShell 7+):**
 ```powershell
-iwr -useb https://raw.githubusercontent.com/onreza/nrz-cli/main/install.ps1 | iex
+$installer = (New-TemporaryFile).FullName
+iwr -useb https://raw.githubusercontent.com/onreza/nrz-cli/main/install.ps1 -OutFile $installer
+Get-Content $installer  # optional: review before running
+pwsh -NoProfile -File $installer
+Remove-Item $installer
 ```
 
+Both installers verify the downloaded archive against the SHA-256 manifest
+published with the selected GitHub release.
+
 ## Documentation
 
 Full documentation and source code: [github.com/onreza/nrz-cli](https://github.com/onreza/nrz-cli)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onreza/nrz",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "private": false,
   "type": "module",
   "description": "ONREZA platform CLI - dev, build, deploy",

package/scripts/postinstall.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { platform, arch } from "node:process";
 import https from "node:https";
-import http from "node:http";
-import { chmodSync, mkdirSync, renameSync, existsSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, renameSync, rmSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { createGunzip } from "node:zlib";
 import { fileURLToPath } from "node:url";
@@ -13,19 +13,26 @@ const __dirname = dirname(__filename);
 
 const MANIFEST = {
   "assets": {
-    "linux-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.1/nrz-linux-x64.tar.gz",
-    "darwin-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.1/nrz-darwin-x64.tar.gz",
-    "darwin-arm64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.1/nrz-darwin-arm64.tar.gz",
-    "win32-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.1/nrz-win32-x64.tar.gz"
+    "linux-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.3/nrz-linux-x64.tar.gz",
+    "darwin-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.3/nrz-darwin-x64.tar.gz",
+    "darwin-arm64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.3/nrz-darwin-arm64.tar.gz",
+    "win32-x64": "https://github.com/ONREZA/nrz-cli/releases/download/v0.36.3/nrz-win32-x64.tar.gz"
+  },
+  "checksums": {
+    "linux-x64": "8d0354827b77c7aed5af158c9c481340ae4bb7750f1f93306f6c6112f5856beb",
+    "darwin-x64": "54d8edfb035a0921790330257699ffd8b4b9097d9ebbdd1fc1afc3feee927eb0",
+    "darwin-arm64": "54b1ef47f7fe83d4f74f2f6e55d2adcd6d5f88c8c65f35289e7cb2de90faf3b2",
+    "win32-x64": "5d1abea64dad0df10b14b148d2e902212697bbf064180ad135e870999aeb38da"
   },
   "binName": "nrz",
-  "version": "0.36.1"
+  "version": "0.36.3"
 };
 
 const platformKey = `${platform}-${arch}`;
 const downloadUrl = MANIFEST.assets[platformKey];
+const expectedSha256 = MANIFEST.checksums[platformKey];
 
-if (!downloadUrl) {
+if (!downloadUrl || !expectedSha256) {
   console.error(`No binary available for ${platformKey}`);
   console.error(`Supported platforms: ${Object.keys(MANIFEST.assets).join(", ")}`);
   process.exit(1);
@@ -33,36 +40,115 @@ if (!downloadUrl) {
 
 const binDir = join(__dirname, "..", "bin");
 mkdirSync(binDir, { recursive: true });
+const stagingDir = mkdtempSync(join(binDir, ".nrz-install-"));
+const sourceName = MANIFEST.sourceBinName || MANIFEST.binName;
+const ext = platform === "win32" ? ".exe" : "";
+const sourcePath = join(stagingDir, sourceName + ext);
+const targetPath = join(binDir, MANIFEST.binName + ext);
+const backupPath = join(binDir, `.${MANIFEST.binName}${ext}.old-${randomUUID()}`);
+
+function replaceInstalledBinary(candidatePath, targetPath, backupPath) {
+  if (platform !== "win32" || !existsSync(targetPath)) {
+    renameSync(candidatePath, targetPath);
+    return;
+  }
+
+  const targetStat = lstatSync(targetPath);
+  if (!targetStat.isFile() && !targetStat.isSymbolicLink()) {
+    throw new Error(`Refusing to replace non-file binary path: ${targetPath}`);
+  }
+
+  renameSync(targetPath, backupPath);
+  try {
+    renameSync(candidatePath, targetPath);
+  } catch (installError) {
+    try {
+      renameSync(backupPath, targetPath);
+    } catch (restoreError) {
+      throw new Error(
+        `Failed to install replacement (${installError.message}) and restore previous binary (${restoreError.message}); previous binary remains at ${backupPath}`,
+      );
+    }
+    throw new Error(
+      `Failed to install replacement; previous binary was restored: ${installError.message}`,
+    );
+  }
+
+  try {
+    rmSync(backupPath, { force: true });
+  } catch (cleanupError) {
+    console.warn(
+      `Installed new binary but could not remove backup ${backupPath}: ${cleanupError.message}`,
+    );
+  }
+}
 
-function download(url, redirectCount = 0) {
+function download(url, expectedSha256, redirectCount = 0) {
   if (redirectCount > 5) {
     return Promise.reject(new Error("Too many redirects"));
   }
 
   return new Promise((resolve, reject) => {
-    const protocol = url.startsWith("https") ? https : http;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+      reject(new Error(`Refusing non-HTTPS download URL: ${url}`));
+      return;
+    }
 
-    const request = protocol.get(url, (res) => {
+    const request = https.get(url, (res) => {
       if ([301, 302, 307, 308].includes(res.statusCode)) {
         const location = res.headers.location;
         if (!location) {
           reject(new Error("Redirect without location header"));
           return;
         }
-        download(location, redirectCount + 1).then(resolve).catch(reject);
+        res.resume();
+        download(new URL(location, url).toString(), expectedSha256, redirectCount + 1)
+          .then(resolve)
+          .catch(reject);
         return;
       }
 
       if (res.statusCode !== 200) {
+        res.resume();
         reject(new Error(`Download failed: HTTP ${res.statusCode}`));
         return;
       }
+      const contentLength = Number(res.headers["content-length"]);
+      if (Number.isFinite(contentLength) && contentLength > 256 * 1024 * 1024) {
+        res.resume();
+        reject(new Error("Download exceeds 256 MiB"));
+        return;
+      }
 
-      res
-        .pipe(createGunzip())
-        .pipe(tar.extract({ cwd: binDir, strip: 1 }))
-        .on("finish", resolve)
-        .on("error", reject);
+      const chunks = [];
+      let received = 0;
+      res.on("data", (chunk) => {
+        received += chunk.length;
+        if (received > 256 * 1024 * 1024) {
+          request.destroy(new Error("Download exceeds 256 MiB"));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on("end", () => {
+        const archive = Buffer.concat(chunks);
+        const actualSha256 = createHash("sha256").update(archive).digest("hex");
+        if (actualSha256 !== expectedSha256) {
+          reject(new Error(
+            `SHA-256 mismatch: expected ${expectedSha256}, received ${actualSha256}`,
+          ));
+          return;
+        }
+        const gunzip = createGunzip();
+        const extract = tar.extract({ cwd: stagingDir, strip: 1 });
+        gunzip.on("error", reject);
+        extract.on("error", reject);
+        extract.on("finish", resolve);
+        gunzip.pipe(extract);
+        gunzip.end(archive);
+      });
+      res.on("error", reject);
     });
 
     request.on("error", reject);
@@ -75,27 +161,32 @@ function download(url, redirectCount = 0) {
 
 console.log(`Installing ${MANIFEST.binName} for ${platformKey}...`);
 
-download(downloadUrl)
+download(downloadUrl, expectedSha256)
   .then(() => {
-    const sourceName = MANIFEST.sourceBinName || MANIFEST.binName;
-    const ext = platform === "win32" ? ".exe" : "";
-    const sourcePath = join(binDir, sourceName + ext);
-    const targetPath = join(binDir, MANIFEST.binName + ext);
-
-    if (sourceName !== MANIFEST.binName && existsSync(sourcePath)) {
-      renameSync(sourcePath, targetPath);
+    if (!existsSync(sourcePath)) {
+      throw new Error(`Archive did not contain ${MANIFEST.binName}${ext}`);
     }
 
     if (platform !== "win32") {
       try {
-        chmodSync(targetPath, 0o755);
+        chmodSync(sourcePath, 0o755);
       } catch {
       }
     }
+    replaceInstalledBinary(sourcePath, targetPath, backupPath);
     console.log(`Installed ${MANIFEST.binName} v${MANIFEST.version}`);
   })
   .catch((err) => {
     console.error(`Failed to install binary: ${err.message}`);
     console.error(`URL: ${downloadUrl}`);
-    process.exit(1);
+    process.exitCode = 1;
+  })
+  .finally(() => {
+    try {
+      rmSync(stagingDir, { recursive: true, force: true });
+    } catch (cleanupError) {
+      console.warn(
+        `Could not remove staging directory ${stagingDir}: ${cleanupError.message}`,
+      );
+    }
   });