@sdk-liuzhaoliang/cli 1.0.46 → 1.0.47

package/checksum

@@ -0,0 +1,26 @@
+e27edb299f809864b93c197a3319ea17d596418f5fb11e2424ecce4af56a1044  volcengine-cli_1.0.47_darwin_amd64.tar.gz
+37d50bd58e0d4d5d12797010f7b9011e7826d20eb7de5a4f5527b06a7d5daaaa  volcengine-cli_1.0.47_darwin_amd64.zip
+7a0e725b0e3a5ddb0f1f1b883d9ce09f1b7109fdbe0767762318031651dcce11  volcengine-cli_1.0.47_darwin_arm64.tar.gz
+4b805d99348f3d476c6a5b4181093646a30dfa1011bf489479b7bca68a9ead02  volcengine-cli_1.0.47_darwin_arm64.zip
+ec4e72df0afe3c1a7b4de9dabe9fb446404a7b7d611cb6bb3d5a9d78d71da75e  volcengine-cli_1.0.47_freebsd_386.tar.gz
+e31cde39d8936c4f503be6e3a59f03490912e23ba643ffc31e89c552a97d4474  volcengine-cli_1.0.47_freebsd_386.zip
+4d48e234ac2b866ee84d51fd61fb74d8629496555435f6b9b4fb6413b5e6bc32  volcengine-cli_1.0.47_freebsd_amd64.tar.gz
+1fd0faf0299ed030807fef04bebacd7c0334e74c7b7667fae8e58fc34ca10394  volcengine-cli_1.0.47_freebsd_amd64.zip
+bf7035148b2b13ec6a2049b732cb703c50d457897d379e62a0245989a2abc522  volcengine-cli_1.0.47_freebsd_arm.tar.gz
+d57f9c485cd60f31d5b73d314d53ff7dfed577a94e9cc12c20ca5e521e6a70c2  volcengine-cli_1.0.47_freebsd_arm.zip
+14ff0d779197857a00c9e5d1cd6e92d0efd42dfedca32f0c0c3e609bda231245  volcengine-cli_1.0.47_freebsd_arm64.tar.gz
+3b55d893b21f8ee5273fba08ec039ce54c493524db051c46d85c74950417853a  volcengine-cli_1.0.47_freebsd_arm64.zip
+8d2157f2cf1849261b8ecae4581e35c15673aad3a0399f7260de077b8cbf11a7  volcengine-cli_1.0.47_linux_386.tar.gz
+dec90bf94b5819c3f0d11cb81dc593c5162cdcdc01411eee0b690bd47ff6c6e0  volcengine-cli_1.0.47_linux_386.zip
+ebcd30ece6a55e7061119f149eb01d0dbcb479da625b78bdafc51f4f6086435b  volcengine-cli_1.0.47_linux_amd64.tar.gz
+1b39ace1e5a1df6cbc5c10b6c8db7e1638b36e7f9047362d604835117821d244  volcengine-cli_1.0.47_linux_amd64.zip
+90c86fdeca3ab41b9c82d12d1a479b44ed7486b06ca4ebc67b59426e9504a44e  volcengine-cli_1.0.47_linux_arm.tar.gz
+83d8c19eb50555482d7884475c426dfbd1b42f796baafce670e42c2d18a4bd19  volcengine-cli_1.0.47_linux_arm.zip
+4c742a8819bc29e683cf5019ab3dc3f20297eb7415f7cf8ed0afcbe88bc051c2  volcengine-cli_1.0.47_linux_arm64.tar.gz
+c3def6f6d05bb99171b199021cca9f878707ef7b7bc6d430e012daaf77f159da  volcengine-cli_1.0.47_linux_arm64.zip
+dd351767e49c0af726038cca762aee984ca68aba09f19adf5c253f88c509e733  volcengine-cli_1.0.47_windows_386.tar.gz
+4c2e4ae14f79bab2d8af4bc04b370d53a763243b98099517eeb2ab1cb6274209  volcengine-cli_1.0.47_windows_386.zip
+a036a6e3a931330738a5d8b68ba3a083220ab65f0efa8a1f490601746d743da6  volcengine-cli_1.0.47_windows_amd64.tar.gz
+047221e1d8200dca4a277329274577420e11ffb962c4e7e77df5fbcecf5162ec  volcengine-cli_1.0.47_windows_amd64.zip
+6580c3af61373f02c9c69dc14abc188a8ac1590cd2fc0d57f083f45e41294db6  volcengine-cli_1.0.47_windows_arm64.tar.gz
+ee3f5b319d1f76b9adae26bf967a99d1087a9e64e19e2c60b3479bfe23ab3f35  volcengine-cli_1.0.47_windows_arm64.zip

package/install.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 
 const { execSync } = require("child_process");
+const crypto = require("crypto");
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
 
-const VERSION = "1.0.46";
+const VERSION = require("./package.json").version;
 const DEFAULT_DOWNLOAD_BASE_URL = "https://vecli-demo.tos-cn-beijing.volces.com/ve";
+const CHECKSUM_PATH = path.join(__dirname, "checksum");
+const OFFICIAL_RELEASES_URL = "https://github.com/sdk-liuzhaoliang/volcengine-cli/releases";
 const DOWNLOAD_BASE_URL = normalizeBaseURL(
   process.env.VOLCENGINE_CLI_DOWNLOAD_BASE_URL || DEFAULT_DOWNLOAD_BASE_URL
 );
@@ -68,6 +71,81 @@ function archiveURLForTarget(target, version, downloadBaseURL) {
   return `${baseURL}/v${version}/${archiveNameForTarget(target, version)}`;
 }
 
+function sha256(data) {
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+function archiveBasename(filename) {
+  return String(filename || "").split(/[\\/]/).pop();
+}
+
+function parseChecksum(content) {
+  const entries = [];
+  String(content || "")
+    .split(/\r?\n/)
+    .forEach((line, index) => {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        return;
+      }
+
+      const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+      if (!match) {
+        throw new Error(`Invalid checksum line ${index + 1}`);
+      }
+
+      entries.push({
+        hash: match[1].toLowerCase(),
+        filename: match[2],
+      });
+    });
+  return entries;
+}
+
+function checksumForArchive(content, archiveName) {
+  const match = parseChecksum(content).find(
+    (entry) => entry.filename === archiveName || archiveBasename(entry.filename) === archiveName
+  );
+
+  if (!match) {
+    throw new Error(`Checksum entry not found for ${archiveName}`);
+  }
+
+  return match.hash;
+}
+
+function verifyArchiveChecksum(data, archiveName, checksumPath = CHECKSUM_PATH) {
+  let checksumContent;
+  try {
+    checksumContent = fs.readFileSync(checksumPath, "utf8");
+  } catch (err) {
+    if (err && err.code === "ENOENT") {
+      throw new Error(`Checksum file not found: ${checksumPath}`);
+    }
+    throw err;
+  }
+
+  const expected = checksumForArchive(checksumContent, archiveName);
+  const actual = sha256(data);
+
+  if (actual !== expected) {
+    throw new Error(
+      `Checksum mismatch for ${archiveName}: expected ${expected}, got ${actual}. ` +
+        `The downloaded archive may have been tampered with. ` +
+        `Please download Volcengine CLI from the official releases page: ${OFFICIAL_RELEASES_URL}`
+    );
+  }
+
+  return actual;
+}
+
+function downloadErrorMessage(statusCode, url) {
+  return (
+    `Download failed: HTTP ${statusCode} for ${url}. ` +
+    `Please download Volcengine CLI from the official releases page: ${OFFICIAL_RELEASES_URL}`
+  );
+}
+
 function createWindowsVeShim(binDir) {
   const shimPath = path.join(binDir, "ve");
   const shim = `#!/usr/bin/env node
@@ -99,7 +177,7 @@ function download(url) {
           return;
         }
         if (res.statusCode !== 200) {
-          reject(new Error(`Download failed: HTTP ${res.statusCode} for ${url}`));
+          reject(new Error(downloadErrorMessage(res.statusCode, url)));
           return;
         }
         const chunks = [];
@@ -131,6 +209,8 @@ async function install() {
   console.log(`Downloading ${zipName}...`);
 
   const data = await download(url);
+  verifyArchiveChecksum(data, zipName);
+
   const tmpDir = path.join(__dirname, ".tmp");
   const zipPath = path.join(tmpDir, zipName);
 
@@ -188,7 +268,13 @@ module.exports = {
   archiveNameForTarget,
   archiveURLForTarget,
   binaryNameForPlatform,
+  checksumForArchive,
   createWindowsVeShim,
+  downloadErrorMessage,
   normalizeBaseURL,
+  parseChecksum,
+  sha256,
   targetForPlatform,
+  verifyArchiveChecksum,
+  version: VERSION,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdk-liuzhaoliang/cli",
-  "version": "1.0.46",
+  "version": "1.0.47",
   "description": "Volcengine CLI test package for sdk-liuzhaoliang",
   "bin": {
     "ve": "bin/ve"
@@ -12,6 +12,7 @@
   },
   "files": [
     "bin/",
+    "checksum",
     "install.js"
   ],
   "keywords": [