@sdk-liuzhaoliang/cli 1.0.46 → 1.1.0

package/checksum

@@ -0,0 +1,26 @@
+2bf4f1de3c2fc9a567b9b737a5f5f2647346075d91553488b41bf14011f8f8f5  volcengine-cli_1.1.0_darwin_amd64.tar.gz
+ccc9c35c3b2191d291deb63bef042954acfef2eac4664c060beb423602080bf1  volcengine-cli_1.1.0_darwin_amd64.zip
+38fabd506bf604f1bc7641eb016e2d183cd3db785863876e2bf2a6ad572b193a  volcengine-cli_1.1.0_darwin_arm64.tar.gz
+21a953690195976a164fb4bc7bf04955aa713c4a755fbcd3401bee3cd189ee9a  volcengine-cli_1.1.0_darwin_arm64.zip
+a1fcc2ce92d00caf266fa1756342616e90c031c7c60e5546bffea67614186eab  volcengine-cli_1.1.0_freebsd_386.tar.gz
+9dbc8e0c0b5d4f17c2b215f208bf721179fd45b8e4c603b4eec449e66fb0cef8  volcengine-cli_1.1.0_freebsd_386.zip
+0d38fb84d2f3e6428bec8fd96192939da88302f0ab4bd9358448a32ee54c6209  volcengine-cli_1.1.0_freebsd_amd64.tar.gz
+a3f9dfe6725f1c2b98983c24976e92d9d1972343006b4e8d3492f6a364e1693e  volcengine-cli_1.1.0_freebsd_amd64.zip
+8b3b628059877034c16fff47e88d643e776cb2e8587ee13e92b25016ae829cd1  volcengine-cli_1.1.0_freebsd_arm.tar.gz
+b9451effbc04b34dfe6f2da39baeed66403e62ab0c98a45b7f5c4408b8e15e5f  volcengine-cli_1.1.0_freebsd_arm.zip
+8e5cc694863f2d942d1a23984c3363ab0d07694c1dca1fd8faa24160ab876019  volcengine-cli_1.1.0_freebsd_arm64.tar.gz
+d1586a4c142a813a39ddd3554bb4bac1b77ba96f21ab2dbbe60ea44940188b8d  volcengine-cli_1.1.0_freebsd_arm64.zip
+7c25f7fc24adfc82e3bb89a9a3aeceb608804fc2cc7ac371afb67033f99829a1  volcengine-cli_1.1.0_linux_386.tar.gz
+ecaf57ad01c9ddecdda104988789887e14a14f8cf801d825c212be48aabf84f6  volcengine-cli_1.1.0_linux_386.zip
+1dd890446e523a098db1f3b0bc4cc007b0e7028d059e34fd421492b11205f2c0  volcengine-cli_1.1.0_linux_amd64.tar.gz
+a466c36ed93aeeb1159ec913bcab625e265bb5f512aa99e3f8b17c2a66d638df  volcengine-cli_1.1.0_linux_amd64.zip
+78df6a14761fbb1ae1bf57f28e00d5f1029a26e8cfcc6ae51ef4852be289c662  volcengine-cli_1.1.0_linux_arm.tar.gz
+405cc1b8a8fee4740256a25f836276cd956dce3c514b6f6052fc47f55763ecab  volcengine-cli_1.1.0_linux_arm.zip
+804a59bc3bf1886aa3a0aa26ac89dbb639970cde2e284cbe57cbb787e104d70e  volcengine-cli_1.1.0_linux_arm64.tar.gz
+9a963a7bc00136126df10587428a1b81345be77f40aea35f1332f4a31013ea74  volcengine-cli_1.1.0_linux_arm64.zip
+97f6874c4c80c20fa8d7855895006e2ae2272366ae5f4feba290f5023ad8e773  volcengine-cli_1.1.0_windows_386.tar.gz
+1bf3b9c13afefb7c57828c99c015b246f6fee06f741dd730d590f5c211a2d9fe  volcengine-cli_1.1.0_windows_386.zip
+fdc2b425fa3da122f32f5e16053bc691b750de3708c99a5ecb258758f4628acd  volcengine-cli_1.1.0_windows_amd64.tar.gz
+ff4d33462f87cb096861650b723507242a175d3d4c149c06d425c15dd9ece7dc  volcengine-cli_1.1.0_windows_amd64.zip
+b0f8c2c8ea74a9c1ae832f3629bc594cd23bfb75d5241545fcb8cfc3d401a89a  volcengine-cli_1.1.0_windows_arm64.tar.gz
+8258c5b03450d84d7a8309596e9ad7a7bdbefcf96184d3cee3a9551a1560fb5d  volcengine-cli_1.1.0_windows_arm64.zip

package/install.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 
 const { execSync } = require("child_process");
+const crypto = require("crypto");
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
 
-const VERSION = "1.0.46";
+const VERSION = require("./package.json").version;
 const DEFAULT_DOWNLOAD_BASE_URL = "https://vecli-demo.tos-cn-beijing.volces.com/ve";
+const CHECKSUM_PATH = path.join(__dirname, "checksum");
+const OFFICIAL_RELEASES_URL = "https://github.com/sdk-liuzhaoliang/volcengine-cli/releases";
 const DOWNLOAD_BASE_URL = normalizeBaseURL(
   process.env.VOLCENGINE_CLI_DOWNLOAD_BASE_URL || DEFAULT_DOWNLOAD_BASE_URL
 );
@@ -68,6 +71,74 @@ function archiveURLForTarget(target, version, downloadBaseURL) {
   return `${baseURL}/v${version}/${archiveNameForTarget(target, version)}`;
 }
 
+function sha256(data) {
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+function archiveBasename(filename) {
+  return String(filename || "").split(/[\\/]/).pop();
+}
+
+function parseChecksum(content) {
+  const entries = [];
+  String(content || "")
+    .split(/\r?\n/)
+    .forEach((line, index) => {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        return;
+      }
+
+      const match = trimmed.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+      if (!match) {
+        throw new Error(`Invalid checksum line ${index + 1}`);
+      }
+
+      entries.push({
+        hash: match[1].toLowerCase(),
+        filename: match[2],
+      });
+    });
+  return entries;
+}
+
+function checksumForArchive(content, archiveName) {
+  const match = parseChecksum(content).find(
+    (entry) => entry.filename === archiveName || archiveBasename(entry.filename) === archiveName
+  );
+
+  if (!match) {
+    throw new Error(`Checksum entry not found for ${archiveName}`);
+  }
+
+  return match.hash;
+}
+
+function verifyArchiveChecksum(data, archiveName, checksumPath = CHECKSUM_PATH) {
+  let checksumContent;
+  try {
+    checksumContent = fs.readFileSync(checksumPath, "utf8");
+  } catch (err) {
+    if (err && err.code === "ENOENT") {
+      throw new Error(`Checksum file not found: ${checksumPath}`);
+    }
+    throw err;
+  }
+
+  const expected = checksumForArchive(checksumContent, archiveName);
+  const actual = sha256(data);
+
+  if (actual !== expected) {
+    throw new Error(
+      `Checksum mismatch for ${archiveName}: expected ${expected}, got ${actual}. ` +
+        `The downloaded archive may have been tampered with. ` +
+        `Please download Volcengine CLI from the official releases page: ${OFFICIAL_RELEASES_URL}`
+    );
+  }
+
+  return actual;
+}
+
 function createWindowsVeShim(binDir) {
   const shimPath = path.join(binDir, "ve");
   const shim = `#!/usr/bin/env node
@@ -131,6 +202,8 @@ async function install() {
   console.log(`Downloading ${zipName}...`);
 
   const data = await download(url);
+  verifyArchiveChecksum(data, zipName);
+
   const tmpDir = path.join(__dirname, ".tmp");
   const zipPath = path.join(tmpDir, zipName);
 
@@ -188,7 +261,12 @@ module.exports = {
   archiveNameForTarget,
   archiveURLForTarget,
   binaryNameForPlatform,
+  checksumForArchive,
   createWindowsVeShim,
   normalizeBaseURL,
+  parseChecksum,
+  sha256,
   targetForPlatform,
+  verifyArchiveChecksum,
+  version: VERSION,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdk-liuzhaoliang/cli",
-  "version": "1.0.46",
+  "version": "1.1.0",
   "description": "Volcengine CLI test package for sdk-liuzhaoliang",
   "bin": {
     "ve": "bin/ve"
@@ -12,6 +12,7 @@
   },
   "files": [
     "bin/",
+    "checksum",
     "install.js"
   ],
   "keywords": [