@secretgenerator/cli 2.0.0 → 2.1.0

package/README.md

@@ -72,11 +72,11 @@ the certificate identity against
 
 ## Supported platforms
 
-| OS      | Architectures   |
-| ------- | --------------- |
-| Linux   | x64, arm64      |
-| macOS   | x64, arm64      |
-| Windows | x64             |
+| OS      | Architectures |
+| ------- | ------------- |
+| Linux   | x64, arm64    |
+| macOS   | x64, arm64    |
+| Windows | x64           |
 
 For other platforms, install from source:
 

package/dist/archive.js

@@ -0,0 +1,78 @@
+// Release-archive checks used by the postinstall downloader.
+//
+// The version string is interpolated into a GitHub download URL and, on
+// the Windows fallback that used to exist, into a shell command. It has
+// to be a semver tag and nothing else. Archive members are checked
+// before extraction so a release tarball cannot write outside the
+// destination via `..` or an absolute path.
+const RELEASE_TAG = /^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/;
+const PATH_SEGMENT = /^[A-Za-z0-9._-]+$/;
+/** Returns a `vX.Y.Z` tag, or throws if `raw` is not a semver release tag. */
+export function releaseTag(raw) {
+    const tag = raw.startsWith("v") ? raw : `v${raw}`;
+    if (!RELEASE_TAG.test(tag)) {
+        throw new Error(`refusing release version ${JSON.stringify(raw)}: expected a semver tag such as v2.0.0 or v2.0.0-alpha.11`);
+    }
+    return tag;
+}
+/**
+ * Returns null when `name` is safe to extract next to the package, or a
+ * short reason when it is not. `binary` is the expected executable name
+ * (`secretgenerator` or `secretgenerator.exe`). Goreleaser also packs
+ * LICENSE, README.md, schemas/, and docs/.
+ */
+export function unsafeArchiveMember(name, binary) {
+    let normalized = name.replace(/\\/g, "/");
+    if (normalized.startsWith("./")) {
+        normalized = normalized.slice(2);
+    }
+    if (normalized.endsWith("/")) {
+        normalized = normalized.slice(0, -1);
+    }
+    if (normalized === "") {
+        return null;
+    }
+    if (normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized)) {
+        return `absolute path ${JSON.stringify(name)}`;
+    }
+    const parts = normalized.split("/");
+    for (const part of parts) {
+        if (part === "" || part === "." || part === ".." || !PATH_SEGMENT.test(part)) {
+            return `unsafe path ${JSON.stringify(name)}`;
+        }
+    }
+    const rel = parts.join("/");
+    if (rel === binary ||
+        rel === "LICENSE" ||
+        rel === "README.md" ||
+        rel.startsWith("schemas/") ||
+        rel.startsWith("docs/")) {
+        return null;
+    }
+    return `unexpected member ${JSON.stringify(name)}`;
+}
+/**
+ * Windows CI puts Git's GNU tar first on PATH. That tar rejects zip
+ * archives and treats `C:` as a remote host. The system bsdtar reads zip
+ * and keeps drive letters local, so prefer it when it is installed.
+ */
+export function tarBinary(platform, systemTar, systemTarExists) {
+    if (platform === "win32" && systemTarExists)
+        return systemTar;
+    return "tar";
+}
+/**
+ * tar argv for extraction. A Windows drive prefix makes GNU tar treat the
+ * path as a remote host (`Cannot connect to C`). Pass `gnuForceLocal` only
+ * for that tar. The system bsdtar rejects `--force-local` and accepts the
+ * drive letter. Same-drive callers should pass a path relative to the dest.
+ */
+export function tarExtractArgs(archiveArg, format, opts = {}) {
+    const flag = format === "tar.gz" ? "-xzf" : "-xf";
+    const args = [flag, archiveArg, "-C", "."];
+    if (opts.gnuForceLocal && /^[A-Za-z]:/.test(archiveArg)) {
+        return ["--force-local", ...args];
+    }
+    return args;
+}
+//# sourceMappingURL=archive.js.map

package/dist/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,mEAAmE;AACnE,kEAAkE;AAClE,4CAA4C;AAE5C,MAAM,WAAW,GACf,uEAAuE,CAAC;AAE1E,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2DAA2D,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IAC9D,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,OAAO,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IACE,GAAG,KAAK,MAAM;QACd,GAAG,KAAK,SAAS;QACjB,GAAG,KAAK,WAAW;QACnB,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAC1B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,QAAyB,EACzB,SAAiB,EACjB,eAAwB;IAExB,IAAI,QAAQ,KAAK,OAAO,IAAI,eAAe;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,MAAwB,EACxB,OAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/install.js

@@ -22,6 +22,7 @@ import { spawnSync } from "node:child_process";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { detectAsset, UnsupportedPlatformError } from "./platform.js";
+import { releaseTag, tarBinary, tarExtractArgs, unsafeArchiveMember } from "./archive.js";
 import { cosignAvailable, verifyChecksum, verifyCosign, IntegrityError, } from "./verify.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dist/install.js is in `cli/dist/`, packageRoot is `cli/`.
@@ -54,7 +55,7 @@ async function main() {
         }
         throw err;
     }
-    const version = readVersion();
+    const version = releaseTag(readVersion());
     const archiveName = `secretgenerator_${stripV(version)}_${asset.suffix}`;
     const baseUrl = `https://github.com/${REPO}/releases/download/${version}`;
     const archiveUrl = `${baseUrl}/${archiveName}`;
@@ -77,6 +78,7 @@ async function main() {
         const checksumsText = readFileSync(checksumsPath, "utf8");
         verifyChecksum(archivePath, archiveName, checksumsText);
         console.log(`[secretgenerator] SHA-256 verified for ${archiveName}`);
+        assertSafeArchive(archivePath, asset.binary);
         if (existsSync(sigPath) && existsSync(pemPath) && cosignAvailable()) {
             if (verifyCosign(checksumsPath, pemPath, sigPath)) {
                 console.log("[secretgenerator] cosign keyless signature verified (Sigstore/Fulcio)");
@@ -110,6 +112,8 @@ async function main() {
 }
 function readVersion() {
     // Allow override (used by smoke tests pinning a specific tag).
+    // releaseTag() rejects anything that is not a semver tag, so the value
+    // cannot rewrite the download path or escape into a shell command.
     if (process.env.SECRETGENERATOR_VERSION) {
         return process.env.SECRETGENERATOR_VERSION;
     }
@@ -130,28 +134,53 @@ async function download(url, out, opts = {}) {
     const nodeStream = Readable.fromWeb(res.body);
     await pipeline(nodeStream, createWriteStream(out));
 }
-function extract(archive, dest, format) {
-    if (format === "tar.gz") {
-        const r = spawnSync("tar", ["-xzf", archive, "-C", dest], {
-            stdio: "inherit",
-        });
-        if (r.status !== 0)
-            throw new Error(`tar exit ${r.status}`);
-        return;
+function tarBin() {
+    const system = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "tar.exe");
+    return tarBinary(process.platform, system, existsSync(system));
+}
+function assertSafeArchive(archive, binary) {
+    // Basename plus cwd: GNU tar on Windows reads `C:` in an absolute path
+    // as a remote host and fails with "Cannot connect to C".
+    const listed = spawnSync(tarBin(), ["-tf", path.basename(archive)], {
+        cwd: path.dirname(archive),
+        encoding: "utf8",
+    });
+    if (listed.status !== 0) {
+        throw new IntegrityError(`could not list archive members: ${(listed.stderr || "").trim()}`);
     }
-    // zip — use Node's built-in zlib + a small inflate; the simplest cross-
-    // platform approach on Windows is `tar -xf` which Windows 10+ ships
-    // with. Fall back to PowerShell Expand-Archive if tar is missing.
-    const r = spawnSync("tar", ["-xf", archive, "-C", dest], {
-        stdio: "inherit",
+    const names = listed.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    const hasBinary = names.some((name) => {
+        const normalized = name.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
+        return normalized === binary;
     });
-    if (r.status !== 0) {
-        const ps = spawnSync("powershell", ["-Command", `Expand-Archive -Path '${archive}' -DestinationPath '${dest}' -Force`], { stdio: "inherit" });
-        if (ps.status !== 0) {
-            throw new Error("zip extraction failed: tar and Expand-Archive both errored");
+    if (!hasBinary) {
+        throw new IntegrityError(`archive does not contain ${binary}`);
+    }
+    for (const name of names) {
+        const why = unsafeArchiveMember(name, binary);
+        if (why) {
+            throw new IntegrityError(`refusing to extract archive: ${why}`);
         }
     }
 }
+function extract(archive, dest, format) {
+    // tar on Windows 10+ reads zip archives. Arguments stay in argv; the
+    // archive path is never interpolated into a shell command. cwd is the
+    // destination so a same-drive archive is a relative path. A cross-drive
+    // path still has a drive letter; tarExtractArgs adds --force-local.
+    const rel = path.relative(dest, archive);
+    const bin = tarBin();
+    // GitHub's Windows temp dir and the repo are often on different drives,
+    // so `rel` is an absolute `C:\...` path. System bsdtar accepts that.
+    // GNU tar needs --force-local or it parses the drive letter as a host.
+    const gnuForceLocal = process.platform === "win32" && bin === "tar";
+    const r = spawnSync(bin, tarExtractArgs(rel, format, { gnuForceLocal }), {
+        cwd: dest,
+        stdio: "inherit",
+    });
+    if (r.status !== 0)
+        throw new Error(`tar exit ${r.status}`);
+}
 // Reading the archive is delegated to `tar` / `Expand-Archive`; the
 // pipeline-and-stream imports above are kept because download() uses them.
 void createReadStream;

package/dist/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,wEAAwE;AACxE,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,yDAAyD;AACzD,2EAA2E;AAC3E,mCAAmC;AACnC,+EAA+E;AAC/E,2DAA2D;AAC3D,oEAAoE;AACpE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAE9D,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,4DAA4D;AAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAExD,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAE5C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CACX,gFAAgF;QAC9E,4BAA4B,sBAAsB,IAAI,kBAAkB,GAAG,CAC9E,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,sBAAsB,IAAI,sBAAsB,OAAO,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,WAAW,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG,OAAO,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAE9C,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;YACjC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;YACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjD,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,0CAA0C,WAAW,EAAE,CAAC,CAAC;QAErE,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC;YACpE,IAAI,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CACT,iGAAiG,CAClG,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,WAAW,WAAW,oBAAoB,KAAK,CAAC,MAAM,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,mBAAmB;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,aAAa,CACX,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CACxF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAElF,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,GAAW,EACX,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA6C,CAAC,CAAC;IACvF,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,MAAwB;IACtE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACvD,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,SAAS,CAClB,YAAY,EACZ,CAAC,UAAU,EAAE,yBAAyB,OAAO,uBAAuB,IAAI,UAAU,CAAC,EACnF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,wEAAwE;AACxE,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,yDAAyD;AACzD,2EAA2E;AAC3E,mCAAmC;AACnC,+EAA+E;AAC/E,2DAA2D;AAC3D,oEAAoE;AACpE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAE9D,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,4DAA4D;AAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAExD,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAE5C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CACX,gFAAgF;QAC9E,4BAA4B,sBAAsB,IAAI,kBAAkB,GAAG,CAC9E,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,sBAAsB,IAAI,sBAAsB,OAAO,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,WAAW,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG,OAAO,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAE9C,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;YACjC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;YACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjD,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,0CAA0C,WAAW,EAAE,CAAC,CAAC;QACrE,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC;YACpE,IAAI,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CACT,iGAAiG,CAClG,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,WAAW,WAAW,oBAAoB,KAAK,CAAC,MAAM,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,mBAAmB;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,aAAa,CACX,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CACxF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,+DAA+D;IAC/D,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAElF,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,GAAW,EACX,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA6C,CAAC,CAAC;IACvF,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM;IACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,mCAAmC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,UAAU,KAAK,MAAM,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,MAAwB;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,CAAC;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;QACvE,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,KAAK,gBAAgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secretgenerator/cli",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Zero-config installer for the secretgenerator CLI. Downloads the right binary for your OS/arch from a verified GitHub release, checks the SHA-256, and (when cosign is available) verifies the keyless Sigstore signature.",
   "type": "module",
   "license": "MIT",
@@ -31,6 +31,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json && chmod +x dist/run.js",
+    "test": "npm run build && node --test test/archive.test.mjs",
     "prepack": "npm run build",
     "postinstall": "node dist/install.js || echo 'secretgenerator: postinstall skipped (likely a tarball-only environment); run `npx secretgenerator --help` to retry'"
   },
@@ -47,7 +48,7 @@
     "arm64"
   ],
   "devDependencies": {
-    "@types/node": "^22.10.0",
-    "typescript": "^5.6.0"
+    "@types/node": "^26.6.5",
+    "typescript": "^5.9.3"
   }
 }