@symbiosis-lab/moss 0.12.0 → 0.14.1

package/lib/fetch.js

@@ -92,26 +92,57 @@ async function download(url) {
   return Buffer.from(await res.arrayBuffer());
 }
 
-// Verifies bytes against the release's SHA256SUMS. Releases before v0.11.2
-// published no checksums; a missing SHA256SUMS is a warning, not a failure.
+// The first release that published a SHA256SUMS file. Before it there is
+// nothing to verify against; from it on, every release has one.
+const CHECKSUMS_SINCE = [0, 11, 2];
+
+// Must a missing checksum be fatal for this version? Anything unparseable
+// answers yes: an unrecognised version string is not a licence to skip the
+// only check on bytes we are about to mark executable.
+function checksumsRequired(version) {
+  const parts = String(version).split('-')[0].split('.').map(Number);
+  if (parts.length !== 3 || parts.some((n) => !Number.isInteger(n))) return true;
+  for (let i = 0; i < 3; i += 1) {
+    if (parts[i] !== CHECKSUMS_SINCE[i]) return parts[i] > CHECKSUMS_SINCE[i];
+  }
+  return true;
+}
+
+// Verifies bytes against the release's SHA256SUMS.
+//
+// Every reason we might not reach a checksum — a non-200, a network error, a
+// SHA256SUMS with no line for this asset — is reached over the same connection
+// that just served the binary. So on a version that publishes checksums, taking
+// any of them as permission to skip verification hands the skip to whoever
+// controls that connection: suppress one small request and the binary installs
+// unverified. Fail closed there, and keep the warning only for the pre-v0.11.2
+// releases where the file genuinely does not exist.
 async function verifyChecksum(bytes, asset, version) {
+  const unverified = (reason) => {
+    if (checksumsRequired(version)) {
+      throw new Error(
+        `moss-npm: cannot verify moss v${version} (${asset}): ${reason}.\n` +
+          '  Every release from v0.11.2 on publishes SHA256SUMS, so this is either a\n' +
+          '  transient network fault or a tampered download. Not installing.'
+      );
+    }
+    console.warn(`moss-npm: ${reason}; skipping checksum verification (v${version} predates SHA256SUMS)`);
+  };
+
   let sums;
   try {
     const res = await fetch(`${RELEASES}/v${version}/SHA256SUMS`, { redirect: 'follow' });
     if (!res.ok) {
-      console.warn(`moss-npm: no SHA256SUMS published for v${version}; skipping checksum verification`);
-      return;
+      return unverified(`no SHA256SUMS published for v${version} (${res.status})`);
     }
     sums = await res.text();
   } catch (err) {
-    console.warn(`moss-npm: could not fetch SHA256SUMS (${err.message}); skipping checksum verification`);
-    return;
+    return unverified(`could not fetch SHA256SUMS (${err.message})`);
   }
 
   const line = sums.split('\n').find((l) => l.trim().endsWith(asset));
   if (!line) {
-    console.warn(`moss-npm: SHA256SUMS has no entry for ${asset}; skipping checksum verification`);
-    return;
+    return unverified(`SHA256SUMS has no entry for ${asset}`);
   }
 
   const expected = line.trim().split(/\s+/)[0];
@@ -141,10 +172,12 @@ async function fetchBinary() {
 }
 
 module.exports = {
+  checksumsRequired,
   fetchBinary,
   vendorBinary,
   resolveAsset,
   resolveBinary,
   resolveVersion,
   skipDownloadReason,
+  verifyChecksum,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symbiosis-lab/moss",
-  "version": "0.12.0",
+  "version": "0.14.1",
   "description": "moss on your PATH — npm wrapper that installs the moss CLI binary from moss-releases",
   "bin": {
     "moss": "bin/moss.js"