@testrigor/testrigor-cli 2.0.8 → 2.0.9

package/README.md

@@ -168,7 +168,7 @@ EXAMPLES
   Config will be stored in ~/.testrigor/testrigor.yml
 ```
 
-_See code: [src/commands/authenticate.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.8/src/commands/authenticate.ts)_
+_See code: [src/commands/authenticate.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.9/src/commands/authenticate.ts)_
 
 ## `testrigor clone SUITE`
 
@@ -198,7 +198,7 @@ EXAMPLES
   $ testrigor clone <test-suite-id>
 ```
 
-_See code: [src/commands/clone.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.8/src/commands/clone.ts)_
+_See code: [src/commands/clone.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.9/src/commands/clone.ts)_
 
 ## `testrigor help [COMMAND]`
 
@@ -244,7 +244,7 @@ EXAMPLES
   $ testrigor test-suite config --delete
 ```
 
-_See code: [src/commands/test-suite/config.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.8/src/commands/test-suite/config.ts)_
+_See code: [src/commands/test-suite/config.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.9/src/commands/test-suite/config.ts)_
 
 ## `testrigor test-suite run [TESTSUITEID]`
 
@@ -304,7 +304,7 @@ DESCRIPTION
   Run all tests of a Test Suite
 ```
 
-_See code: [src/commands/test-suite/run.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.8/src/commands/test-suite/run.ts)_
+_See code: [src/commands/test-suite/run.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.9/src/commands/test-suite/run.ts)_
 
 ## `testrigor test-suite validate-syntax [TESTSUITEID]`
 
@@ -344,7 +344,7 @@ EXAMPLES
   $ testrigor test-suite validate-syntax <test-suite-id> --test-cases-path "test_cases/**/*.{yaml,txt}"
 ```
 
-_See code: [src/commands/test-suite/validate-syntax.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.8/src/commands/test-suite/validate-syntax.ts)_
+_See code: [src/commands/test-suite/validate-syntax.ts](https://github.com/TestRigor/testrigor-cli/blob/v2.0.9/src/commands/test-suite/validate-syntax.ts)_
 <!-- commandsstop -->`, so this README currently stays unchanged.
 
 3. Check that the diff only touches the version fields, then build and test from the lockfile:

package/dist/util/trtc.d.ts

@@ -1,4 +1,13 @@
-export declare function writeEntry(entryPath: string, entry: NodeJS.ReadableStream, mode?: number): Promise<void>;
-export declare function extractZip(dir: string, stream: NodeJS.ReadableStream): Promise<string>;
-export declare function extractTar(dir: string, stream: NodeJS.ReadableStream): Promise<string>;
-export declare function download(dir: string): Promise<string>;
+export declare const BINARY_SHA256: {
+    [key: string]: string;
+};
+export declare function findCachedBinary(dir: string, expectedSha256?: string): Promise<string | undefined>;
+export declare function writeEntry(entryPath: string, entry: NodeJS.ReadableStream, mode?: number, expectedSha256?: string): Promise<void>;
+export interface ExtractOptions {
+    expectedSha256?: string;
+    binaryName?: string;
+}
+export declare function extractZip(dir: string, stream: NodeJS.ReadableStream, options?: ExtractOptions): Promise<string>;
+export declare function extractTar(dir: string, stream: NodeJS.ReadableStream, options?: ExtractOptions): Promise<string>;
+export declare function download(dir: string, expectedSha256?: string): Promise<string>;
+export declare function ensureBinary(dir: string, expectedSha256?: string): Promise<string>;

package/dist/util/trtc.js

@@ -1,11 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BINARY_SHA256 = void 0;
+exports.findCachedBinary = findCachedBinary;
 exports.writeEntry = writeEntry;
 exports.extractZip = extractZip;
 exports.extractTar = extractTar;
 exports.download = download;
+exports.ensureBinary = ensureBinary;
 const tslib_1 = require("tslib");
 const fs_1 = tslib_1.__importDefault(require("@supercharge/fs"));
+const crypto = tslib_1.__importStar(require("crypto"));
 const fs = tslib_1.__importStar(require("fs"));
 const os = tslib_1.__importStar(require("os"));
 const path = tslib_1.__importStar(require("path"));
@@ -60,6 +64,47 @@ function getUrl() {
     }
     throw new Error(`Unsupported platform ${platform} or architecture ${architecture}`);
 }
+// SHA-256 of the trtc binary inside each VERSION archive, keyed by `${FILE_NAME}-${ARCHITECTURE_MAP}`.
+// Bump together with VERSION. A binary that does not match is never spawned.
+exports.BINARY_SHA256 = {
+    "darwin-amd64": "44334bfc402e290473cb0cde2b77dc6ad92ab87e20cb60bbd99eda8ebd4341d8",
+    "darwin-arm64": "bd09654755f78f8974cb8553c8ac0f1f83afb6ef101599d2ba6c652a82a506bc",
+    "linux-amd64": "e96dbe13969340048254f4126d0c229a0022b1dfa471adbd5023e6f01f1fd8b4",
+    "linux-arm64": "e70d995325adb783da70e498a17014ea1ace746cd2399ad26a0a4273ca7770ef",
+    "windows-amd64": "40ac2237574b5de57cccb43dc62135b7dc3ffe0e5be6c8c214d43492ffc8c26d",
+};
+function getExpectedSha256() {
+    const platform = os.platform();
+    const architecture = os.arch();
+    const expected = exports.BINARY_SHA256[`${FILE_NAME[platform]}-${ARCHITECTURE_MAP[architecture]}`];
+    if (expected) {
+        return expected;
+    }
+    throw new Error(`Unsupported platform ${platform} or architecture ${architecture}`);
+}
+function hashFile(file) {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash("sha256");
+        fs.createReadStream(file)
+            .on("error", reject)
+            .on("data", (chunk) => hash.update(chunk))
+            .on("end", () => resolve(hash.digest("hex")));
+    });
+}
+// Returns the binary already extracted in dir when it is executable (not checked on Windows) and
+// matches the pinned hash. A matching hash also proves the version, so no marker file is needed.
+async function findCachedBinary(dir, expectedSha256 = getExpectedSha256()) {
+    try {
+        const binary = getBinaryPath(dir);
+        if (os.platform() !== WIN32_PLATFORM) {
+            fs.accessSync(binary, fs.constants.X_OK);
+        }
+        return (await hashFile(binary)) === expectedSha256 ? binary : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 const DOWNLOAD_ATTEMPTS = 3;
 const DOWNLOAD_STALL_TIMEOUT_MS = 20000;
 function errorMessage(error) {
@@ -69,12 +114,22 @@ function errorMessage(error) {
 // destination once fully flushed, so on any OS the binary is never spawned half-written. It also
 // replaces an existing binary with a new file instead of truncating and rewriting it in place,
 // which an OS may refuse or penalise while that binary is running or cached from a previous run.
-function writeEntry(entryPath, entry, mode) {
+// When expectedSha256 is set, the entry is hashed as it is written and discarded on a mismatch.
+function writeEntry(entryPath, entry, mode, expectedSha256) {
     return new Promise((resolve, reject) => {
         const tmpPath = `${entryPath}.${process.pid}.tmp`;
         const writeStream = fs.createWriteStream(tmpPath);
+        const hash = crypto.createHash("sha256");
         writeStream.on("error", reject);
         writeStream.on("close", () => {
+            if (expectedSha256 !== undefined) {
+                const actualSha256 = hash.digest("hex");
+                if (actualSha256 !== expectedSha256) {
+                    fs.rmSync(tmpPath, { force: true });
+                    reject(new Error(`Checksum mismatch for ${path.basename(entryPath)}: expected ${expectedSha256}, got ${actualSha256}`));
+                    return;
+                }
+            }
             if (mode !== undefined) {
                 try {
                     fs.chmodSync(tmpPath, mode);
@@ -92,10 +147,19 @@ function writeEntry(entryPath, entry, mode) {
             }
             resolve();
         });
+        if (expectedSha256 !== undefined) {
+            entry.on("data", (chunk) => hash.update(chunk));
+        }
         entry.pipe(writeStream);
     });
 }
-async function extractZip(dir, stream) {
+function expectedHashFor(entryName, options) {
+    const binaryName = options.binaryName ?? BINARY_NAME;
+    return path.basename(entryName) === binaryName
+        ? options.expectedSha256
+        : undefined;
+}
+async function extractZip(dir, stream, options = {}) {
     const parser = unzip.Parse();
     const writes = [];
     return new Promise((resolve, reject) => {
@@ -109,13 +173,13 @@ async function extractZip(dir, stream) {
                 return;
             }
             fs.mkdirSync(path.dirname(entryPath), { recursive: true });
-            writes.push(writeEntry(entryPath, entry));
+            writes.push(writeEntry(entryPath, entry, undefined, expectedHashFor(entry.path, options)));
         });
         parser.on("finish", () => Promise.all(writes).then(() => resolve(getBinaryPath(dir)), reject));
         stream.pipe(parser);
     });
 }
-async function extractTar(dir, stream) {
+async function extractTar(dir, stream, options = {}) {
     const extract = tar.extract();
     return new Promise((resolve, reject) => {
         stream.on("error", reject);
@@ -129,7 +193,7 @@ async function extractTar(dir, stream) {
                     next();
                     break;
                 case "file":
-                    writeEntry(entryPath, stream, header.mode || 0o644).then(() => next(), reject);
+                    writeEntry(entryPath, stream, header.mode || 0o644, expectedHashFor(header.name, options)).then(() => next(), reject);
                     return;
                 case "symlink":
                     // ignore symlinks since they will not work on windows
@@ -147,7 +211,7 @@ async function extractTar(dir, stream) {
 }
 // Aborts the download when no data arrives for DOWNLOAD_STALL_TIMEOUT_MS, since a stalled
 // connection would otherwise never settle.
-async function downloadOnce(dir) {
+async function downloadOnce(dir, expectedSha256) {
     const controller = new AbortController();
     let stallTimer;
     const armStallTimer = () => {
@@ -164,23 +228,31 @@ async function downloadOnce(dir) {
             throw new Error("unexpected null response body");
         }
         const stream = stream_1.Readable.fromWeb(response.body);
+        const options = { expectedSha256 };
         const extraction = os.platform() === WIN32_PLATFORM
-            ? extractZip(dir, stream)
-            : extractTar(dir, stream);
+            ? extractZip(dir, stream, options)
+            : extractTar(dir, stream, options);
         // Attached after the extractor has piped the body, so no chunk is consumed before it.
         stream.on("data", armStallTimer);
-        return await extraction;
+        try {
+            return await extraction;
+        }
+        catch (error) {
+            // A rejected entry (e.g. a checksum mismatch) leaves the body piped but unread, so close it.
+            stream.destroy();
+            throw error;
+        }
     }
     finally {
         clearTimeout(stallTimer);
     }
 }
-async function download(dir) {
+async function download(dir, expectedSha256 = getExpectedSha256()) {
     let lastError;
     for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt++) {
         try {
             // eslint-disable-next-line no-await-in-loop
-            return await downloadOnce(dir);
+            return await downloadOnce(dir, expectedSha256);
         }
         catch (error) {
             lastError = error;
@@ -188,3 +260,8 @@ async function download(dir) {
     }
     throw new Error(`Could not download the trtc binary after ${DOWNLOAD_ATTEMPTS} attempts: ${errorMessage(lastError)}`);
 }
+// Reuses the cached binary when it is valid and downloads it otherwise.
+async function ensureBinary(dir, expectedSha256 = getExpectedSha256()) {
+    return ((await findCachedBinary(dir, expectedSha256)) ??
+        download(dir, expectedSha256));
+}

package/dist/util/tunnel.d.ts

@@ -1,3 +1,8 @@
+import * as childProcess from "child_process";
+export declare class PortInUseError extends Error {
+    constructor();
+}
+export declare function describeSpawnError(error: NodeJS.ErrnoException, binaryPath: string): string;
 export default class Tunnel {
     private static readonly BINARY_DIRECTORY;
     private running;
@@ -11,4 +16,5 @@ export default class Tunnel {
     stop(): Promise<void>;
     isRunning(): boolean;
     getPort(): number;
+    protected launch(binaryPath: string, configPath: string): Promise<childProcess.ChildProcessWithoutNullStreams>;
 }

package/dist/util/tunnel.js

@@ -1,11 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PortInUseError = void 0;
+exports.describeSpawnError = describeSpawnError;
 const tslib_1 = require("tslib");
 const fs_1 = tslib_1.__importDefault(require("@supercharge/fs"));
 const childProcess = tslib_1.__importStar(require("child_process"));
 const path = tslib_1.__importStar(require("path"));
 const trtc_1 = require("./trtc");
 const utils_1 = require("./utils");
+// Only a port conflict is worth retrying with another port, so this bounds that retry alone.
+const MAX_PORT_ATTEMPTS = 40;
+class PortInUseError extends Error {
+    constructor() {
+        super("Port already used");
+        this.name = "PortInUseError";
+    }
+}
+exports.PortInUseError = PortInUseError;
 function randomPort(min, max) {
     return Math.floor(Math.random() * (max - min + 1) + min);
 }
@@ -21,6 +32,18 @@ type = "http_proxy"`;
     await fs_1.default.writeFile(configPath, newConfigContent);
     return configPath;
 }
+// Endpoint protection often refuses to run an unknown binary with EPERM or EACCES, so those
+// messages say what to allow-list instead of repeating a bare system error.
+function describeSpawnError(error, binaryPath) {
+    const code = error.code ?? "unknown error";
+    if (error.code === "EPERM" || error.code === "EACCES") {
+        return `Could not run trtc at ${binaryPath} (${code}). Antivirus or endpoint protection may be blocking it; allow-list this path and try again.`;
+    }
+    if (error.code === "ENOENT") {
+        return `trtc is missing at ${binaryPath} (${code}). Delete the trtc folder in the testRigor CLI home (~/.testrigor by default) so it is downloaded again.`;
+    }
+    return `Could not run trtc at ${binaryPath} (${code}): ${error.message}`;
+}
 async function startTrtc(trtc, configPath) {
     return new Promise((resolve, reject) => {
         if (!fs_1.default.pathExistsSync(trtc)) {
@@ -30,25 +53,34 @@ async function startTrtc(trtc, configPath) {
         const tunnelProcess = childProcess.spawn(trtc, ["-c", configPath], {
             cwd: path.dirname(trtc),
         });
+        const rejectPortInUse = () => {
+            tunnelProcess.kill("SIGINT");
+            reject(new PortInUseError());
+        };
         tunnelProcess.stdout.on("data", (data) => {
             const dataString = data.toString();
             if (dataString.includes("start proxy success")) {
                 resolve(tunnelProcess);
             }
             else if (dataString.includes("port already used")) {
-                tunnelProcess.kill("SIGINT");
-                reject(new Error("Port already used"));
+                rejectPortInUse();
             }
         });
         tunnelProcess.stderr.on("data", (data) => {
-            reject(new Error(`TRTC error: ${data.toString()}`));
+            const dataString = data.toString();
+            if (dataString.includes("port already used")) {
+                rejectPortInUse();
+                return;
+            }
+            reject(new Error(`TRTC error: ${dataString}`));
         });
         tunnelProcess.on("error", (error) => {
-            reject(error);
+            reject(new Error(describeSpawnError(error, trtc)));
         });
         tunnelProcess.on("exit", (code, signal) => {
             if (code !== 0) {
-                reject(new Error(`TRTC exited with code ${code}`));
+                const how = code !== null ? `code ${code}` : `signal ${signal}`;
+                reject(new Error(`TRTC exited with ${how}`));
             }
         });
     });
@@ -61,30 +93,28 @@ class Tunnel {
     }
     async initialize() {
         const directory = await (0, utils_1.createDirectory)(Tunnel.BINARY_DIRECTORY);
-        this.binaryPath = await (0, trtc_1.download)(directory);
+        this.binaryPath = await (0, trtc_1.ensureBinary)(directory);
     }
     async start(minPort, maxPort) {
-        if (this.binaryPath == null) {
+        const binaryPath = this.binaryPath;
+        if (binaryPath == null) {
             throw new Error("Could not download the trtc binary");
         }
-        let lastError;
-        let maxTries = 40;
-        while (maxTries > 0) {
+        for (let attempt = 1; attempt <= MAX_PORT_ATTEMPTS; attempt++) {
+            this.port = randomPort(minPort, maxPort);
+            this.configPath = await updateConfig(binaryPath, this.port);
             try {
-                this.port = randomPort(minPort, maxPort);
-                this.configPath = await updateConfig(this.binaryPath, this.port);
-                this.process = await startTrtc(this.binaryPath, this.configPath);
-                break;
+                this.process = await this.launch(binaryPath, this.configPath);
+                this.running = true;
+                return;
             }
-            catch (e) {
-                lastError = e;
-                maxTries--;
+            catch (error) {
+                if (!(error instanceof PortInUseError)) {
+                    throw error;
+                }
             }
         }
-        if (maxTries === 0) {
-            throw new Error(`Could not start trtc process: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
-        }
-        this.running = true;
+        throw new Error(`No free tunnel port found in ${minPort}-${maxPort} after ${MAX_PORT_ATTEMPTS} attempts`);
     }
     async stop() {
         if (this.isRunning()) {
@@ -97,6 +127,9 @@ class Tunnel {
     getPort() {
         return this.port;
     }
+    launch(binaryPath, configPath) {
+        return startTrtc(binaryPath, configPath);
+    }
 }
 Tunnel.BINARY_DIRECTORY = "trtc";
 exports.default = Tunnel;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@testrigor/testrigor-cli",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@testrigor/testrigor-cli",
-      "version": "2.0.8",
+      "version": "2.0.9",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/oclif.manifest.json

@@ -521,5 +521,5 @@
       ]
     }
   },
-  "version": "2.0.8"
+  "version": "2.0.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testrigor/testrigor-cli",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": "TestRigor Command Line",
   "author": "Ivo Parun Rua @parunruaivo",
   "bin": {