@that-company/dat 0.1.43 → 0.1.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@that-company/dat",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "description": "Installer for the D.A.T. CLI",
   "bin": {
     "dat": "bin/dat.js"

package/scripts/install.js

@@ -2,6 +2,7 @@
 "use strict";
 
 const { createHash } = require("node:crypto");
+const { spawnSync } = require("node:child_process");
 const { createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, rmSync, chmodSync } = require("node:fs");
 const { get } = require("node:https");
 const { tmpdir } = require("node:os");
@@ -46,8 +47,9 @@ async function main() {
     await download(sumsUrl, tempSums);
     verifyChecksum(tempBin, tempSums, asset);
 
+    chmodSync(tempBin, 0o755);
+    ensureDarwinSignature(tempBin);
     renameSync(tempBin, BIN_PATH);
-    chmodSync(BIN_PATH, 0o755);
     console.error(`installed dat ${pkg.version} -> ${BIN_PATH}`);
   } finally {
     rmSync(tempDir, { recursive: true, force: true });
@@ -135,3 +137,18 @@ function verifyChecksum(filePath, sumsPath, asset) {
   }
   console.error("checksum ok");
 }
+
+function ensureDarwinSignature(filePath) {
+  if (process.platform !== "darwin" || !isMachO(filePath)) return;
+  const verified = spawnSync("codesign", ["--verify", "--strict", filePath], { stdio: "ignore" });
+  if (verified.status === 0) return;
+  const signed = spawnSync("codesign", ["-f", "-s", "-", filePath], { stdio: "ignore" });
+  if (signed.status !== 0) throw new Error("downloaded macOS binary has an invalid code signature and local codesign failed");
+  const reverified = spawnSync("codesign", ["--verify", "--strict", filePath], { stdio: "ignore" });
+  if (reverified.status !== 0) throw new Error("downloaded macOS binary still has an invalid code signature");
+}
+
+function isMachO(filePath) {
+  const magic = readFileSync(filePath).subarray(0, 4).toString("hex");
+  return ["feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe", "bebafeca"].includes(magic);
+}