@treeship/cli-darwin-arm64 0.9.11 → 0.10.1

package/README.md

@@ -10,6 +10,19 @@ npm install -g treeship
 
 The main `treeship` package detects your platform and pulls the correct binary.
 
+## Binary integrity
+
+The package ships a single-line `expected-checksum.txt` with the SHA-256 of the binary it downloads from the matching GitHub Release. The postinstall script:
+
+1. Reads the expected hash from the package (delivered via npm).
+2. Downloads the binary from `https://github.com/zerkerlabs/treeship/releases/download/v<version>/treeship-darwin-aarch64`.
+3. Verifies the downloaded bytes match the expected hash.
+4. Atomically renames the partial download into place only on match. On mismatch, the partial file is deleted and install fails (exit 1).
+
+Because the hash is delivered via npm and the binary is delivered via GitHub Releases, an attacker would need to compromise *both* trust roots simultaneously to slip a tampered binary past install. A compromise of either alone produces a verification failure.
+
+If the package was published without `expected-checksum.txt`, the postinstall refuses to install. That's intentional: a binary with no published checksum is unverifiable.
+
 ## Repository
 
-[github.com/nicholasgriffintn/treeship](https://github.com/nicholasgriffintn/treeship)
+[github.com/zerkerlabs/treeship](https://github.com/zerkerlabs/treeship)

package/expected-checksum.txt

@@ -0,0 +1 @@
+e4c809e2094fcf8dee0df60734bb06c510cda7d41282c7cb8f6c1610bb57ff61

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeship/cli-darwin-arm64",
-  "version": "0.9.11",
+  "version": "0.10.1",
   "description": "Treeship CLI binary for darwin arm64",
   "os": [
     "darwin"
@@ -9,6 +9,12 @@
     "arm64"
   ],
   "license": "Apache-2.0",
+  "files": [
+    "postinstall.js",
+    "binary.js",
+    "expected-checksum.txt",
+    "README.md"
+  ],
   "scripts": {
     "postinstall": "node postinstall.js"
   },

package/postinstall.js

@@ -1,41 +1,138 @@
-const https = require('https');
+// @treeship/cli-darwin-arm64 -- platform binary postinstall.
+//
+// Downloads the Treeship CLI binary from the matching GitHub Release
+// and verifies its SHA-256 against the expected hash that ships
+// inside this npm package. Both halves of the trust path matter:
+//
+//   1. The expected hash arrives via npm (signed by npm's package
+//      integrity, separate trust root from GitHub).
+//   2. The binary arrives via GitHub Releases.
+//   3. If either is tampered, the hashes don't match and we abort.
+//
+// Earlier versions (<= 0.10.0) downloaded the binary, chmod +x'd it,
+// and exited 0 -- no integrity check, and an install failure also
+// exited 0 (claiming success). This file is the v0.10.1 hardening.
+
+'use strict';
+
 const fs = require('fs');
 const path = require('path');
+const https = require('https');
+const crypto = require('crypto');
 
 const VERSION = require('./package.json').version;
 const BINARY_NAME = 'treeship-darwin-aarch64';
 const URL = 'https://github.com/zerkerlabs/treeship/releases/download/v' + VERSION + '/' + BINARY_NAME;
-const DEST = path.join(__dirname, 'bin', 'treeship');
+const BIN_DIR = path.join(__dirname, 'bin');
+const DEST = path.join(BIN_DIR, 'treeship');
+const PARTIAL = DEST + '.partial';
+const CHECKSUM_FILE = path.join(__dirname, 'expected-checksum.txt');
 
-if (fs.existsSync(DEST)) process.exit(0);
+// Read the expected SHA-256 that the release pipeline embedded in this
+// package. Format: a single line, lowercase hex, 64 chars. If absent
+// or malformed, refuse to install -- a binary without a published
+// checksum is an unverifiable binary.
+function readExpectedChecksum() {
+  let raw;
+  try {
+    raw = fs.readFileSync(CHECKSUM_FILE, 'utf8');
+  } catch (e) {
+    return null;
+  }
+  const hex = raw.trim().toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(hex)) return null;
+  return hex;
+}
 
-fs.mkdirSync(path.join(__dirname, 'bin'), { recursive: true });
+function abort(reason, code) {
+  // Always delete the partial download so a retry doesn't think it
+  // already has the binary.
+  try { if (fs.existsSync(PARTIAL)) fs.unlinkSync(PARTIAL); } catch {}
+  console.error('treeship: install failed -- ' + reason);
+  console.error('  Recover:');
+  console.error('    1. Re-run the install (transient network/CDN issues clear up):');
+  console.error('       npm install -g treeship');
+  console.error('    2. Or download the binary directly and place it on PATH:');
+  console.error('       https://github.com/zerkerlabs/treeship/releases/tag/v' + VERSION);
+  console.error('    3. Or build from source:');
+  console.error('       git clone https://github.com/zerkerlabs/treeship');
+  console.error('       cd treeship && cargo build --release -p treeship-cli');
+  process.exit(code || 1);
+}
 
-console.log('treeship: downloading ' + BINARY_NAME + '...');
+const expected = readExpectedChecksum();
+if (!expected) {
+  abort(
+    'expected-checksum.txt missing or malformed in ' + path.basename(__dirname) +
+    '. This npm package was published without a binary integrity hash and ' +
+    'cannot be installed safely. File an issue at ' +
+    'https://github.com/zerkerlabs/treeship/issues so we can re-publish it.',
+    1,
+  );
+}
 
-function download(url) {
-  https.get(url, (res) => {
-    if (res.statusCode === 302 || res.statusCode === 301) {
-      download(res.headers.location);
-      return;
+if (fs.existsSync(DEST)) {
+  // Already installed and verified previously -- nothing to do.
+  process.exit(0);
+}
+
+fs.mkdirSync(BIN_DIR, { recursive: true });
+console.log('treeship: downloading ' + BINARY_NAME + ' v' + VERSION + ' ...');
+
+function download(url, redirects) {
+  if (redirects > 5) return abort('too many redirects', 1);
+
+  const req = https.get(url, (res) => {
+    if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307 || res.statusCode === 308) {
+      res.resume();
+      return download(res.headers.location, redirects + 1);
     }
     if (res.statusCode !== 200) {
-      console.error('treeship: download failed (' + res.statusCode + ')');
-      console.error('Install manually: cargo install treeship-cli');
-      process.exit(0);
+      res.resume();
+      return abort('download HTTP ' + res.statusCode + ' from ' + url, 1);
     }
-    const file = fs.createWriteStream(DEST);
-    res.pipe(file);
-    file.on('finish', () => {
-      file.close();
-      fs.chmodSync(DEST, 0o755);
-      console.log('treeship: installed');
+
+    const hash = crypto.createHash('sha256');
+    const file = fs.createWriteStream(PARTIAL);
+
+    res.on('data', (chunk) => {
+      hash.update(chunk);
+      file.write(chunk);
+    });
+    res.on('end', () => {
+      file.end(() => {
+        const got = hash.digest('hex');
+        if (got !== expected) {
+          // Delete the partial file before aborting so a retry can't
+          // pick up the bad bytes.
+          try { fs.unlinkSync(PARTIAL); } catch {}
+          return abort(
+            'SHA-256 mismatch.\n' +
+            '       expected: ' + expected + '\n' +
+            '       got:      ' + got + '\n' +
+            '       This means either the GitHub Release was tampered with, ' +
+            'a CDN cached a stale or malicious binary, or the npm package ' +
+            'and the release are out of sync. Do not run the binary.',
+            1,
+          );
+        }
+        try {
+          fs.renameSync(PARTIAL, DEST);
+          fs.chmodSync(DEST, 0o755);
+        } catch (e) {
+          return abort('could not finalize binary: ' + e.message, 1);
+        }
+        console.log('treeship: installed (sha256 verified)');
+      });
     });
-  }).on('error', () => {
-    console.error('treeship: download failed');
-    console.error('Install manually: cargo install treeship-cli');
-    process.exit(0);
+    res.on('error', (e) => abort('stream error: ' + e.message, 1));
+    file.on('error', (e) => abort('write error: ' + e.message, 1));
+  });
+  req.on('error', (e) => abort('connection error: ' + e.message, 1));
+  req.setTimeout(60_000, () => {
+    req.destroy();
+    abort('download timed out after 60s', 1);
   });
 }
 
-download(URL);
+download(URL, 0);