@vibecook/truffle 0.4.7 → 0.4.9

package/scripts/postinstall.cjs

@@ -3,19 +3,34 @@
 /**
  * Postinstall script for @vibecook/truffle.
  *
- * Verifies the sidecar binary is available via optionalDependencies.
- * If missing (e.g., --no-optional), falls back to downloading from GitHub Releases.
+ * Primary path: the platform-specific sidecar arrives via optionalDependencies
+ * (npm integrity-protected). Fallback (e.g. `--no-optional`): download the
+ * binary from GitHub Releases over HTTPS, then verify its SHA-256 against the
+ * checksums shipped *inside this package* (`sidecar-checksums.json`). When a
+ * checksum is present we fail closed on mismatch; when absent we warn loudly
+ * that integrity could not be verified.
  *
- * This follows the esbuild pattern: optionalDependencies as primary, HTTP download as fallback.
+ * This replaces the previous unverified `curl | chmod +x` fallback.
  */
 
 /* eslint-disable @typescript-eslint/no-require-imports */
 
-const { existsSync, mkdirSync, chmodSync } = require('fs');
+const {
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  createWriteStream,
+  createReadStream,
+  readFileSync,
+  unlinkSync,
+} = require('fs');
 const { join, dirname } = require('path');
-const { execSync } = require('child_process');
+const https = require('https');
+const crypto = require('crypto');
 
 const GITHUB_REPO = 'jamesyong-42/truffle';
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+const MAX_ATTEMPTS = 3;
 
 const PLATFORM_PACKAGES = {
   'darwin-arm64': '@vibecook/truffle-sidecar-darwin-arm64',
@@ -34,18 +49,88 @@ const GITHUB_ASSETS = {
   'win32-x64': 'tsnet-sidecar-windows-amd64.exe',
 };
 
-function main() {
+/** Download `url` to `dest` over HTTPS, following redirects, with a hard timeout. */
+function httpsDownload(url, dest, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { headers: { 'User-Agent': 'truffle-postinstall' } }, (res) => {
+      // GitHub release downloads redirect to a CDN — follow 3xx.
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        httpsDownload(res.headers.location, dest, timeoutMs).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`HTTP ${res.statusCode}`));
+        return;
+      }
+      const file = createWriteStream(dest);
+      res.pipe(file);
+      file.on('finish', () => file.close((err) => (err ? reject(err) : resolve())));
+      file.on('error', (err) => {
+        try {
+          unlinkSync(dest);
+        } catch {
+          /* ignore */
+        }
+        reject(err);
+      });
+    });
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`timed out after ${timeoutMs}ms`)));
+    req.on('error', reject);
+  });
+}
+
+/** Compute the hex SHA-256 of a file. */
+function sha256File(path) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const s = createReadStream(path);
+    s.on('data', (d) => hash.update(d));
+    s.on('end', () => resolve(hash.digest('hex')));
+    s.on('error', reject);
+  });
+}
+
+/** Look up the expected SHA-256 for a given version/asset from the shipped checksum map. */
+function loadExpectedChecksum(version, asset) {
+  try {
+    const map = JSON.parse(readFileSync(join(__dirname, '..', 'sidecar-checksums.json'), 'utf8'));
+    const byVersion = map[version] || map[`v${version}`];
+    return byVersion ? byVersion[asset] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Release tags are `truffle-v{version}` (release-please monorepo tag scheme), NOT `v{version}`. */
+function buildDownloadUrl(version, asset) {
+  return `https://github.com/${GITHUB_REPO}/releases/download/truffle-v${version}/${asset}`;
+}
+
+/** Throw if `actual` does not match `expected` (hex, case-insensitive). */
+function assertChecksum(actual, expected, label) {
+  if (actual.toLowerCase() !== expected.toLowerCase()) {
+    throw new Error(
+      `SECURITY: sidecar checksum mismatch for ${label}. Expected ${expected}, got ${actual}.`,
+    );
+  }
+}
+
+async function main() {
   const key = `${process.platform}-${process.arch}`;
   const pkg = PLATFORM_PACKAGES[key];
   const ext = process.platform === 'win32' ? '.exe' : '';
   const binName = `sidecar-slim${ext}`;
 
   if (!pkg) {
-    console.warn(`[truffle] No prebuilt sidecar for ${key}. Build from source: cd packages/sidecar-slim && go build`);
+    console.warn(
+      `[truffle] No prebuilt sidecar for ${key}. Build from source: cd packages/sidecar-slim && go build`,
+    );
     return;
   }
 
-  // Check if the optionalDependency was installed
+  // Primary: was the platform optionalDependency installed?
   try {
     const pkgJson = require.resolve(`${pkg}/package.json`);
     const binPath = join(dirname(pkgJson), 'bin', binName);
@@ -66,32 +151,76 @@ function main() {
     // Not installed — fall through to download
   }
 
-  // Fallback: download from GitHub Releases
+  // Fallback: download from GitHub Releases (verified).
   const asset = GITHUB_ASSETS[key];
   if (!asset) return;
 
   const version = require('../package.json').version;
-  const url = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${asset}`;
+  const url = buildDownloadUrl(version, asset);
+  const expected = loadExpectedChecksum(version, asset);
 
   console.log(`[truffle] Sidecar not found via npm. Downloading from GitHub Releases...`);
 
-  try {
-    const binDir = join(__dirname, '..', 'bin');
-    mkdirSync(binDir, { recursive: true });
-    const dest = join(binDir, binName);
-
-    execSync(`curl -fsSL "${url}" -o "${dest}"`, { stdio: 'pipe' });
-
-    if (process.platform !== 'win32') {
-      chmodSync(dest, 0o755);
+  const binDir = join(__dirname, '..', 'bin');
+  const dest = join(binDir, binName);
+
+  // Retry only the network download; a checksum mismatch is deterministic and
+  // must NOT be retried (it would just re-download the same bad bytes).
+  let downloaded = false;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      mkdirSync(binDir, { recursive: true });
+      await httpsDownload(url, dest, DOWNLOAD_TIMEOUT_MS);
+      downloaded = true;
+      break;
+    } catch (err) {
+      console.warn(`[truffle] Download attempt ${attempt}/${MAX_ATTEMPTS} failed: ${err.message}`);
     }
+  }
 
-    console.log(`[truffle] Sidecar downloaded successfully.`);
-  } catch {
+  if (!downloaded) {
     console.warn(`[truffle] Could not download sidecar binary.`);
     console.warn(`[truffle] Download manually: ${url}`);
-    console.warn(`[truffle] Or build from source: cd packages/sidecar-slim && go build -o bin/sidecar-slim`);
+    console.warn(
+      `[truffle] Or build from source: cd packages/sidecar-slim && go build -o bin/sidecar-slim`,
+    );
+    return;
   }
+
+  // Integrity check.
+  if (expected) {
+    const actual = await sha256File(dest);
+    try {
+      assertChecksum(actual, expected, `truffle-v${version}/${asset}`);
+    } catch (err) {
+      try {
+        unlinkSync(dest);
+      } catch {
+        /* ignore */
+      }
+      console.error(`[truffle] ${err.message} Deleted the download and refusing to install it.`);
+      process.exitCode = 1;
+      return;
+    }
+  } else {
+    console.warn(
+      `[truffle] WARNING: no pinned checksum for truffle-v${version}/${asset}; integrity NOT verified. ` +
+        `Prefer installing with optionalDependencies enabled.`,
+    );
+  }
+
+  if (process.platform !== 'win32') {
+    chmodSync(dest, 0o755);
+  }
+
+  console.log(`[truffle] Sidecar downloaded${expected ? ' and verified' : ''}.`);
 }
 
-main();
+module.exports = { buildDownloadUrl, assertChecksum, loadExpectedChecksum };
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`[truffle] postinstall failed: ${err.message}`);
+    process.exitCode = 1;
+  });
+}

package/sidecar-checksums.json

@@ -0,0 +1,10 @@
+{
+  "_comment": "SHA-256 of each GitHub Release sidecar asset, keyed by release version then by asset filename. This file ships inside the npm package (which npm integrity-protects), so it is the trust anchor for the postinstall HTTPS download fallback. When an entry for the installing version/asset is present, postinstall FAILS CLOSED on a checksum mismatch; when absent it warns that integrity was not verified. Populate this at release time, e.g. `shasum -a 256 tsnet-sidecar-*` over the built assets. Keys must match GITHUB_ASSETS in scripts/postinstall.cjs.",
+  "0.4.8": {
+    "tsnet-sidecar-darwin-arm64": "acfaed6a2de2cb250adb5d3ce5122f5530005a331ad8eb539af6376fe79fc69a",
+    "tsnet-sidecar-darwin-amd64": "68bcbf7bb6e61de57e357f0940ef4db8dd86ab2bd69d34e48264ff5d945a6e6c",
+    "tsnet-sidecar-linux-amd64": "a4450bbbf72777b9773207b96a9585040cbf27ea98f0c02a6e186a288b5d85c2",
+    "tsnet-sidecar-linux-arm64": "90482a6f6b671873d58c57c466c6bd0390573b6b150a98ec4648d1634a1000b2",
+    "tsnet-sidecar-windows-amd64.exe": "62db3a5d3fea8b917851000107cd3ede08dbc0245429693c6baf2f2e0b87c3e7"
+  }
+}