@volcano.dev/cli 0.37.2 → 0.37.3

package/README.md

@@ -38,7 +38,7 @@ volcano --help
 Or install manually:
 
 ```bash
-curl -fsSL https://github.com/Kong/volcano-cli/releases/latest/download/install.sh | sh
+curl -fsSL https://download.volcano.dev/builds/install.sh | sh
 volcano --help
 ```
 

package/bin/volcano.js

@@ -22,10 +22,10 @@ async function resolveBinary() {
     // resolveTarget() throws for e.g. Windows arm64, which passes the
     // package.json os/cpu gate but has no published binary.
     console.error(`volcano: could not obtain the CLI binary: ${err.message}`);
-    console.error(
-      'Install it manually from https://github.com/Kong/volcano-cli/releases ' +
-        'or re-install the package.'
-    );
+    const manual = process.platform === 'win32'
+      ? 'https://download.volcano.dev/builds/releases/latest/download/volcano-windows-amd64.exe'
+      : 'https://download.volcano.dev/builds/install.sh';
+    console.error(`Install it manually from ${manual} or re-install the package.`);
     process.exit(1);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volcano.dev/cli",
-  "version": "0.37.2",
+  "version": "0.37.3",
   "description": "CLI for Volcano's hosting platform.",
   "keywords": [
     "volcano",

package/scripts/npm/download.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Shared helpers for downloading and verifying the platform-specific Volcano
-// CLI binary from GitHub Releases. Used by the postinstall script
+// CLI binary from Volcano downloads. Used by the postinstall script
 // (scripts/npm/install.js) and, as a self-healing fallback, by the launcher
 // shim (bin/volcano.js).
 
@@ -20,7 +20,8 @@ const pkg = require('../../package.json');
 // Allow pointing at a mirror (kept consistent with scripts/install-volcano.sh).
 const RELEASES_BASE = (
   process.env.VOLCANO_GITHUB_RELEASES_URL ||
-  'https://github.com/Kong/volcano-cli/releases'
+  process.env.VOLCANO_CLI_RELEASES_URL ||
+  'https://download.volcano.dev/builds/releases'
 ).replace(/\/+$/, '');
 
 // Map Node's platform-arch to the release asset target id.
@@ -153,7 +154,7 @@ function parseChecksum(manifest, name) {
   return null;
 }
 
-async function downloadToFile(url, dest) {
+async function downloadToFile(url, dest, expected) {
   const tmp = `${dest}.download-${process.pid}`;
   try {
     const res = await get(url);
@@ -163,6 +164,9 @@ async function downloadToFile(url, dest) {
     const hash = crypto.createHash('sha256');
     await streamPipeline(fs.createReadStream(tmp), hash);
     const digest = hash.digest('hex');
+    if (digest !== expected) {
+      throw new Error(`Checksum mismatch for ${path.basename(dest)}: expected ${expected}, got ${digest}`);
+    }
     // rename does not overwrite an existing destination on Windows, so clear it
     // first (also covers a check-then-write race and force re-downloads).
     fs.rmSync(dest, { force: true });
@@ -202,13 +206,7 @@ async function ensureBinary({ force = false } = {}) {
   }
 
   fs.mkdirSync(path.dirname(dest), { recursive: true });
-  const actual = (await downloadToFile(`${base}/${name}`, dest)).toLowerCase();
-  if (actual !== expected) {
-    fs.rmSync(dest, { force: true });
-    throw new Error(
-      `Checksum mismatch for ${name}: expected ${expected}, got ${actual}`
-    );
-  }
+  await downloadToFile(`${base}/${name}`, dest, expected);
 
   if (process.platform !== 'win32') {
     fs.chmodSync(dest, 0o755);

package/scripts/npm/download.test.js

@@ -22,3 +22,58 @@ test('maps supported Node platforms to published release assets', () => {
 test('rejects a platform without a published release asset', () => {
   assert.throws(() => assetName('win32', 'arm64'), /Unsupported platform "win32-arm64"/);
 });
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
+const crypto = require('node:crypto');
+const { spawn } = require('node:child_process');
+
+for (const corrupt of [false, true]) {
+  test(`first-party download ${corrupt ? 'preserves the installed binary on checksum failure' : 'installs without GitHub'}`, async (t) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'volcano-npm-'));
+    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+    fs.mkdirSync(path.join(root, 'scripts/npm'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'bin'));
+    fs.copyFileSync(path.join(__dirname, 'download.js'), path.join(root, 'scripts/npm/download.js'));
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ version: '1.2.3' }));
+    const name = assetName();
+    const dest = path.join(root, 'bin', name);
+    fs.writeFileSync(dest, 'old binary');
+    const payload = 'new binary';
+    const checksum = crypto.createHash('sha256').update(corrupt ? 'wrong' : payload).digest('hex');
+    const requests = [];
+    const server = http.createServer((req, res) => {
+      requests.push(req.url);
+      if (req.url === '/builds/releases/download/v1.2.3/SHA256SUMS') res.end(`${checksum}  ${name}\n`);
+      else if (req.url === `/builds/releases/download/v1.2.3/${name}`) res.end(payload);
+      else { res.statusCode = 404; res.end(); }
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    t.after(() => new Promise(resolve => server.close(resolve)));
+    // Intercept only the first-party host. A GitHub dependency fails the test.
+    const script = `
+      require('https').get = (url, options, callback) => {
+        const parsed = new URL(url);
+        if (parsed.origin !== 'https://download.volcano.dev') throw Error('unexpected host: ' + parsed.origin);
+        return require('http').get('http://127.0.0.1:${server.address().port}' + parsed.pathname, options, callback);
+      };
+      require('./scripts/npm/download.js').ensureBinary({force:true}).catch(e => {console.error(e.message);process.exitCode=1});
+    `;
+    const env = { ...process.env };
+    delete env.VOLCANO_CLI_RELEASES_URL;
+    delete env.VOLCANO_GITHUB_RELEASES_URL;
+    // Launched through a package manager, ensureBinary() would also write an install-method marker into bin/.
+    delete env.npm_config_user_agent;
+    const child = spawn(process.execPath, ['-e', script], { cwd: root, env });
+    let stderr = '';
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    const code = await new Promise(resolve => child.on('close', resolve));
+    assert.equal(code, corrupt ? 1 : 0, stderr);
+    if (corrupt) assert.match(stderr, /Checksum mismatch/);
+    assert.equal(fs.readFileSync(dest, 'utf8'), corrupt ? 'old binary' : payload);
+    assert.equal(requests.length, 2);
+    assert.deepEqual(fs.readdirSync(path.join(root, 'bin')), [name]);
+  });
+}