benmore 0.1.35 → 0.1.38

package/README.md

@@ -10,7 +10,10 @@ benmore new my-app && cd my-app && benmore deploy
 This package is a small launcher. On first run it downloads the CLI release
 matching its version from
 [Benmore-Studio/benmore-cli](https://github.com/Benmore-Studio/benmore-cli/releases),
-checks the archive's SHA-256 against the release's `checksums.txt`, caches the
+checks the archive's SHA-256 against the value embedded in this package at
+publish time (taken from the release's `checksums.txt` after its Sigstore
+signature was verified in the release workflow, so editing the GitHub release
+later cannot change what the launcher accepts), caches the
 binary under `~/.cache/benmore/npm/<version>` (`%LOCALAPPDATA%\benmore\npm` on
 Windows, or `$BENMORE_NPM_CACHE`) and runs it. It has no install scripts.
 

package/bin/benmore.js

@@ -2,10 +2,12 @@
 // Thin launcher for the Benmore CLI. On first run it downloads the release
 // archive for this platform from the public Benmore-Studio/benmore-cli GitHub
 // release matching this package's version, checks its SHA-256 against the
-// release's checksums.txt, caches the binary and runs it. Later runs use the
-// cache. No install scripts, so it works with `npx benmore` and with
-// --ignore-scripts. The Homebrew cask (brew install benmore-studio/benmore/benmore)
-// remains the preferred install on macOS.
+// value embedded in this package (bin/checksums.json, written at publish time
+// from the Sigstore-verified release checksums), caches the binary and runs
+// it. Later runs use the cache. No install scripts, so it works with
+// `npx benmore` and with --ignore-scripts. The Homebrew cask
+// (brew install benmore-studio/benmore/benmore) remains the preferred install
+// on macOS.
 'use strict';
 
 const { spawnSync } = require('node:child_process');
@@ -24,6 +26,26 @@ function fail(msg) {
   process.exit(1);
 }
 
+// The trusted SHA-256 values ship inside the npm tarball. The release's own
+// checksums.txt is deliberately NOT consulted: anyone able to edit the GitHub
+// release could replace an archive and its checksums.txt line together.
+function pinnedChecksum(archive) {
+  let pinned;
+  try {
+    pinned = require('./checksums.json');
+  } catch (_) {
+    fail('this package has no embedded checksums (bin/checksums.json); refusing to download an unverifiable binary');
+  }
+  if (!pinned || pinned.version !== VERSION || !pinned.archives) {
+    fail('embedded checksums do not match package version ' + VERSION + '; refusing to download');
+  }
+  const want = pinned.archives[archive];
+  if (typeof want !== 'string' || !/^[0-9a-f]{64}$/.test(want)) {
+    fail('no embedded checksum for ' + archive + '; refusing to download');
+  }
+  return want;
+}
+
 function cacheDir() {
   const base = process.env.BENMORE_NPM_CACHE ||
     (process.platform === 'win32'
@@ -43,11 +65,8 @@ async function install(binPath) {
     fail('no prebuilt CLI for ' + process.platform + '/' + process.arch + '. See https://benmore.ai/cli');
   }
   const archive = 'benmore_' + VERSION + '_' + OS + '_' + ARCH + (OS === 'windows' ? '.zip' : '.tar.gz');
+  const want = pinnedChecksum(archive);
   process.stderr.write('Downloading Benmore CLI ' + VERSION + ' (' + OS + '/' + ARCH + ')...\n');
-  const sums = (await download(REPO + 'checksums.txt')).toString('utf8');
-  const line = sums.split('\n').find((l) => l.trim().endsWith('  ' + archive) || l.trim().endsWith(' ' + archive));
-  if (!line) fail('checksums.txt does not list ' + archive);
-  const want = line.trim().split(/\s+/)[0].toLowerCase();
   const data = await download(REPO + archive);
   const got = crypto.createHash('sha256').update(data).digest('hex');
   if (got !== want) fail('checksum mismatch for ' + archive + ' (expected ' + want + ', got ' + got + '); nothing was installed');

package/bin/checksums.json

@@ -0,0 +1,10 @@
+{
+  "version": "0.1.38",
+  "archives": {
+    "benmore_0.1.38_darwin_amd64.tar.gz": "41342f53a5d0253564d55899b0dd1eedd4f4a1d0628f970322b1af7eb30bb31d",
+    "benmore_0.1.38_darwin_arm64.tar.gz": "dbd9c961743b424736777a45b0f0aaa0d094f3e09fdd2e78f85ec096b7ff6c0b",
+    "benmore_0.1.38_linux_amd64.tar.gz": "affcdc08fffd4bb4e095a19fedb3ebb07beb393268353e287e803a59ce29d685",
+    "benmore_0.1.38_linux_arm64.tar.gz": "d68db32c2414d1c4bed8af455df626fdbc24354740a31b78e780131796d89f7a",
+    "benmore_0.1.38_windows_amd64.zip": "64a8811629f2673b0f4da8f24751cdd3141744087ce7c699f8651c4ea4409449"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "benmore",
-  "version": "0.1.35",
+  "version": "0.1.38",
   "description": "The Benmore CLI: build, deploy and verify apps on benmore.ai",
   "homepage": "https://benmore.ai/cli",
   "license": "MIT",
@@ -9,6 +9,7 @@
   },
   "files": [
     "bin/benmore.js",
+    "bin/checksums.json",
     "README.md"
   ],
   "engines": {