border-customs 0.4.1 → 0.4.2

package/README.md

@@ -675,6 +675,20 @@ same one that wrote the commit) how to run the five subcommands, how to produce
 
 ## Changelog
 
+### 0.4.2 (2026-09-12)
+- Fix: `npm publish` no longer prints the misleading "bin[border] script name
+  dist/index.js was invalid and removed" warning — package.json now carries the
+  canonical bare-relative bin form npm normalizes to anyway (mechanism traced to
+  @npmcli/package-json publish-side; artifacts were never broken; an always-on
+  test locks the form).
+- Change: RubyGems freshness (skip-ledger) parity compares a normalized CONTENT
+  digest instead of raw file bytes — `gem build` stamps the building toolchain
+  (RubyGems <3.6 embeds the build second in gzip headers), so raw-sha repack
+  parity could never be honored on those machines. The ledger digest and the
+  publish-time same-bytes re-hash stay RAW: what gets uploaded is still exactly
+  the certified bytes, and any unparseable artifact fails closed to a full
+  re-check.
+
 ### 0.4.1 (2026-09-11)
 - Add: release-coherence rule family — every version source inside a published artifact
   must agree (pyproject vs MODULE vs filename, gemspec vs gem metadata, Cargo.toml vs

package/dist/index.js

@@ -39707,6 +39707,7 @@ import { spawnSync as spawnSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync4, rmSync as rmSync5 } from "node:fs";
 import { join as join13 } from "node:path";
+import { gunzipSync as gunzipSync2 } from "node:zlib";
 
 // src/artifacts/rubygems.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -40235,6 +40236,64 @@ function artifactTargets() {
 function sha256File(path4) {
   return createHash7("sha256").update(readFileSync8(path4)).digest("hex");
 }
+function octalField(block, start, end) {
+  const text = block.subarray(start, end).toString("utf8").replace(/[\0 ].*$/, "");
+  if (text === "") return 0;
+  if (!/^[0-7]+$/.test(text)) return null;
+  return Number.parseInt(text, 8);
+}
+function tarEntries(buf) {
+  const magic = buf.subarray(257, 263).toString("latin1");
+  if (!magic.startsWith("ustar")) return null;
+  const out = [];
+  let off = 0;
+  while (off + 512 <= buf.length) {
+    const header = buf.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) return out;
+    const size = octalField(header, 124, 136);
+    if (size === null) return null;
+    const mode = octalField(header, 100, 108);
+    if (mode === null) return null;
+    const typeFlag = header[156] ?? 48;
+    const body = off + 512;
+    if (body + size > buf.length) return null;
+    const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const linkName = header.subarray(157, 257).toString("utf8").replace(/\0.*$/, "");
+    if (typeFlag !== 120 && typeFlag !== 103 && typeFlag !== 76 && typeFlag !== 75) {
+      out.push({ name, member: { content: buf.subarray(body, body + size), typeFlag, mode, linkName } });
+    }
+    off = body + Math.ceil(size / 512) * 512;
+  }
+  return out;
+}
+var GEM_METADATA_STAMP_RE = /^(rubygems_version|gem_version|date):/;
+var GEM_LEGACY_EMPTY_RE = /^(autorequire|description|email|homepage|post_install_message|signing_key):[ ]*$/;
+function sha256Hex(buf) {
+  return createHash7("sha256").update(buf).digest("hex");
+}
+function gemContentDigest(bytes) {
+  const outer = tarEntries(bytes);
+  if (outer === null) return null;
+  const meta3 = outer.find((e) => e.name === "metadata.gz")?.member;
+  const data = outer.find((e) => e.name === "data.tar.gz")?.member;
+  if (meta3 === void 0 || data === void 0) return null;
+  let metadata;
+  let inner;
+  try {
+    metadata = gunzipSync2(meta3.content).toString("utf8");
+    inner = gunzipSync2(data.content);
+  } catch {
+    return null;
+  }
+  const innerEntries = tarEntries(inner);
+  if (innerEntries === null) return null;
+  const chain = createHash7("sha256");
+  for (const { name, member: m } of innerEntries) {
+    chain.update(name).update("\0").update(String(m.typeFlag)).update("\0").update(String(m.mode & 73)).update("\0").update(m.linkName).update("\0").update(sha256Hex(m.content)).update("\0");
+  }
+  const metaStripped = metadata.split("\n").filter((line) => !GEM_METADATA_STAMP_RE.test(line) && !GEM_LEGACY_EMPTY_RE.test(line)).join("\n");
+  return createHash7("sha256").update("border-gem-content-v1\0").update(chain.digest("hex")).update("\0").update(metaStripped).digest("hex");
+}
 var packSeq = 0;
 function packNpmArtifacts(repoDir, o = {}) {
   packSeq += 1;
@@ -40292,7 +40351,10 @@ function packRubygemsArtifacts(repoDir, o = {}) {
     if (r.error !== void 0 || r.status !== 0) return null;
     const files = readdirSync4(dest).filter((f) => f.endsWith(".gem")).sort();
     if (files.length === 0) return null;
-    return files.map((f) => ({ file: f, sha256: sha256File(join13(dest, f)) }));
+    return files.map((f) => {
+      const raw = readFileSync8(join13(dest, f));
+      return { file: f, sha256: sha256Hex(raw), contentDigest: gemContentDigest(raw) };
+    });
   } finally {
     rmSync5(dest, { recursive: true, force: true });
   }
@@ -40305,11 +40367,30 @@ var REPACKERS = {
 function repackChannels() {
   return publishChannels().filter((c) => c.freshness === "repack").map((c) => c.id);
 }
-function sameArtifacts(a, b, extensions) {
-  const digests = (xs) => xs.filter((x) => extensions.some((ext) => x.file.slice(x.file.lastIndexOf("/") + 1).endsWith(ext))).map((x) => `${x.file.slice(x.file.lastIndexOf("/") + 1)}\0${x.sha256}`).sort();
+function gemParity(entry, repoDir) {
+  if (entry.contentDigest !== void 0) return entry.contentDigest;
+  try {
+    return gemContentDigest(readFileSync8(join13(repoDir, entry.file)));
+  } catch {
+    return null;
+  }
+}
+function sameArtifacts(a, b, extensions, repoDir) {
+  const digests = (xs) => {
+    const out = [];
+    for (const x of xs) {
+      const base = x.file.slice(x.file.lastIndexOf("/") + 1);
+      const ext = extensions.find((e) => base.endsWith(e));
+      if (ext === void 0) continue;
+      const parity = ext === ".gem" ? gemParity(x, repoDir) : x.sha256;
+      if (parity === null) return null;
+      out.push(`${base}\0${parity}`);
+    }
+    return out.sort();
+  };
   const ka = digests(a);
   const kb = digests(b);
-  return ka.length === kb.length && ka.every((x, i) => x === kb[i]);
+  return ka !== null && kb !== null && ka.length === kb.length && ka.every((x, i) => x === kb[i]);
 }
 function verifyArtifactFreshness(record2, ctx, repoDir, o = {}) {
   if (!record2.effectiveTargets.some((t) => artifactTargets().includes(t))) return true;
@@ -40331,7 +40412,8 @@ function verifyArtifactFreshness(record2, ctx, repoDir, o = {}) {
     needed.flatMap((id) => {
       const channel = publishChannels().find((c) => c.id === id);
       return channel?.artifactExtensions ?? [];
-    })
+    }),
+    repoDir
   );
 }
 
@@ -43893,7 +43975,7 @@ import { createHash as createHash15 } from "node:crypto";
 import { basename as basename5 } from "node:path";
 var SCAN_MAX_ARTIFACT_BYTES = 200 * 1024 * 1024;
 var SCAN_REQUEST_TIMEOUT_MS = 6e4;
-var SCAN_USER_AGENT = "border-customs/0.4.1 (+https://github.com/sumteclab/border; border scan)";
+var SCAN_USER_AGENT = "border-customs/0.4.2 (+https://github.com/sumteclab/border; border scan)";
 var CRATES_DOWNLOAD_HOST = "https://static.crates.io";
 var defaultScanFetcher = async (url2, init) => {
   if (!/^https?:\/\//.test(url2)) throw new EngineRunError(`border scan refuses non-http(s) URL: ${url2}`, null);
@@ -44018,7 +44100,7 @@ async function fetchArtifact(spec, o) {
     }
   }
 }
-function sha256Hex(data) {
+function sha256Hex2(data) {
   return createHash15("sha256").update(data).digest("hex");
 }
 
@@ -44470,7 +44552,7 @@ function classifyResidue(label, diff, attribution = null) {
 
 // src/roundtrip/orchestrate.ts
 function containerNameFor(label, rand = randomBytes(3).toString("hex")) {
-  return `rt-${sha256Hex(label).slice(0, 8)}-${rand}`;
+  return `rt-${sha256Hex2(label).slice(0, 8)}-${rand}`;
 }
 var shArgv = (name) => {
   if (!/^[A-Za-z0-9@._+/-]+$/.test(name)) {
@@ -44591,7 +44673,7 @@ function runPipeline2(exec, profile, spec, label, hostPath, container, closure,
     return {
       findings: classifyResidue(label, diffManifests(m1, m3), attribution),
       installDelta,
-      baselineDigest: sha256Hex([...m1.keys()].join("\n"))
+      baselineDigest: sha256Hex2([...m1.keys()].join("\n"))
     };
   } finally {
     try {
@@ -44629,7 +44711,7 @@ async function runRoundtripCore(ctx, deps = {}) {
   try {
     const localRead = local !== null ? await readLocalArtifact(local.absPath) : null;
     const bytes = localRead?.bytes ?? (await fetchArtifact(spec, { fetcher: deps.fetcher ?? defaultScanFetcher })).bytes;
-    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex(bytes);
+    const artifactSha256 = localRead !== null ? localRead.sha256 : sha256Hex2(bytes);
     const hostPath = join26(baseDir, "artifact");
     writeFileSync7(hostPath, bytes);
     const container = containerNameFor(label);
@@ -44638,12 +44720,12 @@ async function runRoundtripCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex(`roundtrip:${label}:${baselineDigest}:${verdict}`),
+      key: sha256Hex2(`roundtrip:${label}:${baselineDigest}:${verdict}`),
       head: baselineDigest.slice(0, 40),
       dirty: false,
       exposureSet: [label],
       refSet: [],
-      rulesHash: sha256Hex(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
+      rulesHash: sha256Hex2(`${profile.image}|${profile.install(profile.artifactPath, spec).join(" ")}|${profile.uninstall(spec).join(" ")}`),
       verdict,
       counts: countFindings(findings),
       findings,
@@ -44819,7 +44901,7 @@ function materializePackage(o) {
       if (!existsSync18(path4)) continue;
       const original = readFileSync16(path4);
       rmSync13(path4, { force: true });
-      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex(original)}`);
+      note(`border scan: crates envelope normalized: ${file2} sha256=${sha256Hex2(original)}`);
     }
   }
   const env2 = o.env;
@@ -44856,12 +44938,12 @@ async function runScanCore(ctx, deps = {}) {
     const verdict = computeVerdict(findings);
     const report = {
       schemaVersion: 1,
-      key: sha256Hex(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
+      key: sha256Hex2(`scan:${spec.ecosystem}:${spec.name}@${spec.version}:${head}`),
       head,
       dirty: false,
       exposureSet: [`${spec.ecosystem}:${spec.name}@${spec.version}`],
       refSet: [],
-      rulesHash: sha256Hex(buildScanConfigYaml(spec.ecosystem)),
+      rulesHash: sha256Hex2(buildScanConfigYaml(spec.ecosystem)),
       verdict,
       counts: countFindings(findings),
       findings,

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "border-customs",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "//": "publint is a runtime dep (exact pin): the npm-stage engine is invoked via bin resolution against the installed layout, so consumers get the publint-fail leg out of the box; the dev suite resolves the same node_modules/.bin/publint — no devDependencies entry is needed for it to stay green.",
   "description": "Fail-closed git push gate: secret scanning + supply-chain checks before any remote leaves the machine",
   "type": "module",
   "bin": {
-    "border": "./dist/index.js"
+    "border": "dist/index.js"
   },
   "files": [
     "dist"