chainlesschain 0.162.189 → 0.162.197

package/src/lib/packer/pack-update-signature.js

@@ -0,0 +1,86 @@
+import crypto from "node:crypto";
+
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const key of Object.keys(value).sort()) {
+    out[key] = sortValue(value[key]);
+  }
+  return out;
+}
+
+export function canonicalPackManifestBytes(manifest) {
+  // Only the envelope's signature is excluded. Artifact-level `signature`
+  // fields (Sigstore bundle URLs) are part of the signed update contract and
+  // must not be removable or redirected without invalidating the manifest.
+  const unsigned = { ...(manifest || {}) };
+  delete unsigned.signature;
+  return Buffer.from(JSON.stringify(sortValue(unsigned)), "utf8");
+}
+
+export function packUpdateKeyId(publicKey) {
+  const key =
+    publicKey?.type === "public"
+      ? publicKey
+      : crypto.createPublicKey(publicKey);
+  const der = key.export({ type: "spki", format: "der" });
+  return crypto.createHash("sha256").update(der).digest("hex").slice(0, 32);
+}
+
+export function signPackUpdateManifest(manifest, privateKey) {
+  const privateObject =
+    privateKey?.type === "private"
+      ? privateKey
+      : crypto.createPrivateKey(privateKey);
+  if (privateObject.asymmetricKeyType !== "ed25519") {
+    throw new Error("pack update signing key must be Ed25519");
+  }
+  const publicObject = crypto.createPublicKey(privateObject);
+  const value = crypto
+    .sign(null, canonicalPackManifestBytes(manifest), privateObject)
+    .toString("base64");
+  return {
+    ...manifest,
+    signature: {
+      algorithm: "ed25519",
+      keyId: packUpdateKeyId(publicObject),
+      value,
+    },
+  };
+}
+
+export function verifyPackUpdateManifest(manifest, publicKey) {
+  if (!manifest?.signature) {
+    throw new Error("pack update manifest is unsigned");
+  }
+  if (manifest.signature.algorithm !== "ed25519") {
+    throw new Error(
+      `unsupported pack update signature: ${manifest.signature.algorithm}`,
+    );
+  }
+  const key =
+    publicKey?.type === "public"
+      ? publicKey
+      : crypto.createPublicKey(publicKey);
+  if (key.asymmetricKeyType !== "ed25519") {
+    throw new Error("trusted pack update key must be Ed25519");
+  }
+  const expectedKeyId = packUpdateKeyId(key);
+  if (manifest.signature.keyId !== expectedKeyId) {
+    throw new Error(
+      `pack update signing key mismatch: expected ${expectedKeyId}, got ${manifest.signature.keyId}`,
+    );
+  }
+  const signature = Buffer.from(
+    String(manifest.signature.value || ""),
+    "base64",
+  );
+  if (
+    signature.length !== 64 ||
+    !crypto.verify(null, canonicalPackManifestBytes(manifest), key, signature)
+  ) {
+    throw new Error("pack update manifest signature verification failed");
+  }
+  return true;
+}

package/src/lib/packer/pkg-config-generator.js

@@ -54,6 +54,7 @@ import path from "node:path";
  * @param {string|null} [ctx.updateManifestUrl] Phase 5a OTA manifest URL;
  *                                            baked into BAKED.updateManifestUrl
  *                                            and surfaced via `cc pack check-update`
+ * @param {string|null} [ctx.updatePublicKey] trusted Ed25519 public key PEM
  * @returns {{ pkgConfigDir: string, pkgConfigFile: string, entryScript: string, projectMeta: object|null }}
  */
 export function generatePkgConfig(ctx) {
@@ -71,6 +72,7 @@ export function generatePkgConfig(ctx) {
     projectEntry,
     forceRefreshOnLaunch = false,
     updateManifestUrl = null,
+    updatePublicKey = null,
   } = ctx;
 
   const bakedTokenMode =
@@ -151,6 +153,10 @@ export function generatePkgConfig(ctx) {
       typeof updateManifestUrl === "string" && updateManifestUrl
         ? updateManifestUrl
         : null,
+    updatePublicKey:
+      typeof updatePublicKey === "string" && updatePublicKey
+        ? updatePublicKey
+        : null,
     ...(projectBaked || {}),
   };
 

package/src/lib/paths.js

@@ -1,11 +1,49 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { mkdirSync, existsSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import { CONFIG_DIR_NAME } from "../constants.js";
 import { getPlatform } from "./platform.js";
+import {
+  assertSafeOwnerOnlyPath,
+  ensurePrivateDirectory,
+  repairPrivatePaths,
+} from "./secure-fs.js";
 
 export function getHomeDir() {
-  return process.env.CHAINLESSCHAIN_HOME || join(homedir(), CONFIG_DIR_NAME);
+  const configured = process.env.CHAINLESSCHAIN_HOME;
+  if (configured) {
+    const windowsLiteral = configured.replaceAll("/", "\\");
+    if (
+      windowsLiteral.startsWith("\\\\?\\") ||
+      windowsLiteral.startsWith("\\\\.\\")
+    ) {
+      const error = new Error(
+        "CHAINLESSCHAIN_HOME must not use a Windows device namespace",
+      );
+      error.code = "CONFIG_HOME_UNSAFE";
+      throw error;
+    }
+    if (!isAbsolute(configured)) {
+      const error = new Error(
+        "CHAINLESSCHAIN_HOME must be an absolute path for owner-only storage",
+      );
+      error.code = "CONFIG_HOME_UNSAFE";
+      throw error;
+    }
+    const resolvedHome = resolve(configured);
+    const relativeCwd = relative(resolvedHome, resolve(process.cwd()));
+    if (
+      relativeCwd === "" ||
+      (!relativeCwd.startsWith("..") && !isAbsolute(relativeCwd))
+    ) {
+      const error = new Error(
+        "CHAINLESSCHAIN_HOME must not be the current working directory or one of its ancestors",
+      );
+      error.code = "CONFIG_HOME_UNSAFE";
+      throw error;
+    }
+    return configured;
+  }
+  return join(homedir(), CONFIG_DIR_NAME);
 }
 
 export function getBinDir() {
@@ -57,16 +95,27 @@ export function getElectronUserDataDir() {
   }
 }
 
+/** Refuse broad roots before owner-only chmod/DACL repair can mutate them. */
+export function assertSafePrivateDirectoryPath(dirPath) {
+  return assertSafeOwnerOnlyPath(dirPath);
+}
+
 export function ensureDir(dirPath) {
-  if (!existsSync(dirPath)) {
-    mkdirSync(dirPath, { recursive: true });
-  }
-  return dirPath;
+  assertSafePrivateDirectoryPath(dirPath);
+  return ensurePrivateDirectory(dirPath, {
+    applyWindowsAcl: true,
+    failIfUnavailable: true,
+  });
 }
 
 export function ensureHomeDir() {
+  const homePath = getHomeDir();
+  assertSafePrivateDirectoryPath(homePath);
+  const home = ensurePrivateDirectory(homePath, {
+    applyWindowsAcl: true,
+    failIfUnavailable: true,
+  });
   const dirs = [
-    getHomeDir(),
     getBinDir(),
     getStatePath(),
     getServicesDir(),
@@ -74,7 +123,13 @@ export function ensureHomeDir() {
     getCacheDir(),
   ];
   for (const dir of dirs) {
-    ensureDir(dir);
+    ensurePrivateDirectory(dir, { applyWindowsAcl: false });
+  }
+  if (getPlatform() === "win32") {
+    // Existing directories may predate the protected home ACL and retain broad
+    // explicit permissions. Repair all protected children in one PowerShell
+    // batch rather than paying one process startup per directory.
+    repairPrivatePaths(dirs, { platform: "win32" });
   }
-  return getHomeDir();
+  return home;
 }