fallow-similar-code 3.22.0 → 3.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow-similar-code",
-  "version": "3.22.0",
+  "version": "3.23.0",
   "description": "First-party local embedding sidecar for Fallow similar-code analysis",
   "license": "MIT",
   "repository": {
@@ -26,13 +26,13 @@
     "detect-libc": "2.1.2"
   },
   "optionalDependencies": {
-    "@fallow-cli/fallow-similar-code-darwin-arm64": "3.22.0",
-    "@fallow-cli/fallow-similar-code-darwin-x64": "3.22.0",
-    "@fallow-cli/fallow-similar-code-linux-x64-gnu": "3.22.0",
-    "@fallow-cli/fallow-similar-code-linux-arm64-gnu": "3.22.0",
-    "@fallow-cli/fallow-similar-code-linux-x64-musl": "3.22.0",
-    "@fallow-cli/fallow-similar-code-linux-arm64-musl": "3.22.0",
-    "@fallow-cli/fallow-similar-code-win32-x64-msvc": "3.22.0",
-    "@fallow-cli/fallow-similar-code-win32-arm64-msvc": "3.22.0"
+    "@fallow-cli/fallow-similar-code-darwin-arm64": "3.23.0",
+    "@fallow-cli/fallow-similar-code-darwin-x64": "3.23.0",
+    "@fallow-cli/fallow-similar-code-linux-x64-gnu": "3.23.0",
+    "@fallow-cli/fallow-similar-code-linux-arm64-gnu": "3.23.0",
+    "@fallow-cli/fallow-similar-code-linux-x64-musl": "3.23.0",
+    "@fallow-cli/fallow-similar-code-linux-arm64-musl": "3.23.0",
+    "@fallow-cli/fallow-similar-code-win32-x64-msvc": "3.23.0",
+    "@fallow-cli/fallow-similar-code-win32-arm64-msvc": "3.23.0"
   }
 }

package/scripts/run-binary.js

@@ -2,6 +2,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
+const os = require("node:os");
 const { spawn, spawnSync } = require("node:child_process");
 const { once } = require("node:events");
 const { getPlatformPackage, isPlatformPackage } = require("./platform-package");
@@ -72,8 +73,6 @@ const resolveBinaryArtifact = (
   });
 };
 
-const resolveBinary = (...args) => resolveBinaryArtifact(...args).binaryPath;
-
 const setupTimeoutFor = (args) => (args[0] === "setup" ? SETUP_PROCESS_TIMEOUT_MS : null);
 
 const spawnNative = (binaryPath, args, spawnProcess = spawnSync) => {
@@ -177,7 +176,8 @@ const run = async (args) => {
     }
     if (result.signal) {
       process.stderr.write(`fallow-similar-code terminated by signal ${result.signal}\n`);
-      process.exit(1);
+      const signalNumber = os.constants.signals[result.signal];
+      process.exit(result.status ?? (signalNumber ? 128 + signalNumber : 1));
     }
     process.exit(result.status ?? 1);
   } catch (error) {
@@ -191,7 +191,6 @@ module.exports = {
   SETUP_PROCESS_TIMEOUT_MS,
   SETUP_TIMEOUT_EXIT_CODE,
   SETUP_TIMEOUT_MESSAGE,
-  resolveBinary,
   resolveBinaryArtifact,
   resolvePlatformPackage,
   run,

package/scripts/run-binary.test.js

@@ -3,12 +3,17 @@
 const assert = require("node:assert/strict");
 const test = require("node:test");
 const path = require("node:path");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const { spawn } = require("node:child_process");
+const { once } = require("node:events");
+const { resolvePlatformPackage } = require("./run-binary");
 const ownManifest = require("../package.json");
 const {
   SETUP_PROCESS_TIMEOUT_MS,
   SETUP_TIMEOUT_EXIT_CODE,
   SETUP_TIMEOUT_MESSAGE,
-  resolveBinary,
   resolveBinaryArtifact,
   setupTimeoutFor,
   spawnNative,
@@ -21,19 +26,19 @@ const manifest = (overrides = {}) =>
 
 test("resolves an exact-version regular native binary", () => {
   const manifestPath = path.join("/packages", "native", "package.json");
-  const resolved = resolveBinary(
+  const resolved = resolveBinaryArtifact(
     PACKAGE_NAME,
     () => manifestPath,
     () => manifest(),
     () => ({ isFile: () => true, isSymbolicLink: () => false }),
   );
-  assert.equal(resolved, path.join("/packages", "native", "fallow-similar-code"));
+  assert.equal(resolved.binaryPath, path.join("/packages", "native", "fallow-similar-code"));
 });
 
 test("rejects a platform package from another release", () => {
   assert.throws(
     () =>
-      resolveBinary(
+      resolveBinaryArtifact(
         PACKAGE_NAME,
         () => "/native/package.json",
         () => manifest({ version: "0.0.0" }),
@@ -46,7 +51,7 @@ test("rejects a platform package from another release", () => {
 test("rejects symlinked binaries", () => {
   assert.throws(
     () =>
-      resolveBinary(
+      resolveBinaryArtifact(
         PACKAGE_NAME,
         () => "/native/package.json",
         () => manifest(),
@@ -163,3 +168,65 @@ test("spawns non-setup commands without a wrapper timeout", () => {
   assert.deepEqual(captured.args, ["status", "--json"]);
   assert.deepEqual(captured.options, { env: process.env, stdio: "inherit" });
 });
+
+test(
+  "the signed setup launcher preserves forwarded SIGTERM as exit 143",
+  { skip: process.platform === "win32", timeout: 10_000 },
+  async (t) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "fallow-setup-signal-"));
+    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+    const packageName = resolvePlatformPackage();
+    const packageDir = path.join(root, "node_modules", packageName);
+    fs.mkdirSync(packageDir, { recursive: true });
+    const binaryName = "fallow-similar-code";
+    const binaryPath = path.join(packageDir, binaryName);
+    const binary = Buffer.from(
+      "#!/usr/bin/env node\nprocess.on('SIGTERM', () => process.exit(0)); process.stdout.write('READY\\n'); setInterval(() => {}, 1000);\n",
+    );
+    const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+    fs.writeFileSync(binaryPath, binary, { mode: 0o755 });
+    fs.writeFileSync(`${binaryPath}.sig`, crypto.sign(null, binary, privateKey));
+    fs.writeFileSync(
+      path.join(packageDir, "package.json"),
+      JSON.stringify({
+        name: packageName,
+        version: ownManifest.version,
+        fallowDigests: {
+          [binaryName]: `sha256:${crypto.createHash("sha256").update(binary).digest("hex")}`,
+        },
+      }),
+    );
+    // The real verifier checks a signed fixture using an ephemeral trust key.
+    // Package resolution, digest verification, spawning and signal forwarding all run.
+    const driver = `
+    const crypto = require("node:crypto");
+    const verifier = require(${JSON.stringify(require.resolve("./verify-binary"))});
+    const verify = verifier.verifyBinary;
+    const publicKey = crypto.createPublicKey(${JSON.stringify(publicKey.export({ type: "spki", format: "pem" }))});
+    verifier.verifyBinary = artifact => verify(artifact, { createPublicKey: () => publicKey });
+    require(${JSON.stringify(require.resolve("./run-binary"))}).run(["setup"]);
+  `;
+    const child = spawn(process.execPath, ["-e", driver], {
+      env: { ...process.env, NODE_PATH: path.join(root, "node_modules") },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    t.after(() => child.kill("SIGKILL"));
+    let ready = false;
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+      if (!ready && stdout.includes("READY")) {
+        ready = true;
+        child.kill("SIGTERM");
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    const [status, signal] = await once(child, "close");
+    assert.equal(ready, true, stderr);
+    assert.equal(signal, null);
+    assert.equal(status, 143, stderr);
+  },
+);