fleetctl 4.92.3 → 4.93.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.92.3",
+  "version": "v4.93.1",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"
@@ -16,7 +16,7 @@
   },
   "homepage": "https://fleetdm.com",
   "dependencies": {
-    "axios": "1.18.0",
+    "axios": "1.20.0",
     "rimraf": "6.1.2",
     "tar": "7.5.22"
   },

package/run.js

@@ -2,16 +2,29 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 
 const { spawnSync } = require("child_process");
-const { existsSync, mkdirSync } = require("fs");
-const { type } = require("os");
+const {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  renameSync,
+  rmSync,
+} = require("fs");
+const { constants: osConstants, type } = require("os");
 const { join } = require("path");
 const { arch } = require("process");
+const { pipeline } = require("stream/promises");
 
 const axios = require("axios");
 const { rimrafSync } = require("rimraf");
 const { extract } = require("tar");
 const { version } = require("./package.json");
 
+// Fail closed: if anything below leaves a promise pending (e.g. a download stream that stops
+// without an error event), the event loop drains and Node would otherwise exit 0 silently.
+process.exitCode = 1;
+
 // Strip any v4.0.0-1 style suffix (but not -rc1) so that the correct package is
 // downloaded if there is a mistake in the NPM publish and we need to release a
 // -1, etc. (because NPM packages are immutable and can't be fixed after a mistake).
@@ -34,36 +47,52 @@ const platform = (() => {
     case "Darwin":
       return "macos";
     default:
-      throw new Error(`platform ${type} unrecognized`);
+      throw new Error(`platform ${type()} unrecognized`);
   }
 })();
 
-const binName = platform === "windows" ? "fleetctl.exe" : "fleetctl";
+const binName = platform.startsWith("windows") ? "fleetctl.exe" : "fleetctl";
 const binPath = join(installDir, binName);
 
 const install = async () => {
   const url = `https://github.com/fleetdm/fleet/releases/download/fleet-${strippedVersion}/fleetctl_${strippedVersion}_${platform}.tar.gz`;
 
-  mkdirSync(installDir, { recursive: true });
+  mkdirSync(binDir, { recursive: true });
+  // Extract into a temporary directory and rename it into place, so an interrupted
+  // download never leaves a partial binary where the next run would find it.
+  const tmpDir = mkdtempSync(join(binDir, "tmp-"));
 
   try {
-    const response = await axios({ url, responseType: "stream" });
+    let response;
+    try {
+      response = await axios({ url, responseType: "stream" });
+    } catch (err) {
+      if (axios.isAxiosError(err)) {
+        throw new Error(`download archive ${url}: ${err.message}`);
+      }
+      throw err;
+    }
 
+    // Unlike stream.pipe(), pipeline() rejects on errors and premature close from either side.
     // Strip the outer directory when extracting. Just get the binary.
-    const tarWriter = extract({ strip: 1, cwd: installDir });
-    response.data.pipe(tarWriter);
-
-    // Need to return a promise with the writer to ensure we can await for it to complete.
-    return new Promise((resolve, reject) => {
-      tarWriter.on("finish", resolve);
-      tarWriter.on("error", reject);
-    });
-  } catch (err) {
-    if (axios.isAxiosError(err)) {
-      throw new Error(`download archive ${url}: ${err.message}`);
-    } else {
-      throw err;
+    await pipeline(response.data, extract({ strip: 1, cwd: tmpDir }));
+
+    // Validate before caching: a bad entry here would otherwise be reused on every later run.
+    const extracted = join(tmpDir, binName);
+    const stat = existsSync(extracted) ? lstatSync(extracted) : null;
+    if (!stat || !stat.isFile()) {
+      throw new Error(`archive ${url} does not contain a ${binName} file`);
+    }
+    if (!platform.startsWith("windows") && !(stat.mode & 0o111)) {
+      throw new Error(`${binName} in archive ${url} is not executable`);
     }
+    // mkdtempSync creates the directory as 0700; keep it traversable for other users when
+    // installed as root (sudo npm install -g fleetctl), like the plain mkdirSync it replaced.
+    chmodSync(tmpDir, 0o755);
+    renameSync(tmpDir, installDir);
+  } catch (err) {
+    rmSync(tmpDir, { recursive: true, force: true });
+    throw err;
   }
 };
 
@@ -110,14 +139,26 @@ const run = async () => {
 
   const [, , ...args] = process.argv;
   const options = { cwd: process.cwd(), stdio: "inherit" };
-  const { status, error } = spawnSync(binPath, args, options);
+  const { status, signal, error } = spawnSync(binPath, args, options);
 
   if (error) {
     console.error(error);
     process.exit(1);
   }
+  if (status === null) {
+    // Killed by a signal: status is null and process.exit(null) would report success.
+    // Mirror the shell convention (128 + signal number) and stay quiet on SIGPIPE, which is
+    // routine when the output is piped to a command that exits early (e.g. `| head`).
+    if (signal !== "SIGPIPE") {
+      console.error(`Error: fleetctl was terminated by signal ${signal}`);
+    }
+    process.exit(128 + (osConstants.signals[signal] || 0));
+  }
 
   process.exit(status);
 };
 
-run();
+run().catch((err) => {
+  console.error(`Error: ${err.message}`);
+  process.exit(1);
+});