git-userhub 3.0.1 → 3.0.3

package/README.md

@@ -9,18 +9,18 @@
   </p>
 
   <p>
-    <a href="https://www.npmjs.com/package/git-userhub"><img src="https://img.shields.io/npm/v/git-userhub?style=flat-square&color=CB3837&logo=npm&logoColor=white" alt="npm version" /></a>
-    <a href="https://www.npmjs.com/package/git-userhub"><img src="https://img.shields.io/npm/dt/git-userhub?style=flat-square&color=CB3837&logo=npm&logoColor=white&label=total%20downloads" alt="total downloads" /></a>
-    <a href="https://github.com/divyo-argha/git-user/releases"><img src="https://img.shields.io/github/v/release/divyo-argha/git-user?style=flat-square&color=00FFAA&label=latest" alt="Latest Release" /></a>
-    <a href="https://github.com/divyo-argha/git-user/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-22c55e?style=flat-square" alt="MIT" /></a>
+    <a href="https://www.npmjs.com/package/git-userhub"><img src="https://img.shields.io/npm/v/git-userhub?style=flat&color=CB3837&logo=npm&logoColor=white" alt="npm version" /></a>
+    <a href="https://www.npmjs.com/package/git-userhub"><img src="https://img.shields.io/npm/dt/git-userhub?style=flat&color=CB3837&logo=npm&logoColor=white&label=total%20downloads" alt="total downloads" /></a>
+    <a href="https://github.com/divyo-argha/git-user/releases"><img src="https://img.shields.io/github/v/release/divyo-argha/git-user?style=flat&color=00FFAA&label=latest" alt="Latest Release" /></a>
+    <a href="https://github.com/divyo-argha/git-user/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-22c55e?style=flat" alt="MIT" /></a>
   </p>
 
-  <img src="https://img.shields.io/badge/GitHub-supported-181717?style=for-the-badge&logo=github&logoColor=white" alt="GitHub" />
-  <img src="https://img.shields.io/badge/GitLab-supported-FC6D26?style=for-the-badge&logo=gitlab&logoColor=white" alt="GitLab" />
-  <img src="https://img.shields.io/badge/Bitbucket-supported-0052CC?style=for-the-badge&logo=bitbucket&logoColor=white" alt="Bitbucket" />
-  <img src="https://img.shields.io/badge/macOS-supported-000000?style=for-the-badge&logo=apple&logoColor=white" alt="macOS" />
-  <img src="https://img.shields.io/badge/Linux-supported-FCC624?style=for-the-badge&logo=linux&logoColor=black" alt="Linux" />
-  <img src="https://img.shields.io/badge/Windows-supported-0078D4?style=for-the-badge&logo=windows&logoColor=white" alt="Windows" />
+  <img src="https://img.shields.io/badge/GitHub-supported-181717?style=flat&logo=github&logoColor=white" alt="GitHub" />
+  <img src="https://img.shields.io/badge/GitLab-supported-FC6D26?style=flat&logo=gitlab&logoColor=white" alt="GitLab" />
+  <img src="https://img.shields.io/badge/Bitbucket-supported-0052CC?style=flat&logo=bitbucket&logoColor=white" alt="Bitbucket" />
+  <img src="https://img.shields.io/badge/macOS-supported-000000?style=flat&logo=apple&logoColor=white" alt="macOS" />
+  <img src="https://img.shields.io/badge/Linux-supported-FCC624?style=flat&logo=linux&logoColor=black" alt="Linux" />
+  <img src="https://img.shields.io/badge/Windows-supported-0078D4?style=flat&logo=windows&logoColor=white" alt="Windows" />
 
   <br /><br />
 
@@ -176,7 +176,7 @@ MIT
 
 <div align="center">
 
-[![GitHub](https://img.shields.io/badge/Star%20on%20GitHub-181717?style=for-the-badge&logo=github&logoColor=white)](https://github.com/divyo-argha/git-user)
+[![GitHub](https://img.shields.io/badge/Star%20on%20GitHub-181717?style=flat&logo=github&logoColor=white)](https://github.com/divyo-argha/git-user)
 
 <sub>If git-user saved you from a wrong-account commit, consider giving it a ⭐</sub>
 

package/bin/git-user.js

@@ -1,157 +1,54 @@
 #!/usr/bin/env node
 
 const { spawn } = require('child_process');
-const https = require('https');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const tar = require('tar');
-const pkg = require('../package.json');
-
-const REPO = pkg.config.repo;
-const BIN_DIR = path.join(__dirname, '..', 'bin');
 
 // Detect platform and architecture
-function getPlatform() {
-  const platform = os.platform();
-  const arch = os.arch();
-  
-  const platformMap = {
-    'darwin': 'darwin',
-    'linux': 'linux',
-    'win32': 'windows'
-  };
-  
-  const archMap = {
-    'x64': 'amd64',
-    'arm64': 'arm64'
-  };
-  
-  return {
-    os: platformMap[platform],
-    arch: archMap[arch],
-    ext: platform === 'win32' ? '.exe' : ''
-  };
+const platform = os.platform();
+const arch = os.arch();
+
+const platformMap = {
+  'darwin': 'darwin',
+  'linux': 'linux',
+  'win32': 'windows'
+};
+
+const archMap = {
+  'x64': 'amd64',
+  'arm64': 'arm64'
+};
+
+const osName = platformMap[platform];
+const archName = archMap[arch];
+const ext = platform === 'win32' ? '.exe' : '';
+
+if (!osName || !archName) {
+  console.error(`❌ Unsupported platform: ${platform} ${arch}`);
+  process.exit(1);
 }
 
-// Download file from URL
-function download(url, dest) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest);
-    
-    https.get(url, (response) => {
-      if (response.statusCode === 302 || response.statusCode === 301) {
-        return download(response.headers.location, dest).then(resolve).catch(reject);
-      }
-      if (response.statusCode !== 200) {
-        reject(new Error(`Failed to download: ${response.statusCode}`));
-        return;
-      }
-      response.pipe(file);
-      file.on('finish', () => {
-        file.close();
-        resolve();
-      });
-    }).on('error', (err) => {
-      fs.unlink(dest, () => {});
-      reject(err);
-    });
-  });
-}
+const binaryName = `git-user-${osName}-${archName}${ext}`;
+const binaryPath = path.join(__dirname, binaryName);
 
-// Get release info matching this npm package version.
-function getRelease() {
-  return new Promise((resolve, reject) => {
-    const options = {
-      hostname: 'api.github.com',
-      path: `/repos/${REPO}/releases/tags/v${pkg.version}`,
-      headers: {
-        'User-Agent': 'git-user-cli'
-      }
-    };
-    
-    https.get(options, (res) => {
-      let data = '';
-      res.on('data', (chunk) => data += chunk);
-      res.on('end', () => {
-        try {
-          resolve(JSON.parse(data));
-        } catch (err) {
-          reject(err);
-        }
-      });
-    }).on('error', reject);
-  });
+if (!fs.existsSync(binaryPath)) {
+  console.error(`❌ git-user binary not found at ${binaryPath}`);
+  console.error(`   Please ensure the package was correctly installed.`);
+  process.exit(1);
 }
 
-async function installAndRun() {
-  const { os: osName, arch, ext } = getPlatform();
-  const binaryPath = path.join(BIN_DIR, `git-user${ext}`);
-
-  if (!fs.existsSync(binaryPath)) {
-    console.log('📦 First run detected. Downloading git-user binary...');
-    
-    if (!osName || !arch) {
-      console.error('❌ Unsupported platform:', os.platform(), os.arch());
-      process.exit(1);
-    }
-    
-    try {
-      if (!fs.existsSync(BIN_DIR)) {
-        fs.mkdirSync(BIN_DIR, { recursive: true });
-      }
-      
-      console.log(`🔍 Fetching release v${pkg.version}...`);
-      const release = await getRelease();
-      
-      const asset = release.assets?.find(a => {
-        const name = a.name.toLowerCase();
-        if (!name.includes(osName)) return false;
-        if (arch === 'arm64') return name.includes('arm64');
-        return name.includes('x86_64') || name.includes('amd64') || name.includes('x64');
-      });
-      
-      if (!asset) {
-        console.error('❌ No binary found for your platform');
-        console.error(`   Looking for a ${osName} binary matching architecture: ${arch}`);
-        process.exit(1);
-      }
-      
-      console.log(`⬇️  Downloading ${asset.name}...`);
-      const archivePath = path.join(BIN_DIR, asset.name);
-      await download(asset.browser_download_url, archivePath);
-      
-      console.log('📂 Extracting...');
-      await tar.extract({ file: archivePath, cwd: BIN_DIR });
-      fs.unlinkSync(archivePath);
-      
-      if (fs.existsSync(binaryPath)) {
-        fs.chmodSync(binaryPath, 0o755);
-        console.log('✅ git-user installed successfully!\n');
-      } else {
-        console.error('❌ Binary not found after extraction');
-        process.exit(1);
-      }
-    } catch (err) {
-      console.error('❌ Installation failed:', err.message);
-      process.exit(1);
-    }
-  }
+// Forward all arguments to the bundled binary
+const child = spawn(binaryPath, process.argv.slice(2), {
+  stdio: 'inherit',
+  shell: false
+});
 
-  // Forward all arguments to the binary
-  const child = spawn(binaryPath, process.argv.slice(2), {
-    stdio: 'inherit',
-    shell: false
-  });
-
-  child.on('exit', (code) => {
-    process.exit(code || 0);
-  });
-  
-  child.on('error', (err) => {
-    console.error('❌ Failed to start git-user:', err.message);
-    process.exit(1);
-  });
-}
+child.on('exit', (code) => {
+  process.exit(code || 0);
+});
 
-installAndRun();
+child.on('error', (err) => {
+  console.error('❌ Failed to start git-user:', err.message);
+  process.exit(1);
+});

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "git-userhub",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Switch Git accounts in one command. No config editing. No SSH key chaos.",
   "bin": {
     "git-user": "bin/git-user.js"
   },
   "scripts": {
-    "test": "echo \"No tests yet\" && exit 0"
+    "test": "echo \"No tests yet\" && exit 0",
+    "prepublishOnly": "node scripts/download-binaries.js"
   },
-  "dependencies": {
+  "devDependencies": {
     "tar": "^7.4.3"
   },
   "keywords": [
@@ -44,13 +45,6 @@
     "x64",
     "arm64"
   ],
-  "socket": {
-    "allowedNetworkHosts": [
-      "api.github.com",
-      "github.com",
-      "objects.githubusercontent.com"
-    ]
-  },
   "config": {
     "repo": "divyo-argha/git-user"
   }

package/test_tar.js

@@ -0,0 +1,44 @@
+const fs = require('fs');
+const crypto = require('crypto');
+const tar = require('tar');
+
+const assetName = "git-user_darwin_arm64.tar.gz";
+
+async function main() {
+  console.log("Creating dummy tar file using node-tar...");
+  // create dummy git-user
+  fs.writeFileSync('git-user', 'dummy binary');
+  fs.writeFileSync('malicious.sh', 'echo bad');
+  
+  await tar.create({
+    gzip: true,
+    file: assetName,
+  }, ['git-user', 'malicious.sh']);
+  
+  console.log("Tar created.");
+
+  const file = fs.readFileSync(assetName);
+  const expectedHash = crypto.createHash('sha256').update(file).digest('hex');
+  
+  fs.unlinkSync('git-user');
+  fs.unlinkSync('malicious.sh');
+
+  console.log("Expected hash:", expectedHash);
+
+  // Now extract securely
+  fs.mkdirSync('bin', { recursive: true });
+  
+  await tar.extract({
+    file: assetName,
+    cwd: 'bin',
+    filter: (p, entry) => {
+      console.log('Filtering path:', p, entry.path);
+      return p === 'git-user' || p === 'git-user.exe' || p === './git-user' || p === './git-user.exe';
+    }
+  });
+
+  const binContents = fs.readdirSync('bin');
+  console.log("Bin contents:", binContents);
+}
+
+main().catch(console.error);