gspace 0.1.2 → 0.2.0

package/lib/bootstrap.js

@@ -9,7 +9,7 @@ import { Readable } from 'stream';
 import { requestHTTPS, cancelBody } from './https.js';
 import { extractBundle, validateFiles, verifyBundle } from './bundle.js';
 
-const VERSION = '0.1.2';
+const VERSION = '0.2.0';
 const DAY = 24 * 60 * 60 * 1000;
 const MAX_ARTIFACT = 256 * 1024 * 1024;
 const nonce = () => randomBytes(12).toString('hex');
@@ -161,6 +161,11 @@ function artifact(value, source) {
   const url = new URL(value.url, source);
   if (source.protocol === 'https:' && url.protocol !== 'https:') throw new Error('Remote manifests cannot reference local or insecure artifacts.');
   if (!['https:', 'file:'].includes(url.protocol)) throw new Error('Unsupported artifact URL.');
+  if (value.mirrors !== undefined && (!Array.isArray(value.mirrors) || value.mirrors.length > 3)) throw new Error('Invalid artifact mirrors.');
+  for (const mirror of value.mirrors || []) {
+    const parsed = new URL(mirror);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password) throw new Error('Mirrors require HTTPS without credentials.');
+  }
   return { ...value, url: url.href };
 }
 
@@ -222,6 +227,15 @@ async function downloadRanges(value, handle, first, request) {
 }
 
 export async function downloadVerified(value, destination, transport = requestHTTPS) {
+  let failure;
+  for (const url of [value.url, ...(value.mirrors || [])]) {
+    try { return await downloadFromSource({ ...value, url }, destination, transport); }
+    catch (error) { failure = error; }
+  }
+  throw failure;
+}
+
+async function downloadFromSource(value, destination, transport) {
   if (!Number.isSafeInteger(value.size) || value.size <= 0 || value.size > MAX_ARTIFACT || !/^[a-f0-9]{64}$/.test(value.sha256)) throw new Error('Invalid release artifact metadata.');
   const url = new URL(value.url);
   const temporary = `${destination}.download-${nonce()}`;
@@ -367,7 +381,8 @@ export async function main(args, env = process.env) {
     releaseLock = await lock(context.root);
     runtime = await currentRuntime(context.root);
     const config = JSON.parse(await fs.readFile(new URL('../release.json', import.meta.url), 'utf8'));
-    const location = env.GSPACE_RELEASE_MANIFEST || config.manifest;
+    const locations = env.GSPACE_RELEASE_MANIFEST ? [env.GSPACE_RELEASE_MANIFEST] : [config.manifest, ...(config.fallbacks || [])].filter(Boolean);
+    const location = locations[0];
     const forceUpdate = args[0] === '--update';
     if (forceUpdate) args = args.slice(1);
     const cacheFile = path.join(context.root, 'runtime', 'update.json');
@@ -377,9 +392,16 @@ export async function main(args, env = process.env) {
       if (!location && !runtime) throw new Error('No release source configured. Set GSPACE_RELEASE_MANIFEST to a local manifest.json or HTTPS URL, or use GSPACE_CORE for a development build.');
       if (location) {
         try {
-          const source = asURL(location);
-          const raw = await fetchBytes(source, 1024 * 1024);
-          const manifest = validateManifest(JSON.parse(raw.toString('utf8')), source);
+          let source, raw, manifest, sourceError;
+          for (const candidate of locations) {
+            try {
+              source = asURL(candidate);
+              raw = await fetchBytes(source, 1024 * 1024);
+              manifest = validateManifest(JSON.parse(raw.toString('utf8')), source);
+              break;
+            } catch (error) { sourceError = error; }
+          }
+          if (!manifest) throw sourceError;
           const hash = createHash('sha256').update(raw).digest('hex');
           if (!runtime || runtime.manifest_hash !== hash) {
             if (!runtime) console.error(`Gspace is not installed on this workstation.\nUsing ${context.goinfre}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gspace",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Gspace launcher for 1337/42 Linux workstations",
   "repository": {
     "type": "git",

package/release.json

@@ -1 +1 @@
-{"manifest": "https://github.com/Seraph919/gspace-releases/releases/latest/download/manifest.json"}
+{"manifest":"https://gspace-downloads.pages.dev/manifest.json","fallbacks":["https://github.com/Seraph919/gspace-releases/releases/latest/download/manifest.json"]}