herozion 1.1.74 → 1.1.75

package/bin/checksums.json

@@ -0,0 +1,8 @@
+{
+  "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
+  "_version": "1.1.75",
+  "herozion-linux-amd64": "42e718f60c1cfd3633a04e30c000bbb5311f15dd7222396b9bb7cba530570654",
+  "herozion-macos-amd64": "09a8aec95ac62df1bbe6f1b4f875248ce50ca9bf02ba2664e1f32d842f273ee7",
+  "herozion-macos-arm64": "441a7c237e5c7fb09c598dcfc7b4e3403d8d308768a8e2302110f39efeae5dd1",
+  "herozion-windows-amd64.exe": "9345261a6d986b327c2f68c9d21d687a0eb6c3622de1340e34149c418afbb4e5"
+}

package/install.js

@@ -42,6 +42,13 @@ function getBinaryName() {
   const { platform, arch } = process;
 
   if (platform === "win32" && arch === "x64") return "herozion-windows-amd64.exe";
+  if (platform === "linux" && arch === "arm64") {
+    throw new Error(
+      "Herozion: Linux ARM64 is not supported by the npm binary installer yet.\n" +
+      "Use: pip install herozion  OR  download from:\n" +
+      "  https://github.com/Herozion/scanner-releases/releases/latest"
+    );
+  }
   if (platform === "linux" && (arch === "x64" || arch === "ia32")) return "herozion-linux-amd64";
   if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64";
   if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64";
@@ -159,10 +166,22 @@ async function main() {
   // ── Load bundled checksums (primary trust anchor) ─────────────────────────
   const bundledChecksumsPath = path.join(__dirname, "bin", "checksums.json");
   let bundledHash = "";
-  try {
-    const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
-    bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
-  } catch (_) {}
+  if (fs.existsSync(bundledChecksumsPath)) {
+    try {
+      const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
+      bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
+      if (!bundledHash) {
+        console.warn(`herozion: WARNING — no bundled hash entry for ${binaryName}.`);
+      }
+    } catch (parseErr) {
+      console.warn(`herozion: WARNING — invalid checksums.json: ${parseErr.message}`);
+    }
+  } else {
+    console.warn(
+      "herozion: WARNING — bin/checksums.json missing from npm package; " +
+      "falling back to remote CHECKSUMS.sha256 verification."
+    );
+  }
 
   console.log(`herozion: downloading ${binaryName} v${VERSION}...`);
   try {
@@ -170,6 +189,8 @@ async function main() {
     await download(url, tmpPath);
 
     const actualHash = sha256File(tmpPath);
+    let bundledVerified = false;
+    let remoteVerified = false;
 
     // ── Primary check: bundled checksum (trust anchor inside the npm package) ─
     if (bundledHash) {
@@ -183,6 +204,7 @@ async function main() {
           "This may indicate a supply-chain attack. Aborting installation."
         );
       }
+      bundledVerified = true;
     }
 
     // ── Secondary check: CHECKSUMS.sha256 from GitHub Releases ────────────────
@@ -198,56 +220,62 @@ async function main() {
         }
         return "";
       })();
-      if (remoteHash && actualHash !== remoteHash) {
-        fs.unlinkSync(tmpPath);
-        throw new Error(
-          `Remote checksum mismatch for ${binaryName}.\n` +
-          `  Expected (remote) : ${remoteHash}\n` +
-          `  Got               : ${actualHash}\n` +
-          "The downloaded binary does not match the GitHub Releases .sha256 file."
-        );
+      if (remoteHash) {
+        if (actualHash !== remoteHash) {
+          fs.unlinkSync(tmpPath);
+          throw new Error(
+            `Remote checksum mismatch for ${binaryName}.\n` +
+            `  Expected (remote) : ${remoteHash}\n` +
+            `  Got               : ${actualHash}\n` +
+            "The downloaded binary does not match the GitHub Releases CHECKSUMS.sha256 file."
+          );
+        }
+        remoteVerified = true;
       }
     } catch (checksumErr) {
-      // If we have a valid bundled hash that already passed, remote failure is non-fatal
-      if (!bundledHash) {
+      // If bundled verification already passed, remote failure is non-fatal.
+      if (!bundledVerified) {
         throw checksumErr;
       }
       console.warn(`herozion: WARNING — could not verify remote checksum: ${checksumErr.message}`);
       console.warn("Proceeding because bundled checksum verification passed.");
     }
 
-    // Fail closed: refuse to install if neither hash source could be verified.
-    if (!bundledHash) {
-      // We reach here only when bundledHash is empty AND remote check was skipped/failed.
-      // Secondary catch block re-throws when !bundledHash, so this path is belt-and-suspenders.
+    // Fail closed: require at least one independent verification source.
+    if (!bundledVerified && !remoteVerified) {
       fs.unlinkSync(tmpPath);
       throw new Error(
-        `Cannot verify ${binaryName}: no bundled hash found and remote checksum unavailable.\n` +
+        `Cannot verify ${binaryName}: no bundled hash in package and remote checksum unavailable.\n` +
         "Installation aborted to prevent supply-chain risk.\n" +
         `Download manually from: ${BASE_URL}/${binaryName}`
       );
     }
 
-    // Both checks passed — move binary into place
+    // Verification passed — move binary into place
     fs.renameSync(tmpPath, destPath);
     if (!isWindows) {
       fs.chmodSync(destPath, 0o755);
     }
     // Write version marker so we don't re-download on repeated installs
     fs.writeFileSync(markerPath, VERSION, "utf8");
-    const verifiedBy = bundledHash ? "bundled + remote SHA-256" : "remote SHA-256";
+    const verifiedBy = bundledVerified && remoteVerified
+      ? "bundled + remote SHA-256"
+      : bundledVerified
+        ? "bundled SHA-256"
+        : "remote SHA-256";
     console.log(`herozion: binary installed successfully (verified: ${verifiedBy}).`);
   } catch (err) {
     // Clean up temp file if it exists
     try { fs.unlinkSync(tmpPath); } catch (_) {}
-    // Non-fatal: warn and continue — the bin shim will give a clear error at runtime
-    console.warn(`herozion: WARNING — could not download binary: ${err.message}`);
-    console.warn(`You can download it manually from:`);
-    console.warn(`  ${BASE_URL}/${binaryName}`);
+    console.error(`herozion: ERROR — could not install binary: ${err.message}`);
+    console.error("Try reinstalling with scripts enabled:");
+    console.error("  npm install herozion --foreground-scripts");
+    console.error(`Or download manually from: ${BASE_URL}/${binaryName}`);
+    process.exit(1);
   }
 }
 
 main().catch((err) => {
   console.error("herozion install error:", err.message);
-  // Do not exit(1) — a failed postinstall breaks `npm install` entirely
+  process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.1.74",
+  "version": "1.1.75",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",
@@ -23,6 +23,7 @@
   },
   "files": [
     "bin/herozion.js",
+    "bin/checksums.json",
     "install.js",
     "README.md"
   ],