herozion 1.1.74 → 1.1.76

package/bin/checksums.json

@@ -0,0 +1,8 @@
+{
+  "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
+  "_version": "1.1.76",
+  "herozion-linux-amd64": "388813017d4212e1615132e8ea98cba63eefa8b6885d9b8509f64e9d9c7f46d1",
+  "herozion-macos-amd64": "50145d9ac239c0380fe60c2e775ed43bd9588efd32538fe4bcee4c89a6a92cbd",
+  "herozion-macos-arm64": "5fe6d4c03b5d7d944e14d59371477b9a5a2e456a8a2ee3f051022587303594cc",
+  "herozion-windows-amd64.exe": "1a64cc8460e5cf92b4806e0ecd69b857bc70d2b7fe42981842ff9b8cf24d558f"
+}

package/install.js

@@ -42,6 +42,13 @@ function getBinaryName() {
   const { platform, arch } = process;
 
   if (platform === "win32" && arch === "x64") return "herozion-windows-amd64.exe";
+  if (platform === "linux" && arch === "arm64") {
+    throw new Error(
+      "Herozion: Linux ARM64 is not supported by the npm binary installer yet.\n" +
+      "Use: pip install herozion  OR  download from:\n" +
+      "  https://github.com/Herozion/scanner-releases/releases/latest"
+    );
+  }
   if (platform === "linux" && (arch === "x64" || arch === "ia32")) return "herozion-linux-amd64";
   if (platform === "darwin" && arch === "arm64") return "herozion-macos-arm64";
   if (platform === "darwin" && (arch === "x64" || arch === "ia32")) return "herozion-macos-amd64";
@@ -59,8 +66,18 @@ const _ALLOWED_REDIRECT_HOSTS = new Set([
   "objects.githubusercontent.com",
   "codeload.github.com",
   "releases.githubusercontent.com",
+  "release-assets.githubusercontent.com",
 ]);
 
+function _isAllowedRedirectHost(host) {
+  if (_ALLOWED_REDIRECT_HOSTS.has(host)) {
+    return true;
+  }
+  // GitHub release binaries are served from various *.githubusercontent.com CDNs.
+  // Allow the suffix so new CDN hostnames do not break installs.
+  return host.endsWith(".githubusercontent.com");
+}
+
 function _validateRedirectUrl(location) {
   if (!location || !location.startsWith("https://")) {
     throw new Error(`Redirect to non-HTTPS URL rejected: ${location}`);
@@ -69,10 +86,10 @@ function _validateRedirectUrl(location) {
   try { host = new URL(location).hostname; } catch (_) {
     throw new Error(`Invalid redirect URL: ${location}`);
   }
-  if (!_ALLOWED_REDIRECT_HOSTS.has(host)) {
+  if (!_isAllowedRedirectHost(host)) {
     throw new Error(
       `Redirect to untrusted host rejected: ${host}\n` +
-      "Only github.com and githubusercontent.com are allowed."
+      "Only github.com and *.githubusercontent.com are allowed."
     );
   }
 }
@@ -159,10 +176,22 @@ async function main() {
   // ── Load bundled checksums (primary trust anchor) ─────────────────────────
   const bundledChecksumsPath = path.join(__dirname, "bin", "checksums.json");
   let bundledHash = "";
-  try {
-    const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
-    bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
-  } catch (_) {}
+  if (fs.existsSync(bundledChecksumsPath)) {
+    try {
+      const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
+      bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
+      if (!bundledHash) {
+        console.warn(`herozion: WARNING — no bundled hash entry for ${binaryName}.`);
+      }
+    } catch (parseErr) {
+      console.warn(`herozion: WARNING — invalid checksums.json: ${parseErr.message}`);
+    }
+  } else {
+    console.warn(
+      "herozion: WARNING — bin/checksums.json missing from npm package; " +
+      "falling back to remote CHECKSUMS.sha256 verification."
+    );
+  }
 
   console.log(`herozion: downloading ${binaryName} v${VERSION}...`);
   try {
@@ -170,6 +199,8 @@ async function main() {
     await download(url, tmpPath);
 
     const actualHash = sha256File(tmpPath);
+    let bundledVerified = false;
+    let remoteVerified = false;
 
     // ── Primary check: bundled checksum (trust anchor inside the npm package) ─
     if (bundledHash) {
@@ -183,6 +214,7 @@ async function main() {
           "This may indicate a supply-chain attack. Aborting installation."
         );
       }
+      bundledVerified = true;
     }
 
     // ── Secondary check: CHECKSUMS.sha256 from GitHub Releases ────────────────
@@ -198,56 +230,62 @@ async function main() {
         }
         return "";
       })();
-      if (remoteHash && actualHash !== remoteHash) {
-        fs.unlinkSync(tmpPath);
-        throw new Error(
-          `Remote checksum mismatch for ${binaryName}.\n` +
-          `  Expected (remote) : ${remoteHash}\n` +
-          `  Got               : ${actualHash}\n` +
-          "The downloaded binary does not match the GitHub Releases .sha256 file."
-        );
+      if (remoteHash) {
+        if (actualHash !== remoteHash) {
+          fs.unlinkSync(tmpPath);
+          throw new Error(
+            `Remote checksum mismatch for ${binaryName}.\n` +
+            `  Expected (remote) : ${remoteHash}\n` +
+            `  Got               : ${actualHash}\n` +
+            "The downloaded binary does not match the GitHub Releases CHECKSUMS.sha256 file."
+          );
+        }
+        remoteVerified = true;
       }
     } catch (checksumErr) {
-      // If we have a valid bundled hash that already passed, remote failure is non-fatal
-      if (!bundledHash) {
+      // If bundled verification already passed, remote failure is non-fatal.
+      if (!bundledVerified) {
         throw checksumErr;
       }
       console.warn(`herozion: WARNING — could not verify remote checksum: ${checksumErr.message}`);
       console.warn("Proceeding because bundled checksum verification passed.");
     }
 
-    // Fail closed: refuse to install if neither hash source could be verified.
-    if (!bundledHash) {
-      // We reach here only when bundledHash is empty AND remote check was skipped/failed.
-      // Secondary catch block re-throws when !bundledHash, so this path is belt-and-suspenders.
+    // Fail closed: require at least one independent verification source.
+    if (!bundledVerified && !remoteVerified) {
       fs.unlinkSync(tmpPath);
       throw new Error(
-        `Cannot verify ${binaryName}: no bundled hash found and remote checksum unavailable.\n` +
+        `Cannot verify ${binaryName}: no bundled hash in package and remote checksum unavailable.\n` +
         "Installation aborted to prevent supply-chain risk.\n" +
         `Download manually from: ${BASE_URL}/${binaryName}`
       );
     }
 
-    // Both checks passed — move binary into place
+    // Verification passed — move binary into place
     fs.renameSync(tmpPath, destPath);
     if (!isWindows) {
       fs.chmodSync(destPath, 0o755);
     }
     // Write version marker so we don't re-download on repeated installs
     fs.writeFileSync(markerPath, VERSION, "utf8");
-    const verifiedBy = bundledHash ? "bundled + remote SHA-256" : "remote SHA-256";
+    const verifiedBy = bundledVerified && remoteVerified
+      ? "bundled + remote SHA-256"
+      : bundledVerified
+        ? "bundled SHA-256"
+        : "remote SHA-256";
     console.log(`herozion: binary installed successfully (verified: ${verifiedBy}).`);
   } catch (err) {
     // Clean up temp file if it exists
     try { fs.unlinkSync(tmpPath); } catch (_) {}
-    // Non-fatal: warn and continue — the bin shim will give a clear error at runtime
-    console.warn(`herozion: WARNING — could not download binary: ${err.message}`);
-    console.warn(`You can download it manually from:`);
-    console.warn(`  ${BASE_URL}/${binaryName}`);
+    console.error(`herozion: ERROR — could not install binary: ${err.message}`);
+    console.error("Try reinstalling with scripts enabled:");
+    console.error("  npm install herozion --foreground-scripts");
+    console.error(`Or download manually from: ${BASE_URL}/${binaryName}`);
+    process.exit(1);
   }
 }
 
 main().catch((err) => {
   console.error("herozion install error:", err.message);
-  // Do not exit(1) — a failed postinstall breaks `npm install` entirely
+  process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "1.1.74",
+  "version": "1.1.76",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",
@@ -23,6 +23,7 @@
   },
   "files": [
     "bin/herozion.js",
+    "bin/checksums.json",
     "install.js",
     "README.md"
   ],