herozion 2.0.13 → 2.0.16

package/bin/checksums.json

@@ -1,8 +1,8 @@
 {
   "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
-  "_version": "2.0.13",
-  "herozion-linux-amd64": "a20617f88c2fe0221d08e5a5c7d5b1bfb281f8f98a9c7b027a88527cc2d3d420",
-  "herozion-macos-amd64.tar.gz": "5c8dd9c0954a9c0447d40e07f1d83901e28a7c99d43c9afc3366dc7180cf177c",
-  "herozion-macos-arm64.tar.gz": "b710499760b841adb20fc7f5d562b4c5a8b5c7a9d67579e7d8b801639abc149c",
-  "herozion-windows-amd64.exe": "61a1b876158105a9b2c9592368bcfcbb92b5030b13d8acd21342ca320c95b65d"
+  "_version": "2.0.16",
+  "herozion-linux-amd64": "a6f14d840c17e335bb1d34edb88ee9aad688db73595de8a0573091538bfc8796",
+  "herozion-macos-amd64.tar.gz": "d2d99b9a51ccfcd533b8c7e62af924886ae5c090772a3ff43dbbed26ea3d9e02",
+  "herozion-macos-arm64.tar.gz": "c29772a2ef54953e5a86a5dafb2e06cf456e5cc1765ff506f243d4d171ffe499",
+  "herozion-windows-amd64.exe": "711328645a1e692e7f63e6eb86d77b0da8b4797c64e2ed743abf3fa7cc100d88"
 }

package/install.js

@@ -14,8 +14,10 @@
  * 1. PRIMARY trust anchor: bin/checksums.json bundled inside this npm package.
  *    These hashes are embedded at `npm publish` time and cannot be swapped by
  *    a GitHub Releases compromise alone.
- * 2. SECONDARY verification: <binary>.sha256 downloaded from GitHub Releases.
- *    Both must agree; if either fails the binary is rejected.
+ * 2. SECONDARY verification: CHECKSUMS.sha256 from GitHub Releases.
+ *    A remote hash mismatch rejects the binary even when the bundled hash matched.
+ *    If that file cannot be fetched and the bundled hash matched, install continues
+ *    with a warning.
  *
  * Supported platforms:
  *   Windows  x64  → herozion-windows-amd64.exe
@@ -94,13 +96,23 @@ function _validateRedirectUrl(location) {
   }
 }
 
+function _isRedirect(statusCode) {
+  return (
+    statusCode === 301 ||
+    statusCode === 302 ||
+    statusCode === 303 ||
+    statusCode === 307 ||
+    statusCode === 308
+  );
+}
+
 function download(url, destPath, redirectCount = 0) {
   return new Promise((resolve, reject) => {
     if (redirectCount > 5) {
       return reject(new Error("Too many redirects"));
     }
     https.get(url, { headers: { "User-Agent": "herozion-npm-installer" } }, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302) {
+      if (_isRedirect(res.statusCode)) {
         try { _validateRedirectUrl(res.headers.location); } catch (e) { return reject(e); }
         return resolve(download(res.headers.location, destPath, redirectCount + 1));
       }
@@ -127,7 +139,7 @@ function downloadText(url, redirectCount = 0) {
   return new Promise((resolve, reject) => {
     if (redirectCount > 5) return reject(new Error("Too many redirects"));
     https.get(url, { headers: { "User-Agent": "herozion-npm-installer" } }, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302) {
+      if (_isRedirect(res.statusCode)) {
         try { _validateRedirectUrl(res.headers.location); } catch (e) { return reject(e); }
         return resolve(downloadText(res.headers.location, redirectCount + 1));
       }
@@ -276,57 +288,13 @@ async function main() {
     await download(url, tmpPath);
 
     const actualHash = sha256File(tmpPath);
-    let bundledVerified = false;
-    let remoteVerified = false;
-
-    // ── Primary check: bundled checksum (trust anchor inside the npm package) ─
-    if (bundledHash) {
-      if (actualHash !== bundledHash) {
-        fs.unlinkSync(tmpPath);
-        throw new Error(
-          `Bundled checksum mismatch for ${binaryName}.\n` +
-          `  Expected (bundled) : ${bundledHash}\n` +
-          `  Got                : ${actualHash}\n` +
-          "The downloaded binary does not match the hash embedded in this npm package.\n" +
-          "This may indicate a supply-chain attack. Aborting installation."
-        );
-      }
-      bundledVerified = true;
-    }
-
-    // ── Secondary check: CHECKSUMS.sha256 from GitHub Releases ────────────────
-    try {
-      const checksumData = await downloadText(checksumUrl);
-      // Parse the combined checksum file: each line is "<hash>  <filename>"
-      const remoteHash = (() => {
-        for (const line of checksumData.split(/\n/)) {
-          const parts = line.trim().split(/\s+/);
-          if (parts.length >= 2 && parts[1] === binaryName) {
-            return parts[0].toLowerCase();
-          }
-        }
-        return "";
-      })();
-      if (remoteHash) {
-        if (actualHash !== remoteHash) {
-          fs.unlinkSync(tmpPath);
-          throw new Error(
-            `Remote checksum mismatch for ${binaryName}.\n` +
-            `  Expected (remote) : ${remoteHash}\n` +
-            `  Got               : ${actualHash}\n` +
-            "The downloaded binary does not match the GitHub Releases CHECKSUMS.sha256 file."
-          );
-        }
-        remoteVerified = true;
-      }
-    } catch (checksumErr) {
-      // If bundled verification already passed, remote failure is non-fatal.
-      if (!bundledVerified) {
-        throw checksumErr;
-      }
-      console.warn(`herozion: WARNING — could not verify remote checksum: ${checksumErr.message}`);
-      console.warn("Proceeding because bundled checksum verification passed.");
-    }
+    // A remote CHECKSUMS mismatch is rethrown even when the bundled hash matched.
+    const { bundledVerified, remoteVerified } = await verifyChecksums({
+      actualHash,
+      bundledHash,
+      binaryName,
+      readRemoteChecksums: () => downloadText(checksumUrl),
+    });
 
     // Fail closed: require at least one independent verification source.
     if (!bundledVerified && !remoteVerified) {
@@ -367,7 +335,74 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  console.error("herozion install error:", err.message);
-  process.exit(1);
-});
+function parseRemoteChecksum(checksumData, binaryName) {
+  for (const line of String(checksumData).split(/\n/)) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length >= 2 && parts[1] === binaryName) {
+      return parts[0].toLowerCase();
+    }
+  }
+  return "";
+}
+
+/**
+ * Compare the downloaded bytes with the bundled hash and CHECKSUMS.sha256.
+ * A remote mismatch always rejects the binary. A failure to fetch the remote
+ * file is fatal only when the bundled hash did not already match.
+ */
+async function verifyChecksums({ actualHash, bundledHash, binaryName, readRemoteChecksums }) {
+  let bundledVerified = false;
+  let remoteVerified = false;
+  if (bundledHash) {
+    if (actualHash !== bundledHash) {
+      throw new Error(
+        `Bundled checksum mismatch for ${binaryName}.\n` +
+        `  Expected (bundled) : ${bundledHash}\n` +
+        `  Got                : ${actualHash}\n` +
+        "The downloaded binary does not match the hash embedded in this npm package.\n" +
+        "This may indicate a supply-chain attack. Aborting installation."
+      );
+    }
+    bundledVerified = true;
+  }
+
+  let remoteMismatch = null;
+  try {
+    const remoteHash = parseRemoteChecksum(await readRemoteChecksums(), binaryName);
+    if (remoteHash && actualHash !== remoteHash) {
+      remoteMismatch = new Error(
+        `Remote checksum mismatch for ${binaryName}.\n` +
+        `  Expected (remote) : ${remoteHash}\n` +
+        `  Got               : ${actualHash}\n` +
+        "The downloaded binary does not match the GitHub Releases CHECKSUMS.sha256 file."
+      );
+    } else if (remoteHash) {
+      remoteVerified = true;
+    }
+  } catch (checksumErr) {
+    if (!bundledVerified) {
+      throw checksumErr;
+    }
+    console.warn(`herozion: WARNING — could not verify remote checksum: ${checksumErr.message}`);
+    console.warn("Proceeding because bundled checksum verification passed.");
+  }
+  if (remoteMismatch) {
+    throw remoteMismatch;
+  }
+  return { bundledVerified, remoteVerified };
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error("herozion install error:", err.message);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  _isRedirect,
+  download,
+  downloadText,
+  parseRemoteChecksum,
+  verifyChecksums,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "2.0.13",
+  "version": "2.0.16",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",