iterate-skill-installer 3.10.0 → 3.12.0

package/lib/installer.js

@@ -56,6 +56,16 @@ const CHECKSUMS_ASSET_NAME = 'SHA256SUMS.txt';
 // verifies authenticity (not just integrity) against the embedded signing key.
 const TARBALL_SIGNATURE_ASSET_NAME = 'iterate-skill.tar.gz.asc';
 
+/**
+ * Find a release asset by name, tolerating a malformed payload.
+ * Guards each element (a malformed GitHub API response can contain a null /
+ * non-object entry before the matching asset; `a.name` on null would throw a
+ * TypeError instead of the intended clean "release is missing …" error path).
+ */
+function findReleaseAsset(assets, name) {
+  return Array.isArray(assets) ? assets.find((a) => a && a.name === name) : undefined;
+}
+
 // Hard cap on a single curl download: a misbehaving CDN or a corrupt release
 // must never hang the installer forever.
 const CURL_MAX_TIME_SECONDS = '120';
@@ -166,6 +176,25 @@ const ITERATE_SIGNING_PUBLIC_KEY = [
   '-----END PGP PUBLIC KEY BLOCK-----',
 ].join('\n');
 
+//: SHA-1 fingerprint of the pinned signing key (uid jingzhao-l (sign-github)).
+//: Verification is only accepted when the ``VALIDSIG`` fingerprint belongs to
+//: this key, not merely on a GOODSIG/exit-0 — a substituted signer whose key
+//: gpg auto-retrieved would otherwise pass. Keep in sync with
+//: ``iterate_cli/signing.py`` and ``scripts/install.py``.
+const ITERATE_SIGNING_KEY_FINGERPRINT = '0929EA31DF4F7429F63FC53189D88B1D043A1298';
+
+//: Extract the fingerprints gpg reported as ``VALIDSIG`` in ``--status-fd``
+//: output. A status line is ``[GNUPG:] VALIDSIG <fpr> <date> …``.
+function validsigFingerprints(statusOutput) {
+  const fprs = [];
+  for (const line of String(statusOutput || '').split('\n')) {
+    if (!line.startsWith('[GNUPG:] VALIDSIG ')) continue;
+    const parts = line.split(/\s+/);
+    if (parts.length >= 3 && parts[2]) fprs.push(parts[2].toUpperCase());
+  }
+  return fprs;
+}
+
 const ITERATE_BANNER = [
   '██╗████████╗███████╗██████╗  █████╗ ████████╗███████╗',
   '██║╚══██╔══╝██╔════╝██╔══██╗██╔══██╗╚══██╔══╝██╔════╝',
@@ -616,7 +645,7 @@ function verifyGpgDetachedSignature(artifactPath, signaturePath, publicKeyArmor,
 
   const verifyResult = spawnSync(
     'gpg',
-    ['--homedir', gpgHome, '--batch', '--quiet', '--no-autostart', '--verify', signaturePath, artifactPath],
+    ['--homedir', gpgHome, '--batch', '--quiet', '--no-autostart', '--no-auto-key-retrieve', '--status-fd', '1', '--verify', signaturePath, artifactPath],
     { encoding: 'utf8', timeout, killSignal: 'SIGKILL' }
   );
   if (verifyResult.error) {
@@ -631,8 +660,15 @@ function verifyGpgDetachedSignature(artifactPath, signaturePath, publicKeyArmor,
     }
     return { status: 'unavailable', detail: `gpg launch failed: ${verifyResult.error.message}` };
   }
-  // gpg exit 0 = good signature; 1 = bad signature; 2 = fatal (bad key usage).
-  if (verifyResult.status === 0) {
+  // A GOODSIG (or exit 0) alone does not prove the signer is the pinned key: a
+  // substituted signer whose key gpg auto-retrieved would pass. Require a
+  // VALIDSIG fingerprint belonging to the pinned key, mirroring
+  // iterate_cli/signing.py and scripts/install.py (keep in sync).
+  const signerFingerprints = validsigFingerprints(verifyResult.stdout);
+  const matchesPinned = signerFingerprints.some(
+    (fpr) => fpr === ITERATE_SIGNING_KEY_FINGERPRINT
+  );
+  if (verifyResult.status === 0 && matchesPinned) {
     return { status: 'verified', detail: (verifyResult.stderr || '').trim() };
   }
   return { status: 'invalid', detail: (verifyResult.stderr || '').trim() || `gpg exited ${verifyResult.status}` };
@@ -1611,11 +1647,11 @@ async function main(options = {}) {
   }
   success(`Latest release: ${tag}`);
 
-  const tarballAsset = release.assets?.find((a) => a.name === TARBALL_ASSET_NAME);
-  const checksumAsset = release.assets?.find((a) => a.name === CHECKSUMS_ASSET_NAME);
+  const tarballAsset = findReleaseAsset(release.assets, TARBALL_ASSET_NAME);
+  const checksumAsset = findReleaseAsset(release.assets, CHECKSUMS_ASSET_NAME);
   // Optional `.asc` signature; its absence only downgrades authenticity to
   // integrity (see the best-effort verify below), never fails the install.
-  const signatureAsset = release.assets?.find((a) => a.name === TARBALL_SIGNATURE_ASSET_NAME);
+  const signatureAsset = findReleaseAsset(release.assets, TARBALL_SIGNATURE_ASSET_NAME);
 
   if (!tarballAsset) {
     error(`Release is missing the ${TARBALL_ASSET_NAME} asset.`);
@@ -1794,6 +1830,7 @@ module.exports = {
   parseChecksums,
   constantTimeHashEqual,
   enforceDownloadedSize,
+  findReleaseAsset,
   extractTarball,
   rejectLinkEntries,
   sumDeclaredSizes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-skill-installer",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "description": "One-command installer for iterate-skill across AI coding assistants",
   "main": "lib/installer.js",
   "files": [