nw 0.89.0 → 0.90.0-1

package/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2011-2019 NW.js Authors
+Copyright (c) 2011-2019 The Chromium Authors
+Copyright (c) 2011-2018 Intel Corp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of 
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to use, 
+copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the 
+Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR 
+A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH
+THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -36,7 +36,7 @@ npm install --save-dev nw@0.85.0-1
 npm install --save-dev nw@sdk
 ```
 
-> Optionally set `nwjs_build_type=sdk` in `.npmrc` or `NWJS_BUILD_TYPE=sdk` environment variable.
+Or set `nwjs_build_type=sdk` in `.npmrc` or `NWJS_BUILD_TYPE=sdk` environment variable.
 
 ### Specify platform:
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nw",
-  "version": "0.89.0",
-  "description": "An installer for nw.js",
+  "version": "0.90.0-1",
+  "description": "An installer for NW.js",
   "repository": {
     "type": "git",
     "url": "git://github.com/nwjs/npm-installer.git"
@@ -14,12 +14,9 @@
   "scripts": {
     "postinstall": "node src/postinstall.js",
     "test": "vitest run",
-    "test:cov": "vitest --coverage.enabled true",
-    "demo": "nw ./test/app --log-level=verbose"
+    "test:coverage": "vitest --coverage.enabled true"
   },
   "files": [
-    "bin",
-    "lib",
     "src"
   ],
   "author": {
@@ -34,10 +31,10 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "axios": "^1.7.2",
+    "axios": "^1.7.4",
     "commander": "^12.1.0",
-    "semver": "^7.6.2",
-    "tar": "^7.4.0",
+    "semver": "^7.6.3",
+    "tar": "^7.4.3",
     "yauzl-promise": "^4.0.0"
   },
   "keywords": [
@@ -53,8 +50,9 @@
     "application"
   ],
   "devDependencies": {
-    "@vitest/coverage-v8": "^1.6.0",
-    "selenium-webdriver": "^4.22.0",
-    "vitest": "^1.6.0"
+    "@vitest/coverage-v8": "^2.0.5",
+    "patch-package": "^8.0.0",
+    "selenium-webdriver": "^4.23.0",
+    "vitest": "^2.0.2"
   }
 }

package/src/get.js

@@ -96,6 +96,12 @@ async function get(options) {
 
   await decompress(nwFilePath, options.cacheDir);
 
+  await verify(
+    `${options.downloadUrl}/v${options.version}/SHASUMS256.txt`,
+    `${options.cacheDir}/shasum/${options.version}.txt`,
+    options.cacheDir,
+  );
+
   await fs.promises.symlink(nwDirPath, './nwjs', );
 
   if (options.ffmpeg === true) {

package/src/postinstall.js

@@ -1,3 +1,4 @@
+import child_process from 'node:child_process';
 import fs from 'node:fs';
 import process from 'node:process';
 import path from 'node:path';
@@ -8,6 +9,14 @@ import semver from 'semver';
 import get from './get.js';
 import util from './util.js';
 
+const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
+
+const patchPackagePath = path.resolve(path.join(__dirname, '..', 'node_modules', 'patch-package'));
+
+if (fs.existsSync(patchPackagePath)) {
+    child_process.execSync('node ' + patchPackagePath);
+}
+
 await postinstall()
     .catch((error) => {
         if (error.code === 'EPERM') {

package/src/verify.js

@@ -0,0 +1,47 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import request from './request.js';
+import util from './util.js';
+
+/**
+ * Verify the SHA256 checksum of downloaded artifacts.
+ *
+ * @param {string} shaUrl - URL to get the shasum text file from.
+ * @param {string} shaOut - File path to shasum text file.
+ * @param {string} cacheDir - File path to cache directory.
+ * @throws {Error}
+ * @returns {Promise<boolean>}
+ */
+export default async function verify(shaUrl, shaOut, cacheDir) {
+  const shaOutExists = await util.fileExists(shaOut);
+
+  if (shaOutExists === false) {
+    /* Create directory if does not exist. */
+    await fs.promises.mkdir(path.dirname(shaOut), { recursive: true });
+
+    /* Download SHASUM text file. */
+    await request(shaUrl, shaOut);
+  }
+
+  /* Read SHASUM text file */
+  const shasum = await fs.promises.readFile(shaOut, { encoding: 'utf-8' });
+  const shasums = shasum.trim().split('\n');
+  for await (const line of shasums) {
+    const [storedSha, filePath] = line.split('  ');
+    const relativeFilePath = path.resolve(cacheDir, filePath);
+    const relativefilePathExists = await util.fileExists(relativeFilePath);
+    if (relativefilePathExists) {
+      const fileBuffer = await fs.promises.readFile(relativeFilePath);
+      const hash = crypto.createHash('sha256');
+      hash.update(fileBuffer);
+      const generatedSha = hash.digest('hex');
+      if (storedSha !== generatedSha) {
+        throw new Error('SHA256 checksums do not match.');
+      }
+    }
+  }
+
+  return true;
+}

package/src/verify.test.js

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+
+import verify from "./verify.js";
+
+describe("get/verify", function () {
+
+  it("verify shasums", async function () {
+    const status = await verify(
+      'https://dl.nwjs.io/v0.90.0/SHASUMS256.txt',
+      './shasum/0.90.0.txt',
+      '.'
+    );
+    expect(status).toBe(true);
+  }, Infinity);
+});