oh-my-codex 0.20.2 → 0.20.5

package/src/scripts/__tests__/verify-native-release-assets.test.ts

@@ -0,0 +1,240 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PassThrough } from 'node:stream';
+import { gzipSync } from 'node:zlib';
+import { describe, it } from 'node:test';
+import { compress as xzCompress } from '@napi-rs/lzma/xz';
+import * as tar from 'tar-stream';
+import * as yazl from 'yazl';
+import { fileURLToPath } from 'node:url';
+
+function sha256(value: Buffer): string {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function verify(manifest: string, artifacts: string) {
+  return spawnSync(process.execPath, [fileURLToPath(new URL('../verify-native-release-assets.js', import.meta.url)), '--manifest', manifest, '--artifacts-dir', artifacts], { encoding: 'utf-8' });
+}
+
+async function collect(stream: NodeJS.ReadableStream): Promise<Buffer> {
+  const output: Buffer[] = [];
+  for await (const chunk of stream) output.push(Buffer.from(chunk));
+  return Buffer.concat(output);
+}
+
+async function tarArchive(entries: Array<{ name: string; data?: Buffer; type?: tar.Headers['type']; linkname?: string }>, format: 'tar.gz' | 'tar.xz'): Promise<Buffer> {
+  const archive = tar.pack();
+  for (const item of entries) {
+    const header: tar.Headers = { name: item.name, type: item.type ?? 'file', size: item.data?.length ?? 0, linkname: item.linkname };
+    if ((item.type ?? 'file') === 'file') archive.entry(header, item.data ?? Buffer.alloc(0));
+    else archive.entry(header);
+  }
+  archive.finalize();
+  const raw = await collect(archive);
+  return format === 'tar.gz' ? gzipSync(raw) : xzCompress(raw);
+}
+
+async function zipArchive(entries: Array<{ name: string; data?: Buffer }>): Promise<Buffer> {
+  const archive = new yazl.ZipFile();
+  for (const item of entries) {
+    if (item.name.endsWith('/')) archive.addEmptyDirectory(item.name);
+    else archive.addBuffer(item.data ?? Buffer.alloc(0), item.name);
+  }
+  archive.end();
+  return collect(archive.outputStream);
+}
+
+function crc32(value: Buffer): number {
+  let crc = 0xffffffff;
+  for (const byte of value) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) crc = (crc >>> 1) ^ (-(crc & 1) & 0xedb88320);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function rawZip(name: string, mode: number, dosAttributes = 0, data = Buffer.alloc(0)): Buffer {
+  const fileName = Buffer.from(name);
+  const crc = crc32(data);
+  const local = Buffer.alloc(30);
+  local.writeUInt32LE(0x04034b50, 0);
+  local.writeUInt16LE(20, 4);
+  local.writeUInt32LE(crc, 14);
+  local.writeUInt32LE(data.length, 18);
+  local.writeUInt32LE(data.length, 22);
+  local.writeUInt16LE(fileName.length, 26);
+
+  const central = Buffer.alloc(46);
+  central.writeUInt32LE(0x02014b50, 0);
+  central.writeUInt16LE((3 << 8) | 20, 4);
+  central.writeUInt16LE(20, 6);
+  central.writeUInt32LE(crc, 16);
+  central.writeUInt32LE(data.length, 20);
+  central.writeUInt32LE(data.length, 24);
+  central.writeUInt16LE(fileName.length, 28);
+  central.writeUInt32LE((((mode & 0xffff) << 16) | dosAttributes) >>> 0, 38);
+
+  const directoryOffset = local.length + fileName.length + data.length;
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(1, 8);
+  end.writeUInt16LE(1, 10);
+  end.writeUInt32LE(central.length + fileName.length, 12);
+  end.writeUInt32LE(directoryOffset, 16);
+  return Buffer.concat([local, fileName, data, central, fileName, end]);
+}
+
+function manifestFor(archive: string, content: Buffer, overrides: Record<string, unknown> = {}) {
+  return {
+    manifest_version: 1,
+    version: '0.8.15',
+    tag: 'v0.8.15',
+    assets: [{
+      product: 'omx-api', version: '0.8.15', platform: 'linux', arch: 'x64', target: 'x86_64-unknown-linux-musl', libc: 'musl',
+      archive, binary: 'omx-api', binary_path: 'omx-api', sha256: sha256(content), size: content.length,
+      download_url: `https://example.invalid/${archive}`,
+      ...overrides,
+    }],
+  };
+}
+
+async function verifyArchive(root: string, archive: string, content: Buffer, overrides: Record<string, unknown> = {}, manifestOverrides: Record<string, unknown> = {}) {
+  await writeFile(join(root, archive), content);
+  const manifest = join(root, `${archive}.manifest.json`);
+  await writeFile(manifest, JSON.stringify({ ...manifestFor(archive, content, overrides), ...manifestOverrides }));
+  return verify(manifest, root);
+}
+
+describe('verify-native-release-assets', () => {
+  it('accepts tar.gz, tar.xz, and zip archives with one wrapped regular binary', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-'));
+    try {
+      for (const format of ['tar.gz', 'tar.xz', 'zip'] as const) {
+        const artifacts = join(wd, format.replace('.', '-'));
+        await mkdir(artifacts, { recursive: true });
+        const archive = `omx-api-x86_64-unknown-linux-musl.${format}`;
+        const content = format === 'zip'
+          ? await zipArchive([{ name: 'wrapper/', data: Buffer.alloc(0) }, { name: 'wrapper/omx-api', data: Buffer.from('x') }])
+          : await tarArchive([{ name: 'wrapper/', type: 'directory' }, { name: 'wrapper/omx-api', data: Buffer.from('x') }], format);
+        assert.equal((await verifyArchive(artifacts, archive, content)).status, 0, format);
+      }
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('accepts full-release siblings with logical Windows binary names and executable paths', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-full-'));
+    try {
+      const apiArchive = 'omx-api-x86_64-pc-windows-msvc.zip';
+      const runtimeArchive = 'omx-runtime-x86_64-pc-windows-msvc.zip';
+      const apiBytes = await zipArchive([{ name: 'omx-api.exe', data: Buffer.from('api') }]);
+      const runtimeBytes = await zipArchive([{ name: 'omx-runtime.exe', data: Buffer.from('runtime') }]);
+      await writeFile(join(wd, apiArchive), apiBytes);
+      await writeFile(join(wd, runtimeArchive), runtimeBytes);
+      const asset = (product: string, archive: string, binaryPath: string, content: Buffer) => ({
+        product,
+        version: '0.20.3',
+        platform: 'win32',
+        arch: 'x64',
+        target: 'x86_64-pc-windows-msvc',
+        archive,
+        binary: product,
+        binary_path: binaryPath,
+        sha256: sha256(content),
+        size: content.length,
+        download_url: `https://example.invalid/${archive}`,
+      });
+      const manifestPath = join(wd, 'native-release-manifest.json');
+      await writeFile(manifestPath, JSON.stringify({
+        manifest_version: 1,
+        version: '0.20.3',
+        tag: 'v0.20.3',
+        assets: [
+          asset('omx-api', apiArchive, 'omx-api.exe', apiBytes),
+          asset('omx-runtime', runtimeArchive, 'omx-runtime.exe', runtimeBytes),
+        ],
+      }));
+      const result = verify(manifestPath, wd);
+      assert.equal(result.status, 0, result.stderr || result.stdout);
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects unsafe unrelated paths and links before selecting a binary', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-unsafe-'));
+    try {
+      for (const [index, unsafe] of ['../escape', '/absolute', 'C:/drive', 'dir\\backslash'].entries()) {
+        const archive = `unsafe-${index}.tar.gz`;
+        const content = await tarArchive([{ name: 'omx-api', data: Buffer.from('x') }, { name: unsafe, data: Buffer.from('x') }], 'tar.gz');
+        assert.notEqual((await verifyArchive(wd, archive, content)).status, 0, unsafe);
+      }
+      const linked = await tarArchive([{ name: 'omx-api', data: Buffer.from('x') }, { name: 'link', type: 'symlink', linkname: 'omx-api' }], 'tar.gz');
+      assert.notEqual((await verifyArchive(wd, 'linked.tar.gz', linked)).status, 0);
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects ZIP entries with contradictory Unix types and directory markers', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-zip-types-'));
+    try {
+      const malformed = [
+        rawZip('regular/', 0o100644),
+        rawZip('regular', 0o100644, 0x10),
+        rawZip('directory', 0o040755),
+      ];
+      for (const [index, content] of malformed.entries()) {
+        assert.notEqual((await verifyArchive(wd, `zip-types-${index}.zip`, content)).status, 0);
+      }
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects ambiguous, colliding, and zero-byte selected members', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-selection-'));
+    try {
+      const cases = [
+        await tarArchive([{ name: 'one/omx-api', data: Buffer.from('x') }, { name: 'two/omx-api', data: Buffer.from('x') }], 'tar.gz'),
+        await tarArchive([{ name: 'omx-api', data: Buffer.from('x') }, { name: 'omx-api/config', data: Buffer.from('x') }], 'tar.gz'),
+        await tarArchive([{ name: 'omx-api', data: Buffer.alloc(0) }], 'tar.gz'),
+      ];
+      for (const [index, content] of cases.entries()) {
+        assert.notEqual((await verifyArchive(wd, `selection-${index}.tar.gz`, content)).status, 0);
+      }
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+
+  it('enforces manifest version, target, libc, and basename coherence', async () => {
+    const wd = await mkdtemp(join(tmpdir(), 'omx-verify-native-release-manifest-'));
+    try {
+      const content = await tarArchive([{ name: 'omx-api', data: Buffer.from('x') }], 'tar.gz');
+      const invalid = [
+        [{}, { manifest_version: undefined }],
+        [{}, { version: 'v0.8.15', tag: 'vv0.8.15' }],
+        [{}, { tag: 'v0.8.16' }],
+        [{ platform: 'darwin', arch: 'x64', target: 'x86_64-apple-darwin', libc: 'musl' }, {}],
+        [{ product: 'omx-unknown' }, {}],
+        [{ binary: 'omx-api.exe' }, {}],
+        [{ binary_path: '../omx-api' }, {}],
+        [{ archive: 'nested/omx-api-x86_64-unknown-linux-musl.tar.gz' }, {}],
+        [{ archive: 'omx-api-x86_64-unknown-linux-musl.tar.bz2' }, {}],
+        [{ archive: 'omx-api-x86_64-unknown-linux-gnu.tar.gz' }, {}],
+        [{ archive: 'omx-api-aarch64-unknown-linux-musl.tar.gz' }, {}],
+      ] as const;
+      for (const [index, [assetOverrides, documentOverrides]] of invalid.entries()) {
+        assert.notEqual((await verifyArchive(wd, `manifest-${index}.tar.gz`, content, assetOverrides, documentOverrides)).status, 0);
+      }
+    } finally {
+      await rm(wd, { recursive: true, force: true });
+    }
+  });
+});