qpdf-compress 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-07-15
+
+### Security
+
+- Verify the downloaded prebuilt binary against a per-platform SHA-256 pin shipped in the package before use, falling back to the checksum-pinned source build on mismatch or a missing pin. Closes the prebuilt-binary trust gap where a swapped GitHub release asset could be executed unverified.
+
+### Changed
+
+- The `update-native-deps` PR body now describes `verify-checksums` as a consistency check against the same source rather than "independent" verification.
+
+### Fixed
+
+- Corrected the HarfBuzz version recorded in `THIRD-PARTY-NOTICES.md` (14.1.0 → 14.2.1) to match the pinned dependency.
+
+### Added
+
+- Hermetic test coverage for prebuilt verification and manifest generation (`test/prebuild.test.ts`).
+
 ## [0.7.0] - 2026-06-27
 
 ### Added
@@ -193,7 +211,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - QEMU-based cross-compilation for Linux arm64/arm and musl variants
 - vcpkg integration for Windows static linking
 
-[Unreleased]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.7.1...HEAD
+[0.7.1]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.6.4...v0.7.0
 [0.6.4]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.6.3...v0.6.4
 [0.6.3]: https://github.com/xonaman/nodejs-qpdf-compress/compare/v0.6.2...v0.6.3

package/THIRD-PARTY-NOTICES.md

@@ -9,7 +9,7 @@ full license text of each is available from the upstream project linked.
 | -------- | ------------------ | --------------------------------------------------------- | -------------------------------------- |
 | QPDF     | 12.3.2             | Apache-2.0                                                | <https://github.com/qpdf/qpdf>         |
 | mozjpeg  | 4.1.1              | BSD-3-Clause and IJG (with zlib-licensed SIMD components) | <https://github.com/mozilla/mozjpeg>   |
-| HarfBuzz | 14.1.0             | MIT ("Old MIT")                                           | <https://github.com/harfbuzz/harfbuzz> |
+| HarfBuzz | 14.2.1             | MIT ("Old MIT")                                           | <https://github.com/harfbuzz/harfbuzz> |
 | zlib     | bundled on Windows | zlib License                                              | <https://github.com/madler/zlib>       |
 
 ## Details

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qpdf-compress",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Native PDF compression for Node.js, powered by QPDF",
   "license": "Apache-2.0",
   "type": "module",
@@ -96,16 +96,16 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^25.5.0",
+    "@types/node": "^22.0.0",
     "@vitest/coverage-v8": "^4.1.4",
     "eslint": "^10.1.0",
     "eslint-config-prettier": "^10.1.8",
     "globals": "^17.0.0",
     "husky": "^9.1.7",
-    "lint-staged": "^16.4.0",
+    "lint-staged": "^17.0.8",
     "node-gyp": "^13.0.0",
     "prettier": "^3.8.1",
-    "typescript": "^5.9.3",
+    "typescript": "^6.0.3",
     "typescript-eslint": "^8.57.2",
     "vitest": "^4.1.4"
   }

package/scripts/gen-prebuild-manifest.mjs

@@ -0,0 +1,59 @@
+/**
+ * Generate `scripts/prebuilds.json`: a map of "<platform>-<arch>" -> SHA-256 of
+ * each prebuilt release tarball.
+ *
+ * Run in the release workflow AFTER the prebuild artifacts are downloaded and
+ * BEFORE `npm publish`, so the pins ship *inside* the published (SLSA-attested)
+ * npm package. `install.mjs` then verifies a downloaded prebuilt against the
+ * pin baked into the package, closing the prebuilt-binary trust gap: a swapped
+ * GitHub release asset will not match the pin and falls back to the
+ * checksum-pinned source build.
+ *
+ * Usage: node scripts/gen-prebuild-manifest.mjs <artifacts-dir>
+ */
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { sha256File } from './lib/integrity.mjs';
+
+/**
+ * Map every "<prefix>-v<version>-<platform>-<arch>.tar.gz" in `artifactsDir` to
+ * its SHA-256, keyed by "<platform>-<arch>" (matching install.mjs's lookup).
+ *
+ * @param {string} artifactsDir
+ * @param {string} version
+ * @returns {Promise<Record<string, string>>}
+ */
+export async function computePins(artifactsDir, version) {
+  // strip the "<prefix>-v<version>-" head and ".tar.gz" tail to recover the key
+  const headRe = new RegExp('^.*-v' + version.replace(/[.]/g, '\\.') + '-');
+  const files = readdirSync(artifactsDir)
+    .filter((f) => f.endsWith('.tar.gz'))
+    .sort();
+  const pins = {};
+  for (const file of files) {
+    const key = file.replace(/\.tar\.gz$/, '').replace(headRe, '');
+    pins[key] = await sha256File(join(artifactsDir, file));
+  }
+  return pins;
+}
+
+// CLI entrypoint (skipped when this module is imported, e.g. by tests)
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const artifactsDir = process.argv[2];
+  if (!artifactsDir) {
+    console.error('usage: node scripts/gen-prebuild-manifest.mjs <artifacts-dir>');
+    process.exit(1);
+  }
+  const root = join(import.meta.dirname, '..');
+  const { version } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const pins = await computePins(artifactsDir, version);
+  if (Object.keys(pins).length === 0) {
+    console.error(`No .tar.gz artifacts found in ${artifactsDir}`);
+    process.exit(1);
+  }
+  for (const [key, sha] of Object.entries(pins)) console.log(`  ${key}  ${sha}`);
+  const out = join(root, 'scripts', 'prebuilds.json');
+  writeFileSync(out, JSON.stringify(pins, null, 2) + '\n');
+  console.log(`Wrote ${Object.keys(pins).length} prebuild pin(s) to ${out}`);
+}

package/scripts/install.mjs

@@ -11,12 +11,25 @@ import { createWriteStream, existsSync, mkdirSync, readFileSync, unlinkSync } fr
 import { join } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { extractTarball } from './lib/integrity.mjs';
+import { extractTarball, verifyPrebuild } from './lib/integrity.mjs';
 
 const root = join(import.meta.dirname, '..');
 const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
 const version = pkg.version;
 
+// Per-platform SHA-256 pins for the prebuilt tarballs, generated at release
+// time (scripts/gen-prebuild-manifest.mjs) and shipped inside this package.
+// The prebuilt binary is the code that actually runs, so it is verified against
+// this pin before use; a swapped release asset fails the check and we fall back
+// to the checksum-pinned source build.
+function loadPrebuildPins() {
+  try {
+    return JSON.parse(readFileSync(join(import.meta.dirname, 'prebuilds.json'), 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
 // validate version to prevent SSRF via malicious package.json
 if (!/^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?$/.test(version)) {
   console.error(`Invalid version format: ${version}`);
@@ -74,6 +87,23 @@ async function tryDownload() {
 
     await pipeline(Readable.fromWeb(body), fileStream);
 
+    // verify the prebuilt against the pinned checksum before trusting it
+    const pinKey = `${platformKey}-${arch}`;
+    const check = await verifyPrebuild(tmpTar, pinKey, loadPrebuildPins());
+    if (!check.ok) {
+      if (check.reason === 'no-pin') {
+        console.log(
+          `No pinned checksum for ${pinKey}; refusing unverified prebuilt, will compile from source.`,
+        );
+      } else {
+        console.log(
+          `Prebuilt checksum mismatch for ${pinKey} (expected ${check.expected}, got ${check.actual}); will compile from source.`,
+        );
+      }
+      unlinkSync(tmpTar);
+      return false;
+    }
+
     // extract tar.gz into project root (hardened: no -P, no archived ownership)
     extractTarball(tmpTar, root);
     unlinkSync(tmpTar);

package/scripts/lib/integrity.mjs

@@ -32,6 +32,29 @@ export async function sha256File(path) {
   return hash.digest('hex');
 }
 
+/**
+ * Decide whether a downloaded prebuilt tarball is trusted by comparing its
+ * SHA-256 to the pin recorded for `pinKey` in `pins` (scripts/prebuilds.json).
+ * Returns a discriminated result so the installer can log and fall back to a
+ * source build instead of running an unverified binary.
+ *
+ * @param {string} tarPath
+ * @param {string} pinKey  e.g. "darwin-arm64" / "linux-musl-x64"
+ * @param {Record<string, string>} pins
+ * @returns {Promise<{ok: true, pinKey: string, sha256: string}
+ *   | {ok: false, reason: 'no-pin', pinKey: string}
+ *   | {ok: false, reason: 'mismatch', pinKey: string, expected: string, actual: string}>}
+ */
+export async function verifyPrebuild(tarPath, pinKey, pins) {
+  const expected = pins[pinKey];
+  if (!expected) return { ok: false, reason: 'no-pin', pinKey };
+  const actual = await sha256File(tarPath);
+  if (actual !== expected.toLowerCase()) {
+    return { ok: false, reason: 'mismatch', pinKey, expected, actual };
+  }
+  return { ok: true, pinKey, sha256: actual };
+}
+
 /** Read the native-dependency manifest (scripts/native-deps.json). */
 export function loadManifest() {
   return JSON.parse(readFileSync(join(import.meta.dirname, '..', 'native-deps.json'), 'utf8'));

package/scripts/native-deps.json

@@ -7,10 +7,10 @@
     "checksumSource": "official PGP-signed release manifest (qpdf-12.3.2.sha256)"
   },
   "harfbuzz": {
-    "version": "14.1.0",
+    "version": "14.2.1",
     "origin": "https://github.com",
-    "url": "https://github.com/harfbuzz/harfbuzz/archive/refs/tags/14.1.0.tar.gz",
-    "sha256": "9deffe9dded3c367c7d08265fd0a64193fad505a362a4889d898568c1cd46812",
+    "url": "https://github.com/harfbuzz/harfbuzz/archive/refs/tags/14.2.1.tar.gz",
+    "sha256": "3c2a9006a7e1bf58737e557014d7882c554c628fb379a9f00008f5ea53dbbdfb",
     "checksumSource": "self-computed from the GitHub git-archive tarball; HarfBuzz's only release asset is .tar.xz, whose extraction hangs Windows bsdtar — the gzip git-archive builds identically"
   },
   "mozjpeg": {

package/scripts/prebuilds.json

@@ -0,0 +1,11 @@
+{
+  "darwin-arm64": "2af510fe83270db0874eef4accafe24a8aefa37af4e5f7d621eb2bb4702491ed",
+  "darwin-x64": "5b55c91245c220ad287bc20a02a72c34edc11765ed1f71630fb174554c402251",
+  "linux-arm": "302480ffb46576cc009386a3621099946bc1435387afe680a07c8d4abe90920b",
+  "linux-arm64": "ae3ae7629a6ead5e61b0f67167ef4ad6bc3309f84bcae70d0e30cd3690246161",
+  "linux-musl-arm64": "075a23fae7a2cc3d4b01fde42aa09e9d52d024cdb003236adfa4d1b1b5435d81",
+  "linux-musl-x64": "2aa7f761de96acbf604ef2ed7d9f45068257ca12ac735fa0c5529a64b9e9c34b",
+  "linux-x64": "85743113468dcdc2f676e9def2dba2f8edca8fd3084fb4ea032542a5ce1b3ce2",
+  "win32-arm64": "ce651ad9d9e1e4b57e549ef1379aeef44f013a5912b0890bcc8605050e531328",
+  "win32-x64": "d7ccbcb0b089996f116100fcaf0b0554c8b9c1a423f43955be2c16b9ce499906"
+}

package/scripts/update-native-deps.mjs

@@ -0,0 +1,129 @@
+/**
+ * Check each native dependency in native-deps.json for a newer upstream GitHub
+ * release and, when found, re-pin the version and re-hash the asset(s).
+ *
+ * This is the piece Dependabot cannot do: the prebuilt/source native libraries
+ * are upstream release tarballs, not a package-manager ecosystem. Runs in CI
+ * (see .github/workflows/update-native-deps.yml) and emits a markdown summary
+ * for the pull-request body via GITHUB_OUTPUT.
+ *
+ * Supports both manifest shapes:
+ *  - per-platform "targets" (baseUrl + { asset, sha256 } map), version == full tag
+ *  - single "url" + "sha256", version == numeric (tag with any v/n prefix stripped)
+ *
+ * Only upstreams that publish a GitHub Release are tracked; a dependency whose
+ * repo has no usable release is skipped with a warning (kept manual) rather than
+ * guessed from noisy git tags.
+ */
+import { createHash } from 'node:crypto';
+import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+const manifestPath = join(import.meta.dirname, 'native-deps.json');
+const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+const token = process.env.GITHUB_TOKEN;
+const apiHeaders = {
+  accept: 'application/vnd.github+json',
+  'user-agent': 'update-native-deps',
+  ...(token ? { authorization: `Bearer ${token}` } : {}),
+};
+
+// derive "OWNER/REPO" from a github.com baseUrl (targets shape) or url (single)
+function repoFor(dep) {
+  const source = dep.baseUrl ?? dep.url;
+  const match = /^https:\/\/github\.com\/([^/]+\/[^/]+)/.exec(source ?? '');
+  if (!match) throw new Error(`cannot derive a github.com OWNER/REPO from: ${source}`);
+  return match[1];
+}
+
+// returns the latest release tag, or null when the repo publishes no release
+async function latestReleaseTag(repo) {
+  const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+    headers: apiHeaders,
+    signal: AbortSignal.timeout(30000),
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) throw new Error(`GitHub API returned HTTP ${res.status} for ${repo} latest release`);
+  const { tag_name: tag } = await res.json();
+  if (!tag) throw new Error(`latest release for ${repo} has no tag_name`);
+  return tag;
+}
+
+async function sha256Url(url, allowedOrigin) {
+  const parsed = new URL(url);
+  if (allowedOrigin && parsed.origin !== allowedOrigin) {
+    throw new Error(`refusing to fetch from unexpected origin: ${parsed.origin}`);
+  }
+  const res = await fetch(parsed, { redirect: 'follow', signal: AbortSignal.timeout(120000) });
+  if (!res.ok) throw new Error(`HTTP ${res.status} for ${parsed.href}`);
+  if (!res.body) throw new Error(`empty response body for ${parsed.href}`);
+  const hash = createHash('sha256');
+  await pipeline(Readable.fromWeb(res.body), hash);
+  return hash.digest('hex');
+}
+
+const changes = [];
+for (const [name, dep] of Object.entries(manifest)) {
+  const repo = repoFor(dep);
+  const tag = await latestReleaseTag(repo);
+  if (tag === null) {
+    console.warn(`${name}: ${repo} publishes no GitHub release; skipping (update manually)`);
+    continue;
+  }
+
+  if (dep.targets) {
+    // targets shape: version is the full tag (e.g. "chromium/7920")
+    if (tag === dep.version) {
+      console.log(`${name}: up to date (${dep.version})`);
+      continue;
+    }
+    console.log(
+      `${name}: ${dep.version} -> ${tag}; re-hashing ${Object.keys(dep.targets).length} targets`,
+    );
+    for (const [key, target] of Object.entries(dep.targets)) {
+      const url = `${dep.baseUrl}/${encodeURIComponent(tag)}/${target.asset}`;
+      target.sha256 = await sha256Url(url, dep.origin);
+      console.log(`  ${key}: ${target.sha256}`);
+    }
+    changes.push({ name, from: dep.version, to: tag });
+    dep.version = tag;
+  } else {
+    // single-url shape: manifest version is numeric; the tag may carry a v/n
+    // prefix. The url embeds the version string, so a plain substitution rebuilds
+    // both the tag segment and the filename.
+    const version = tag.replace(/^[^0-9]*/, '');
+    if (version === dep.version) {
+      console.log(`${name}: up to date (${dep.version})`);
+      continue;
+    }
+    const url = dep.url.replaceAll(dep.version, version);
+    console.log(`${name}: ${dep.version} -> ${version}; re-hashing`);
+    dep.sha256 = await sha256Url(url, dep.origin);
+    dep.url = url;
+    changes.push({ name, from: dep.version, to: version });
+    dep.version = version;
+  }
+}
+
+if (changes.length === 0) {
+  console.log('\nAll native dependencies are up to date.');
+} else {
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+  const summary = changes.map((c) => `- **${c.name}**: \`${c.from}\` → \`${c.to}\``).join('\n');
+  console.log(`\n${summary}`);
+
+  if (process.env.GITHUB_OUTPUT) {
+    const body = [
+      'Automated native dependency update.',
+      '',
+      summary,
+      '',
+      'Checksums were recomputed from the upstream release assets. `verify-checksums` re-downloads each asset and confirms it matches the recorded hash — a consistency check against the same source, not independent provenance.',
+    ].join('\n');
+    appendFileSync(process.env.GITHUB_OUTPUT, 'changed=true\n');
+    appendFileSync(process.env.GITHUB_OUTPUT, `body<<PR_BODY_EOF\n${body}\nPR_BODY_EOF\n`);
+  }
+}