sandboxedjs 0.1.95 → 0.1.97

package/dist/index.cjs

@@ -20958,7 +20958,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.95"};
+  version: "0.1.97"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -23933,9 +23933,7 @@ async function installRequirements(options) {
       continue;
     }
     options.progress.downloading(distribution.name, distribution.version);
-    const bytes2 = await options.client.bytes(distribution.url, { timeoutMs: 12e4 });
-    requireArchive(distribution, bytes2);
-    verifyDigest(distribution, bytes2);
+    const bytes2 = await download(options.client, distribution);
     const files = stageWheel(readZip(bytes2));
     staged.push(...distribution.kind === "substituted" ? substituteFiles(distribution.name, files, SITE_PACKAGES) : files);
     installed3.push({ name: distribution.name, version: distribution.version });
@@ -23951,18 +23949,41 @@ function requireArchive(distribution, bytes2) {
     `${distribution.filename} did not arrive as a wheel from ${distribution.url}: ` + (looksLikeMarkup ? "the server answered with an HTML page, which usually means the wheel is not published at that address and the server returned its index page instead" : `expected a zip archive, got ${bytes2.length} bytes beginning ${JSON.stringify(opening)}`)
   );
 }
-function verifyDigest(distribution, bytes2) {
+async function download(client, distribution) {
+  const bytes2 = await client.bytes(distribution.url, { timeoutMs: 12e4 });
+  requireArchive(distribution, bytes2);
+  const mismatch = digestMismatch(distribution, bytes2);
+  if (!mismatch) return bytes2;
+  const fresh = await refetch(client, distribution);
+  if (fresh && !digestMismatch(distribution, fresh)) {
+    requireArchive(distribution, fresh);
+    return fresh;
+  }
+  throw new Error(
+    `${mismatch} ${fresh ? "A retry past any cache returned the same bytes, so the index and the file it names disagree." : "A retry past any cache could not be made, so this may be a cached copy of an older build; clearing the cache, or asking the index's host to purge it, is worth trying before the index is blamed."}`
+  );
+}
+async function refetch(client, distribution) {
+  const separator = distribution.url.includes("?") ? "&" : "?";
+  try {
+    const bytes2 = await client.bytes(
+      `${distribution.url}${separator}sha256=${distribution.sha256}`,
+      { timeoutMs: 6e4 }
+    );
+    return bytes2.length > 1 && bytes2[0] === 80 && bytes2[1] === 75 ? bytes2 : null;
+  } catch {
+    return null;
+  }
+}
+function digestMismatch(distribution, bytes2) {
   if (!distribution.sha256) {
     throw new Error(
       `${distribution.filename} was published without a sha256 digest, so it cannot be verified`
     );
   }
   const actual = [...sha256.sha256(bytes2)].map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (actual !== distribution.sha256) {
-    throw new Error(
-      `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}`
-    );
-  }
+  if (actual === distribution.sha256) return null;
+  return `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}.`;
 }
 function stageWheel(entries, resolved) {
   const staged = [];
@@ -28043,12 +28064,19 @@ async function installRelease(ctx, index, release, seen, options) {
   const base2 = registryBase(ctx).replace(/\/$/, "");
   const url = `${base2}/${release.filename}`;
   ctx.line(`Fetching ${release.name} ${release.version}`);
-  const archive = await download(url);
-  const digest2 = await digestHex("sha256", archive);
+  let archive = await download2(url);
+  let digest2 = await digestHex("sha256", archive);
   if (digest2 !== release.sha256) {
-    throw new AppRegistryError(
-      `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}`
-    );
+    const retried = await download2(`${url}${url.includes("?") ? "&" : "?"}sha256=${release.sha256}`).catch(() => null);
+    const retriedDigest = retried && await digestHex("sha256", retried);
+    if (retried && retriedDigest === release.sha256) {
+      archive = retried;
+      digest2 = retriedDigest;
+    } else {
+      throw new AppRegistryError(
+        `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}. ` + (retried ? "A retry past any cache returned the same bytes, so the registry and the file it names disagree." : "A retry past any cache could not be made; a cached copy of an older build would look like this, so clearing the cache is worth trying before the registry is blamed.")
+      );
+    }
   }
   const verified = await verify(ctx, archive, release, options);
   const root = `${APPS_ROOT}/${release.name}`;
@@ -28075,7 +28103,7 @@ async function installRelease(ctx, index, release, seen, options) {
   }
   if (manifest.docs) ctx.line(`  docs: ${root}/${manifest.docs}`);
 }
-async function download(url) {
+async function download2(url) {
   const response = await fetch(url);
   if (!response.ok) {
     throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);

package/dist/index.js

@@ -20941,7 +20941,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.95"};
+  version: "0.1.97"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -23916,9 +23916,7 @@ async function installRequirements(options) {
       continue;
     }
     options.progress.downloading(distribution.name, distribution.version);
-    const bytes2 = await options.client.bytes(distribution.url, { timeoutMs: 12e4 });
-    requireArchive(distribution, bytes2);
-    verifyDigest(distribution, bytes2);
+    const bytes2 = await download(options.client, distribution);
     const files = stageWheel(readZip(bytes2));
     staged.push(...distribution.kind === "substituted" ? substituteFiles(distribution.name, files, SITE_PACKAGES) : files);
     installed3.push({ name: distribution.name, version: distribution.version });
@@ -23934,18 +23932,41 @@ function requireArchive(distribution, bytes2) {
     `${distribution.filename} did not arrive as a wheel from ${distribution.url}: ` + (looksLikeMarkup ? "the server answered with an HTML page, which usually means the wheel is not published at that address and the server returned its index page instead" : `expected a zip archive, got ${bytes2.length} bytes beginning ${JSON.stringify(opening)}`)
   );
 }
-function verifyDigest(distribution, bytes2) {
+async function download(client, distribution) {
+  const bytes2 = await client.bytes(distribution.url, { timeoutMs: 12e4 });
+  requireArchive(distribution, bytes2);
+  const mismatch = digestMismatch(distribution, bytes2);
+  if (!mismatch) return bytes2;
+  const fresh = await refetch(client, distribution);
+  if (fresh && !digestMismatch(distribution, fresh)) {
+    requireArchive(distribution, fresh);
+    return fresh;
+  }
+  throw new Error(
+    `${mismatch} ${fresh ? "A retry past any cache returned the same bytes, so the index and the file it names disagree." : "A retry past any cache could not be made, so this may be a cached copy of an older build; clearing the cache, or asking the index's host to purge it, is worth trying before the index is blamed."}`
+  );
+}
+async function refetch(client, distribution) {
+  const separator = distribution.url.includes("?") ? "&" : "?";
+  try {
+    const bytes2 = await client.bytes(
+      `${distribution.url}${separator}sha256=${distribution.sha256}`,
+      { timeoutMs: 6e4 }
+    );
+    return bytes2.length > 1 && bytes2[0] === 80 && bytes2[1] === 75 ? bytes2 : null;
+  } catch {
+    return null;
+  }
+}
+function digestMismatch(distribution, bytes2) {
   if (!distribution.sha256) {
     throw new Error(
       `${distribution.filename} was published without a sha256 digest, so it cannot be verified`
     );
   }
   const actual = [...sha256(bytes2)].map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (actual !== distribution.sha256) {
-    throw new Error(
-      `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}`
-    );
-  }
+  if (actual === distribution.sha256) return null;
+  return `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}.`;
 }
 function stageWheel(entries, resolved) {
   const staged = [];
@@ -28026,12 +28047,19 @@ async function installRelease(ctx, index, release, seen, options) {
   const base2 = registryBase(ctx).replace(/\/$/, "");
   const url = `${base2}/${release.filename}`;
   ctx.line(`Fetching ${release.name} ${release.version}`);
-  const archive = await download(url);
-  const digest2 = await digestHex("sha256", archive);
+  let archive = await download2(url);
+  let digest2 = await digestHex("sha256", archive);
   if (digest2 !== release.sha256) {
-    throw new AppRegistryError(
-      `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}`
-    );
+    const retried = await download2(`${url}${url.includes("?") ? "&" : "?"}sha256=${release.sha256}`).catch(() => null);
+    const retriedDigest = retried && await digestHex("sha256", retried);
+    if (retried && retriedDigest === release.sha256) {
+      archive = retried;
+      digest2 = retriedDigest;
+    } else {
+      throw new AppRegistryError(
+        `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}. ` + (retried ? "A retry past any cache returned the same bytes, so the registry and the file it names disagree." : "A retry past any cache could not be made; a cached copy of an older build would look like this, so clearing the cache is worth trying before the registry is blamed.")
+      );
+    }
   }
   const verified = await verify(ctx, archive, release, options);
   const root = `${APPS_ROOT}/${release.name}`;
@@ -28058,7 +28086,7 @@ async function installRelease(ctx, index, release, seen, options) {
   }
   if (manifest.docs) ctx.line(`  docs: ${root}/${manifest.docs}`);
 }
-async function download(url) {
+async function download2(url) {
   const response = await fetch(url);
   if (!response.ok) {
     throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",