super-release 1.1.3 → 1.1.4

package/npm/bin/super-release-darwin-aarch64.tar.gz.sha256

@@ -0,0 +1 @@
+f8f0f3bea7140dcf3d83b48e40880086137f73afe32237c5acca4e93b4fe7978  super-release-darwin-aarch64.tar.gz

package/npm/bin/super-release-darwin-x86_64.tar.gz.sha256

@@ -0,0 +1 @@
+97b0db18b7089bbd72467c5932864165fa1d84af68c105296f1226ec08ddd604  super-release-darwin-x86_64.tar.gz

package/npm/bin/super-release-linux-aarch64.tar.gz.sha256

@@ -0,0 +1 @@
+f04c6e51c2bcd4b21592fe531740586580fab32e81d4d25ccb31b91b13459d9c  super-release-linux-aarch64.tar.gz

package/npm/bin/super-release-linux-x86_64-musl.tar.gz.sha256

@@ -0,0 +1 @@
+1f8581d2d08ceb6b1bc8b3b63fae163fa561ff24e92fc7fa5ae15da9a89cc2d3  super-release-linux-x86_64-musl.tar.gz

package/npm/bin/super-release-linux-x86_64.tar.gz.sha256

@@ -0,0 +1 @@
+9a47bc384459f01d6fb83df3ab38851f2f7662e446d2e3d1ed114e4fb4129029  super-release-linux-x86_64.tar.gz

package/npm/bin/super-release-windows-x86_64.zip.sha256

@@ -0,0 +1 @@
+04FCBE4653F84BD15706437F3CAB64C2E5C8E622A347A43DCB64BA31C7165BF5

package/npm/bin/super-release.js

@@ -5,6 +5,7 @@ import {
   existsSync,
   mkdirSync,
   createWriteStream,
+  readFileSync,
   unlinkSync,
   chmodSync,
 } from "node:fs";
@@ -92,6 +93,27 @@ async function install() {
     const response = await download(url);
     await pipeline(response, createWriteStream(tmpFile));
 
+    const hashFile = join(__dirname, `${artifact}.${ext}.sha256`);
+    if (existsSync(hashFile)) {
+      const expectedHash = readFileSync(hashFile, "utf8").trim().split(/\s+/)[0].toLowerCase();
+      const fileBuffer = readFileSync(tmpFile);
+      const hashBuffer = await crypto.subtle.digest("SHA-256", fileBuffer);
+      const actualHash = Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, "0")).join("");
+      if (actualHash !== expectedHash) {
+        console.error(`Hash mismatch for ${artifact}.${ext}!`);
+        console.error(`  Expected: ${expectedHash}`);
+        console.error(`  Actual:   ${actualHash}`);
+        console.error(`This may indicate a tampered or corrupted download.`);
+        unlinkSync(tmpFile);
+        process.exit(1);
+      }
+      console.error(`Hash verified for ${artifact}.${ext}`);
+    } else {
+      console.error(`No hash file found at ${hashFile}, cannot verify download integrity.`);
+      unlinkSync(tmpFile);
+      process.exit(1);
+    }
+
     if (isWindows) {
       execFileSync("powershell", ["-Command", `Expand-Archive -Path '${tmpFile}' -DestinationPath '${__dirname}' -Force`], { stdio: "ignore" });
     } else {

package/package.json

@@ -4,7 +4,7 @@
   },
   "description": "A fast semantic-release alternative for monorepos, written in Rust",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "files": [
     "npm/bin",
@@ -28,7 +28,7 @@
     "url": "git+https://github.com/BowlingX/super-release.git"
   },
   "type": "module",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "scripts": {
     "super-release": "node npm/bin/super-release.js"
   }