super-release 1.1.3 → 1.2.0

package/npm/bin/super-release-darwin-aarch64.tar.gz.sha256

@@ -0,0 +1 @@
+71794d83631b0d1836e6890a5d0a3360085bb3e2aad37080774026d936e30d1a  super-release-darwin-aarch64.tar.gz

package/npm/bin/super-release-darwin-x86_64.tar.gz.sha256

@@ -0,0 +1 @@
+e853cd54e6a245b80fd8446afee4aaa81871af6ef6c415af108fee48a15979cb  super-release-darwin-x86_64.tar.gz

package/npm/bin/super-release-linux-aarch64.tar.gz.sha256

@@ -0,0 +1 @@
+455d0bb89c981360e22092d65dc2cf21011c55a827807495fd88f63ab0cb585f  super-release-linux-aarch64.tar.gz

package/npm/bin/super-release-linux-x86_64-musl.tar.gz.sha256

@@ -0,0 +1 @@
+80c6c77119ee232a7b8138a358b86bb6317cd0ef358473d8f2e0c868f9d29511  super-release-linux-x86_64-musl.tar.gz

package/npm/bin/super-release-linux-x86_64.tar.gz.sha256

@@ -0,0 +1 @@
+b9a26668bbe4efbff75e9169afd9fd0f4f6c380d5d440a3d7f066a7bba776eb5  super-release-linux-x86_64.tar.gz

package/npm/bin/super-release-windows-x86_64.zip.sha256

@@ -0,0 +1 @@
+F2250B18DE1F400175D88C5E65A27B7CFE2CE287FF153122C8564BBA5BD0FECC

package/npm/bin/super-release.js

@@ -5,6 +5,7 @@ import {
   existsSync,
   mkdirSync,
   createWriteStream,
+  readFileSync,
   unlinkSync,
   chmodSync,
 } from "node:fs";
@@ -92,6 +93,27 @@ async function install() {
     const response = await download(url);
     await pipeline(response, createWriteStream(tmpFile));
 
+    const hashFile = join(__dirname, `${artifact}.${ext}.sha256`);
+    if (existsSync(hashFile)) {
+      const expectedHash = readFileSync(hashFile, "utf8").trim().split(/\s+/)[0].toLowerCase();
+      const fileBuffer = readFileSync(tmpFile);
+      const hashBuffer = await crypto.subtle.digest("SHA-256", fileBuffer);
+      const actualHash = Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, "0")).join("");
+      if (actualHash !== expectedHash) {
+        console.error(`Hash mismatch for ${artifact}.${ext}!`);
+        console.error(`  Expected: ${expectedHash}`);
+        console.error(`  Actual:   ${actualHash}`);
+        console.error(`This may indicate a tampered or corrupted download.`);
+        unlinkSync(tmpFile);
+        process.exit(1);
+      }
+      console.error(`Hash verified for ${artifact}.${ext}`);
+    } else {
+      console.error(`No hash file found at ${hashFile}, cannot verify download integrity.`);
+      unlinkSync(tmpFile);
+      process.exit(1);
+    }
+
     if (isWindows) {
       execFileSync("powershell", ["-Command", `Expand-Archive -Path '${tmpFile}' -DestinationPath '${__dirname}' -Force`], { stdio: "ignore" });
     } else {

package/package.json

@@ -4,7 +4,7 @@
   },
   "description": "A fast semantic-release alternative for monorepos, written in Rust",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "files": [
     "npm/bin",
@@ -28,7 +28,7 @@
     "url": "git+https://github.com/BowlingX/super-release.git"
   },
   "type": "module",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "scripts": {
     "super-release": "node npm/bin/super-release.js"
   }