tessl 0.90.0 → 0.91.0

package/bin/tessl.js

@@ -3,19 +3,67 @@
 // installer/src/main.ts
 import { existsSync as existsSync3, rmSync } from "node:fs";
 import { createInterface } from "node:readline";
+import { Readable as Readable2 } from "node:stream";
 
-// installer/src/channels.ts
-async function fetchLatestVersion(channel) {
-  const url = getChannelUrl(channel);
+// installer/src/download.ts
+async function downloadTarball(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download binary: ${response.status} ${response.statusText}`);
+  }
+  if (!response.body) {
+    throw new Error("Response body is null");
+  }
+  return response.body;
+}
+async function downloadBytes(url, maxBytes = 512 * 1024 * 1024) {
   const response = await fetch(url);
   if (!response.ok) {
-    throw new Error(`Failed to fetch version from ${url}: ${response.status} ${response.statusText}`);
+    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
   }
-  const version = (await response.text()).trim();
+  const advertised = Number(response.headers.get("content-length"));
+  if (Number.isFinite(advertised) && advertised > maxBytes) {
+    throw new Error(`Response from ${url} exceeds size limit (${advertised} > ${maxBytes} bytes)`);
+  }
+  if (!response.body) {
+    throw new Error(`Response from ${url} has no body`);
+  }
+  const chunks = [];
+  let total = 0;
+  const reader = response.body.getReader();
+  for (;; ) {
+    const chunk = await reader.read();
+    if (chunk.done)
+      break;
+    total += chunk.value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new Error(`Response from ${url} exceeds size limit (> ${maxBytes} bytes)`);
+    }
+    chunks.push(chunk.value);
+  }
+  return Buffer.concat(chunks);
+}
+
+// installer/src/channels.ts
+var MAX_CHANNEL_RESPONSE_BYTES = 8 * 1024;
+var VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.+-]{0,127}$/;
+function assertPathSafeVersion(version, source) {
+  if (!VERSION_PATTERN.test(version)) {
+    const shown = version.length > 40 ? `${JSON.stringify(version.slice(0, 40))}… (${version.length} chars)` : JSON.stringify(version);
+    const where = source ? ` from ${source}` : "";
+    throw new Error(`Refusing to install: release channel returned a malformed version${where}: ${shown}.`);
+  }
+  return version;
+}
+async function fetchLatestVersion(channel) {
+  const url = getChannelUrl(channel);
+  const bytes = await downloadBytes(url, MAX_CHANNEL_RESPONSE_BYTES);
+  const version = bytes.toString("utf8").trim();
   if (!version) {
     throw new Error(`Empty version returned from ${url}`);
   }
-  return version;
+  return assertPathSafeVersion(version, url);
 }
 function getChannelFromVersion(version) {
   if (version.includes("head"))
@@ -26,26 +74,24 @@ function getChannelFromVersion(version) {
     return "beta";
   return "latest";
 }
+function getBaseUrl() {
+  return process.env.TESSL_INSTALL_BASE_URL || "https://install.tessl.io";
+}
 function getChannelUrl(channel) {
-  const baseUrl = process.env.TESSL_INSTALL_BASE_URL || "https://install.tessl.io";
-  return `${baseUrl}/.well-known/tessl/${channel}.txt`;
+  return `${getBaseUrl()}/.well-known/tessl/${channel}.txt`;
+}
+function getManifestUrl(version) {
+  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS`;
+}
+function getManifestSigUrl(version) {
+  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS.sig`;
+}
+function getBinaryFileName(version, platform) {
+  return `tessl-${version}-${platform}.tar.gz`;
 }
 function getBinaryUrl(version, platform) {
-  const baseUrl = process.env.TESSL_INSTALL_BASE_URL || "https://install.tessl.io";
   const encodedVersion = encodeURIComponent(version);
-  return `${baseUrl}/binaries/${encodedVersion}/tessl-${encodedVersion}-${platform}.tar.gz`;
-}
-
-// installer/src/download.ts
-async function downloadTarball(url) {
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`Failed to download binary: ${response.status} ${response.statusText}`);
-  }
-  if (!response.body) {
-    throw new Error("Response body is null");
-  }
-  return response.body;
+  return `${getBaseUrl()}/binaries/${encodedVersion}/${getBinaryFileName(encodedVersion, platform)}`;
 }
 
 // installer/src/extract.ts
@@ -75,6 +121,19 @@ async function extractTarball(stream, destination) {
   await tarExit;
 }
 
+// installer/src/keys.ts
+var RELEASE_SIGNING_PUBLIC_KEYS = [
+  {
+    id: "kms-2026-06",
+    publicKeyPem: `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE81DxbddrC8wywZa2W0R+dq5q7xsB
+TaNvYdQeUrdR5LGZIaYN4XziIK27qwZEl4xJIEB+sqgsx2limHUjf/OKwA==
+-----END PUBLIC KEY-----
+`
+  }
+];
+var RELEASE_VERIFICATION_ENABLED = false;
+
 // installer/src/path.ts
 import { existsSync } from "node:fs";
 import {
@@ -299,10 +358,65 @@ function validateBinary(binaryPath) {
   }
 }
 
+// installer/src/verify.ts
+import { createHash, verify } from "node:crypto";
+function parseManifest(manifest) {
+  const map = new Map;
+  for (const line of manifest.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    const match = trimmed.match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
+    if (!match?.[1] || !match[2])
+      continue;
+    map.set(match[2], match[1].toLowerCase());
+  }
+  return map;
+}
+function expectedHashFor(manifest, filename) {
+  const hash = parseManifest(manifest).get(filename);
+  if (!hash) {
+    throw new Error(`No checksum for ${filename} in SHA256SUMS manifest`);
+  }
+  return hash;
+}
+function verifyManifestSignature(manifest, signature, publicKeyPem) {
+  try {
+    return verify("sha256", manifest, publicKeyPem, signature);
+  } catch {
+    return false;
+  }
+}
+function verifyManifestSignatureWithKeys(manifest, signature, trustedKeys) {
+  return trustedKeys.some((key) => verifyManifestSignature(manifest, signature, key.publicKeyPem));
+}
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+
 // installer/src/main.ts
 function isInteractive() {
   return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
+async function downloadVerifyAndExtract(version, platform, tarballUrl, versionsDir) {
+  const fileName = getBinaryFileName(version, platform);
+  const [tarballBytes, manifestBytes, manifestSig] = await Promise.all([
+    downloadBytes(tarballUrl),
+    downloadBytes(getManifestUrl(version), 2 * 1024 * 1024),
+    downloadBytes(getManifestSigUrl(version), 64 * 1024)
+  ]);
+  if (!verifyManifestSignatureWithKeys(manifestBytes, manifestSig, RELEASE_SIGNING_PUBLIC_KEYS)) {
+    throw new Error("SHA256SUMS signature verification failed — refusing to install. " + "The download may be corrupt or tampered with.");
+  }
+  const expected = expectedHashFor(manifestBytes.toString("utf8"), fileName);
+  const actual = sha256Hex(tarballBytes);
+  if (actual !== expected) {
+    throw new Error(`Checksum mismatch for ${fileName} (expected ${expected}, got ${actual}) — refusing to install.`);
+  }
+  const verifiedStream = Readable2.toWeb(Readable2.from(tarballBytes));
+  await extractTarball(verifiedStream, versionsDir);
+}
 async function promptConfirmation(message) {
   return new Promise((resolve2) => {
     const rl = createInterface({
@@ -327,7 +441,7 @@ function printUnsupportedPlatformMessage() {
 async function prepareBinary() {
   const tesslBinPath = getTesslBinPath();
   const existingBinary = await getExistingBinaryPath(tesslBinPath);
-  const installerVersion = "0.90.0";
+  const installerVersion = "0.91.0";
   const isTestOrDevBuild = installerVersion.includes("test") || installerVersion.includes("dev");
   let versionMismatch = false;
   if (isTestOrDevBuild && existingBinary) {
@@ -356,11 +470,15 @@ async function prepareBinary() {
   }
   console.log(`Downloading ${version} for ${platform}`);
   const url = getBinaryUrl(version, platform);
+  const versionsDir = getVersionsDirectory();
   const progressInterval = setInterval(() => process.stdout.write("."), 500).unref();
   try {
-    const tarballStream = await downloadTarball(url);
-    const versionsDir = getVersionsDirectory();
-    await extractTarball(tarballStream, versionsDir);
+    if (RELEASE_VERIFICATION_ENABLED) {
+      await downloadVerifyAndExtract(version, platform, url, versionsDir);
+    } else {
+      const tarballStream = await downloadTarball(url);
+      await extractTarball(tarballStream, versionsDir);
+    }
   } finally {
     clearInterval(progressInterval);
     console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tessl",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "description": "Tessl CLI",
   "author": "Tessl",
   "license": "SEE LICENSE.md",