uncomment-cli 3.6.0 → 3.8.0

package/README.md

@@ -11,7 +11,7 @@ A blazing fast Rust-based command-line tool that removes comments from your sour
 - 🎯 **100% Accurate** - Never accidentally removes code that looks like comments
 - 🛡️ **Safe by Default** - Preview changes before applying them
 - 🌍 **Multi-language** - 49 built-in languages, 306 available via [tree-sitter-language-pack](https://github.com/kreuzberg-dev/tree-sitter-language-pack)
-- 🔧 **Zero Dependencies** - Downloads a self-contained binary
+- 🔧 **Self-contained** - Installs a single static Rust binary, checksum-verified against the GitHub release
 
 ## Installation
 
@@ -19,7 +19,27 @@ A blazing fast Rust-based command-line tool that removes comments from your sour
 npm install -g uncomment-cli
 ```
 
-The installer will automatically download the appropriate pre-compiled Rust binary for your platform (Windows, macOS, or Linux).
+The postinstall step downloads the pre-compiled binary for your platform and verifies
+it against the release checksum manifest. Prebuilt archives exist for:
+
+| Platform | Architectures |
+| --- | --- |
+| Linux (glibc) | `x86_64`, `aarch64` |
+| macOS | `x86_64`, `aarch64` |
+| Windows | `x86_64` |
+
+Anything else — musl/Alpine Linux, 32-bit, other architectures — has no prebuilt
+archive; install with `cargo install uncomment` instead.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `uncomment <paths>` | Remove comments (the default, with no subcommand) |
+| `uncomment init` | Write a template `.uncomment.toml` |
+| `uncomment scan` | Report every comment and the verdict a run would reach; writes no files |
+| `uncomment keep` | Write `~keep` markers into the comments a decision selected |
+| `uncomment lint` | Check tag comments (TODO, FIXME, HACK, XXX) against the `[lint]` convention |
 
 ## Quick Start
 

package/install.js

@@ -1,159 +1,177 @@
+const crypto = require("node:crypto");
 const fs = require("node:fs");
+const https = require("node:https");
 const os = require("node:os");
 const path = require("node:path");
-const https = require("node:https");
-const http = require("node:http");
 const tar = require("tar");
 const AdmZip = require("adm-zip");
 
 const { version } = require("./package.json");
 
+const BASE_URL = `https://github.com/Goldziher/uncomment/releases/download/v${version}`;
+
+// Must stay in step with the archives .github/workflows/publish.yaml uploads.
+const TRIPLES = {
+  "Windows_NT:x64": "x86_64-pc-windows-gnu",
+  "Linux:x64": "x86_64-unknown-linux-gnu",
+  "Linux:arm64": "aarch64-unknown-linux-gnu",
+  "Darwin:x64": "x86_64-apple-darwin",
+  "Darwin:arm64": "aarch64-apple-darwin",
+};
+
+function assertGlibc() {
+  // The Linux archives are gnu-linked. On a musl host (Alpine) they resolve at
+  // download time and then fail at exec with a bare "not found", so say so here.
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  if (report && report.header && report.header.glibcVersionRuntime) {
+    return;
+  }
+  if (fs.existsSync("/etc/alpine-release")) {
+    throw new Error(
+      "musl-based Linux (Alpine) is not supported: only gnu-linked Linux archives are published. Build from source with `cargo install uncomment`.",
+    );
+  }
+}
+
 function getPlatformTriple() {
   const type = os.type();
   const arch = os.arch();
+  const triple = TRIPLES[`${type}:${arch}`];
 
-  if (type === "Windows_NT") {
-    if (arch === "x64") return "x86_64-pc-windows-gnu";
-    if (arch === "ia32") throw new Error("32-bit Windows is not supported");
+  if (!triple) {
+    throw new Error(
+      `No prebuilt uncomment binary for ${type} ${arch}. Supported: ${Object.keys(TRIPLES).join(", ")}. Build from source with \`cargo install uncomment\`.`,
+    );
   }
 
   if (type === "Linux") {
-    if (arch === "x64") return "x86_64-unknown-linux-gnu";
-    if (arch === "arm64") return "aarch64-unknown-linux-gnu";
-    return "x86_64-unknown-linux-gnu";
-  }
-
-  if (type === "Darwin") {
-    if (arch === "x64") return "x86_64-apple-darwin";
-    if (arch === "arm64") return "aarch64-apple-darwin";
-    return "x86_64-apple-darwin";
+    assertGlibc();
   }
 
-  throw new Error(`Unsupported platform: ${type} ${arch}`);
-}
-
-function getBinaryUrl() {
-  const platform = getPlatformTriple();
-  const baseUrl = `https://github.com/Goldziher/uncomment/releases/download/v${version}`;
-  const ext = platform.includes("windows") ? "zip" : "tar.gz";
-  return `${baseUrl}/uncomment-${platform}.${ext}`;
+  return triple;
 }
 
-function downloadWithRedirects(url, dest, maxRedirects = 5) {
+function httpsGet(url, maxRedirects = 5) {
   return new Promise((resolve, reject) => {
     if (maxRedirects <= 0) {
       return reject(new Error("Too many redirects"));
     }
 
-    const urlObj = new URL(url);
-    const client = urlObj.protocol === "https:" ? https : http;
-
-    const req = client.get(
-      url,
-      {
-        headers: {
-          "User-Agent": "uncomment-npm-wrapper",
-        },
-      },
-      (res) => {
-        if (
-          res.statusCode >= 300 &&
-          res.statusCode < 400 &&
-          res.headers.location
-        ) {
-          return downloadWithRedirects(
-            res.headers.location,
-            dest,
-            maxRedirects - 1,
-          )
-            .then(resolve)
-            .catch(reject);
-        }
-
-        if (res.statusCode !== 200) {
-          return reject(
-            new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`),
-          );
-        }
-
-        const file = fs.createWriteStream(dest);
-        res.pipe(file);
-
-        file.on("finish", () => {
-          file.close();
-          resolve();
-        });
-
-        file.on("error", (err) => {
-          fs.unlink(dest, () => {});
-          reject(err);
-        });
-      },
-    );
+    // HTTPS only. Following a redirect down to plain HTTP would let a network
+    // attacker substitute the archive that gets unpacked below.
+    if (new URL(url).protocol !== "https:") {
+      return reject(new Error(`Refusing non-HTTPS download URL: ${url}`));
+    }
+
+    const req = https.get(url, { headers: { "User-Agent": "uncomment-npm-wrapper" } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return httpsGet(new URL(res.headers.location, url).toString(), maxRedirects - 1)
+          .then(resolve)
+          .catch(reject);
+      }
+
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`HTTP ${res.statusCode} ${res.statusMessage} for ${url}`));
+      }
+
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => resolve(Buffer.concat(chunks)));
+      res.on("error", reject);
+    });
 
     req.on("error", reject);
-    req.setTimeout(30000, () => {
-      req.destroy();
-      reject(new Error("Download timeout"));
+    req.setTimeout(60000, () => {
+      req.destroy(new Error(`Download timed out: ${url}`));
     });
   });
 }
 
+function expectedDigest(checksums, archiveName) {
+  for (const line of checksums.toString("utf8").split("\n")) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(\S+)$/);
+    if (match && path.basename(match[2]) === archiveName) {
+      return match[1];
+    }
+  }
+  return null;
+}
+
 async function installBinary() {
-  try {
-    const url = getBinaryUrl();
-    const isZip = url.endsWith(".zip");
-    const binDir = path.join(__dirname, "bin");
-    const archivePath = path.join(
-      binDir,
-      isZip ? "uncomment.zip" : "uncomment.tar.gz",
-    );
-    const binaryName =
-      os.type() === "Windows_NT" ? "uncomment.exe" : "uncomment";
-    const binaryPath = path.join(binDir, binaryName);
+  const triple = getPlatformTriple();
+  const isWindows = os.type() === "Windows_NT";
+  const archiveName = `uncomment-${triple}.${isWindows ? "zip" : "tar.gz"}`;
 
-    if (!fs.existsSync(binDir)) {
-      fs.mkdirSync(binDir, { recursive: true });
-    }
+  const binDir = path.join(__dirname, "bin");
+  // bin/uncomment is the committed launcher stub; the native executable lives
+  // beside it under a distinct name so extraction never overwrites the stub.
+  const binaryName = isWindows ? "uncomment.exe" : "uncomment-bin";
+  const binaryPath = path.join(binDir, binaryName);
+  const memberName = isWindows ? "uncomment.exe" : "uncomment";
 
-    if (fs.existsSync(binaryPath)) {
-      return;
-    }
+  fs.mkdirSync(binDir, { recursive: true });
+
+  if (fs.existsSync(binaryPath)) {
+    return;
+  }
+
+  const stagingDir = fs.mkdtempSync(path.join(os.tmpdir(), "uncomment-install-"));
 
-    console.log(`Downloading uncomment binary from ${url}...`);
+  try {
+    console.log(`Downloading ${archiveName}...`);
+    const archive = await httpsGet(`${BASE_URL}/${archiveName}`);
+
+    // Verify against the release's own checksum manifest before unpacking. The
+    // archive readers below (node-tar, adm-zip) have a history of path-traversal
+    // issues, so nothing hostile should reach them in the first place.
+    const checksums = await httpsGet(`${BASE_URL}/uncomment_${version}_checksums.txt`);
+    const expected = expectedDigest(checksums, archiveName);
+    if (!expected) {
+      throw new Error(`No checksum published for ${archiveName}; refusing to install.`);
+    }
 
-    await downloadWithRedirects(url, archivePath);
+    const actual = crypto.createHash("sha256").update(archive).digest("hex");
+    if (actual !== expected) {
+      throw new Error(`Checksum mismatch for ${archiveName}: expected ${expected}, got ${actual}`);
+    }
 
-    console.log("Extracting binary...");
+    const archivePath = path.join(stagingDir, archiveName);
+    fs.writeFileSync(archivePath, archive);
 
-    if (isZip) {
+    console.log("Extracting...");
+    if (isWindows) {
       const zip = new AdmZip(archivePath);
-      const entry = zip
-        .getEntries()
-        .find((e) => e.entryName.endsWith(binaryName));
+      const entry = zip.getEntries().find((e) => path.basename(e.entryName) === memberName);
       if (!entry) {
-        throw new Error("Binary not found in downloaded archive");
+        throw new Error(`${memberName} not found in ${archiveName}`);
       }
-      zip.extractEntryTo(entry, binDir, false, true);
+      zip.extractEntryTo(entry, stagingDir, false, true);
     } else {
       await tar.extract({
         file: archivePath,
-        cwd: binDir,
-        filter: (entryPath) => entryPath.endsWith(binaryName),
+        cwd: stagingDir,
+        filter: (entryPath) => path.basename(entryPath) === memberName,
       });
     }
 
-    fs.unlinkSync(archivePath);
-
-    if (os.type() !== "Windows_NT") {
-      fs.chmodSync(binaryPath, 0o755);
+    const extracted = path.join(stagingDir, memberName);
+    if (!fs.existsSync(extracted)) {
+      throw new Error(`${archiveName} did not contain ${memberName}`);
     }
 
-    console.log("uncomment binary installed successfully!");
-  } catch (error) {
-    console.error("Error installing uncomment binary:", error.message);
-    process.exit(1);
+    // copy + unlink rather than rename: the staging dir is in os.tmpdir(), which is
+    // often a different filesystem from node_modules, and rename would fail EXDEV.
+    fs.copyFileSync(extracted, binaryPath);
+    fs.chmodSync(binaryPath, 0o755);
+    console.log(`uncomment ${version} installed (${triple}).`);
+  } finally {
+    fs.rmSync(stagingDir, { recursive: true, force: true });
   }
 }
 
-installBinary();
+installBinary().catch((error) => {
+  console.error(`Failed to install the uncomment binary: ${error.message}`);
+  process.exit(1);
+});

package/package.json

@@ -1,8 +1,7 @@
 {
   "name": "uncomment-cli",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "description": "A fast Rust-based CLI tool for removing comments from source code",
-  "main": "index.js",
   "bin": {
     "uncomment": "bin/uncomment"
   },
@@ -31,15 +30,14 @@
     "url": "https://github.com/Goldziher/uncomment/issues"
   },
   "dependencies": {
-    "adm-zip": "^0.6.0",
-    "tar": "^6.0.0"
+    "adm-zip": "^0.6.1",
+    "tar": "^7.5.22"
   },
   "files": [
-    "index.js",
     "install.js",
-    "bin/"
+    "bin/uncomment"
   ],
   "engines": {
-    "node": ">=14"
+    "node": ">=22"
   }
 }

package/index.js

@@ -1,37 +0,0 @@
-const { Binary } = require("binary-install");
-const os = require("os");
-const { version } = require("./package.json");
-
-function getPlatform() {
-  const type = os.type();
-  const arch = os.arch();
-
-  if (type === "Windows_NT") {
-    return arch === "x64" ? "x86_64-pc-windows-msvc" : "i686-pc-windows-msvc";
-  }
-
-  if (type === "Linux") {
-    if (arch === "x64") return "x86_64-unknown-linux-gnu";
-    if (arch === "arm64") return "aarch64-unknown-linux-gnu";
-    return "x86_64-unknown-linux-gnu";
-  }
-
-  if (type === "Darwin") {
-    if (arch === "x64") return "x86_64-apple-darwin";
-    if (arch === "arm64") return "aarch64-apple-darwin";
-    return "x86_64-apple-darwin";
-  }
-
-  throw new Error(`Unsupported platform: ${type} ${arch}`);
-}
-
-function getBinaryUrl() {
-  const platform = getPlatform();
-  const ext = os.type() === "Windows_NT" ? ".exe" : "";
-  const baseUrl = `https://github.com/Goldziher/uncomment/releases/download/v${version}`;
-  return `${baseUrl}/uncomment-${platform}${ext}`;
-}
-
-const binary = new Binary("uncomment", getBinaryUrl());
-
-module.exports = binary;