Repository navigation
Npm installer fixes - #344
Merged
Merged
Conversation
Specify the acceptance criteria and task sequence for fixing launcher permissions, validating signed manifest identity, replacing unrestricted tar extraction with bounded extraction, and atomically installing the native binary. Include packed-package smoke coverage, release wiring, and distribution documentation. Plan: harden-npm-installer Tasks: T01, T02, T03, T04, T05 Co-authored-by: SCE <sce@crocoder.dev>
Commit the launcher with executable mode so npm pack preserves a runnable package/bin/sce.js, and add a loopback HTTPS fixture test that packs, installs, and exercises the launcher against a signed stub release. Record the completed installer hardening evidence in the plan and npm distribution contract. Plan: harden-npm-installer Task: T01 Co-authored-by: SCE <sce@crocoder.dev>
Ensure npm installation accepts only manifests bound to the requested package version and sce binary, with exactly one target artifact using its canonical archive name and lowercase SHA-256 digest. This removes fallback archive/checksum trust and rejects malformed identity metadata before temporary-directory creation or archive download. Add regression coverage for invalid identity fields, duplicate targets, and canonical archive URL selection. Plan: harden-npm-installer (T02) Co-authored-by: SCE <sce@crocoder.dev>
Replace host tar extraction with a bounded ustar/GNU archive reader that validates paths, entry types, sizes, and checksums before staging only bin/sce. Install staged binaries through durable temp-file writes and atomic rename so failed checksum, extraction, or interrupted installs preserve existing runtime state. Add fixture and installer tests covering malicious archives, GNU tar compatibility, size limits, and failure cleanup, and include the new archive sources in npm checks. Plan: harden-npm-installer.md (T02, T03) Co-authored-by: SCE <sce@crocoder.dev>
Validate the npm launcher after `npm pack` so release assets cannot be emitted with a non-executable `bin/sce.js` or a broken offline install. Add the packed-tarball smoke as a flake check, include its fixture inputs in the copied source, and run it from `release-npm-package` before writing metadata. Plan: context/plans/harden-npm-installer.md (T04) Co-authored-by: SCE <sce@crocoder.dev>
Document the musl platform targets and the installer's manifest identity checks, bounded archive extraction, checksum verification, and atomic executable install. Record completion and validation evidence for the harden-npm-installer plan, including the completed T05 documentation task and all acceptance criteria. Plan: harden-npm-installer (T05) Co-authored-by: SCE <sce@crocoder.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.