fix(npm): verify release archive checksums#43
Merged
BunsDev merged 1 commit intoJun 6, 2026
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the npm distribution of @opencoven/coven-code by embedding SHA-256 digests for platform-native release archives and verifying downloaded artifacts during postinstall, reducing the risk of executing tampered GitHub release assets.
Changes:
- Add
npm/checksums.jsonto the published package and verify archive SHA-256 before extraction innpm/install.js. - Update the npm publish workflow to generate
npm/checksums.jsonfrom release assets prior tonpm publish. - Fix the Node wrapper to select the correct Windows binary name (
.exe) and update the reinstall hint.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
npm/package.json |
Ensures checksums.json is included in the published npm package. |
npm/install.js |
Enforces HTTPS downloads, handles redirects, and verifies SHA-256 before extraction. |
npm/checksums.json |
Adds the checksum manifest file (populated during publish). |
npm/bin/coven-code |
Fixes platform binary path resolution and corrects reinstall guidance. |
.github/workflows/npm-publish.yml |
Generates npm/checksums.json from GitHub Release assets before publishing to npm. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+132
to
+134
| console.log('coven-code: verifying checksum...'); | ||
| verifyChecksum(tmpPath, archiveName); | ||
|
|
Comment on lines
+52
to
+56
| https.get(url, (res) => { | ||
| if ([301, 302, 303, 307, 308].includes(res.statusCode)) { | ||
| file.close(); | ||
| try { fs.unlinkSync(dest); } catch (_) {} | ||
| download(res.headers.location, dest).then(resolve).catch(reject); | ||
| if (!res.headers.location) { |
Comment on lines
+126
to
+137
| - name: Generate npm checksum manifest | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -euo pipefail | ||
| TAG="${{ steps.version.outputs.tag }}" | ||
| mkdir -p release-assets | ||
| gh release download "$TAG" \ | ||
| --repo "${{ github.repository }}" \ | ||
| --pattern 'coven-code-*.tar.gz' \ | ||
| --pattern 'coven-code-*.zip' \ | ||
| --dir release-assets |
Comment on lines
+96
to
+102
| function expectedSha256(archiveName) { | ||
| const entry = checksums[archiveName]; | ||
| if (!entry || typeof entry.sha256 !== 'string') { | ||
| throw new Error(`Missing SHA-256 checksum for ${archiveName} in checksums.json`); | ||
| } | ||
| return entry.sha256; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
postinstallwithout any independent integrity check, allowing a forged or replaced GitHub release asset to execute on users' machines.Description
npm/checksums.jsonbefore runningnpm publish(file:.github/workflows/npm-publish.yml).npm/checksums.jsonin the published package vianpm/package.jsonso the installer can consult expected digests.npm/install.jsto refuse non-HTTPS downloads, handle redirects safely, compute SHA-256 of the downloaded archive, and abort on missing or mismatched checksums before extraction.npm/bin/coven-codeto pick the correct platform-specific binary name (append.exeon Windows) and corrected the reinstall hint.Testing
node --check npm/install.jsandnode --check npm/bin/coven-code(syntax checks passed).npm pack --dry-run --jsoninsidenpmverifiedchecksums.jsonis included in the packaged files.Codex Task