oUpdate 0.2.3

Security release. Upgrade from 0.2.2 or earlier. It fixes the issues in advisory GHSA-mhr6-9xx9-84fp, where an update could be approved or land without its code being reviewed.

Review

• Symlinks and hardlinks in an artifact are read. A link to a startup hook, or one that points outside the package, stops the release, and a link's target is shown to the reviewer.
• Files are no longer skipped because their name looks like prose. A changed file of any extension reaches the reviewer. Files that package.json loads or runs (main, exports, bin, install scripts) are never treated as inert, and an unchanged file that newly becomes an entry is shown whole.
• A NUL byte no longer hides a code file. A changed binary holds for a person, unless its bytes really are the image or font its name says.
• Diffs compare lines exactly, so a whitespace-only change is shown. A large reorder is shown in full.
• A release with nothing to review holds; oUpdate never records an approval on 0 parts.
• PyPI: every wheel and the sdist of both releases are reviewed, each checked against the sha256 PyPI lists.
• npm globals: the reviewed version is the one installed and verified. A package with an install hook holds for a person, since the file the hook runs is not read.
• The reviewer client treats a truncated answer as a failure. It never sends the API key over plain http to another host, and never follows a redirect.
• Archives are checked for size and file count before unpacking.

Gate (oupdate gate)

• What the gate cannot see fails the PR: a deleted lockfile, any changed file the gate did not read, and manifest changes beyond dependency versions. A manifest's dependency change has to match its lockfile.
• A git, URL or file dependency fails, as does a lockfile whose download URL is not the registry's own tarball or PyPI file for that version. A same-version source or hash swap also fails.
• npm, pnpm and bun lockfile integrities are checked for every hash algorithm they record.
• Breaking:
  • only PRs from a bot author on a same-repo branch are gated: pass --gate-login on GitHub Actions and --bot-login for a self-hosted bot.
  • a private-registry version now fails by default (--private-registry hold|list|review).
  • a prior status is trusted only with the gate's own comment for that commit.

Other

• Gatekeeper checks parse codesign and spctl output by whole lines and need a real Team ID.
• A keg restart needs an exact launchd label, and the process must belong to that keg.
• ${NAME} in the host and targets config is now read from the environment, as documented (#9). An unset variable stops the run with its name.