Verify extension CDN packages

Author: mehmetozguldev

.github/workflows/deploy.yml

@@ -14,6 +14,9 @@ on:
       - "registry.json"
       - "index.json"
       - "manifests.json"
+      - "scripts/deploy-extensions-cdn.ts"
+      - "scripts/verify-installable-packages.ts"
+      - ".github/workflows/deploy.yml"
   workflow_dispatch:
 
 jobs:
@@ -77,3 +80,6 @@ jobs:
           remote_user: ${{ secrets.VPS_USER }}
           remote_key: ${{ secrets.VPS_SSH_KEY }}
           remote_port: ${{ secrets.VPS_PORT || 22 }}
+
+      - name: Verify installable packages on CDN
+        run: bun scripts/verify-installable-packages.ts

scripts/deploy-extensions-cdn.ts

@@ -1,12 +1,16 @@
 #!/usr/bin/env bun
 
 import { $ } from "bun";
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
 import { join, resolve } from "node:path";
 
 const root = resolve(import.meta.dirname, "..");
 const extensionsDir = join(root, "extensions");
 const packagesDir = join(root, "packages");
+const databaseDir = join(root, "database");
 const targetDir = process.env.EXTENSIONS_CDN_ROOT;
+const cdnBaseUrl = process.env.EXTENSIONS_CDN_BASE_URL || "https://athas.dev/extensions";
 
 if (!targetDir) {
   console.error("Missing EXTENSIONS_CDN_ROOT environment variable.");
@@ -25,9 +29,98 @@ await $`rsync -az --include='*/' --include='*.json' --include='*.scm' --include=
 // Sync packaged installable extensions
 await $`rsync -az ${packagesDir}/ ${targetDir}/packages/`;
 
+// Sync packaged database sidecars
+await $`test ! -d ${databaseDir} || rsync -az ${databaseDir}/ ${targetDir}/database/`;
+
 // Sync root-level registry files
 for (const file of ["registry.json", "index.json", "manifests.json"]) {
   await $`cp ${join(root, file)} ${targetDir}/${file}`;
 }
 
+type InstallablePackage = {
+  url: string;
+  size: number;
+  checksum: string;
+};
+
+function collectInstallablePackages(value: unknown, packages: InstallablePackage[] = []) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectInstallablePackages(item, packages);
+    }
+    return packages;
+  }
+
+  if (!value || typeof value !== "object") {
+    return packages;
+  }
+
+  const entry = value as Record<string, unknown>;
+  if (
+    typeof entry.downloadUrl === "string" &&
+    typeof entry.size === "number" &&
+    entry.size > 0 &&
+    typeof entry.checksum === "string" &&
+    entry.checksum.length > 0
+  ) {
+    packages.push({
+      url: entry.downloadUrl,
+      size: entry.size,
+      checksum: entry.checksum,
+    });
+  }
+
+  for (const item of Object.values(entry)) {
+    collectInstallablePackages(item, packages);
+  }
+
+  return packages;
+}
+
+async function sha256(path: string) {
+  const bytes = await readFile(path);
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+async function verifyInstallablePackages() {
+  const manifests = JSON.parse(await readFile(join(root, "manifests.json"), "utf8")) as unknown;
+  const cdnPrefix = `${cdnBaseUrl.replace(/\/$/, "")}/`;
+  const failures: string[] = [];
+  const installablePackages = new Map(
+    collectInstallablePackages(manifests).map((installablePackage) => [
+      installablePackage.url,
+      installablePackage,
+    ]),
+  );
+
+  for (const installablePackage of installablePackages.values()) {
+    if (!installablePackage.url.startsWith(cdnPrefix)) {
+      continue;
+    }
+
+    const relativePath = installablePackage.url.slice(cdnPrefix.length);
+    const deployedPath = join(targetDir!, relativePath);
+
+    try {
+      const fileStats = await stat(deployedPath);
+      const checksum = await sha256(deployedPath);
+      if (fileStats.size !== installablePackage.size || checksum !== installablePackage.checksum) {
+        failures.push(
+          `${relativePath}: expected ${installablePackage.size}/${installablePackage.checksum}, got ${fileStats.size}/${checksum}`,
+        );
+      }
+    } catch (error) {
+      failures.push(
+        `${relativePath}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  if (failures.length > 0) {
+    throw new Error(`Extension CDN verification failed:\n${failures.join("\n")}`);
+  }
+}
+
+await verifyInstallablePackages();
+
 console.log("Extensions CDN sync complete.");

scripts/verify-installable-packages.ts

@@ -0,0 +1,95 @@
+#!/usr/bin/env bun
+
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+
+type InstallablePackage = {
+  url: string;
+  size: number;
+  checksum: string;
+};
+
+const root = resolve(import.meta.dirname, "..");
+const cdnBaseUrl = process.env.EXTENSIONS_CDN_BASE_URL || "https://athas.dev/extensions";
+
+function collectInstallablePackages(value: unknown, packages: InstallablePackage[] = []) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectInstallablePackages(item, packages);
+    }
+    return packages;
+  }
+
+  if (!value || typeof value !== "object") {
+    return packages;
+  }
+
+  const entry = value as Record<string, unknown>;
+  if (
+    typeof entry.downloadUrl === "string" &&
+    typeof entry.size === "number" &&
+    entry.size > 0 &&
+    typeof entry.checksum === "string" &&
+    entry.checksum.length > 0
+  ) {
+    packages.push({
+      url: entry.downloadUrl,
+      size: entry.size,
+      checksum: entry.checksum,
+    });
+  }
+
+  for (const item of Object.values(entry)) {
+    collectInstallablePackages(item, packages);
+  }
+
+  return packages;
+}
+
+function sha256(bytes: Uint8Array) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+async function verifyRemotePackage(installablePackage: InstallablePackage) {
+  const url = new URL(installablePackage.url);
+  url.searchParams.set("verify", String(Date.now()));
+
+  const response = await fetch(url, { cache: "no-store" });
+  if (!response.ok) {
+    return `HTTP ${response.status} for ${installablePackage.url}`;
+  }
+
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  const checksum = sha256(bytes);
+
+  if (bytes.byteLength !== installablePackage.size || checksum !== installablePackage.checksum) {
+    return `${installablePackage.url}: expected ${installablePackage.size}/${installablePackage.checksum}, got ${bytes.byteLength}/${checksum}`;
+  }
+
+  return null;
+}
+
+const manifests = JSON.parse(await readFile(join(root, "manifests.json"), "utf8")) as unknown;
+const cdnPrefix = `${cdnBaseUrl.replace(/\/$/, "")}/`;
+const installablePackages = new Map(
+  collectInstallablePackages(manifests)
+    .filter((installablePackage) => installablePackage.url.startsWith(cdnPrefix))
+    .map((installablePackage) => [installablePackage.url, installablePackage]),
+);
+
+const failures: string[] = [];
+
+for (const installablePackage of installablePackages.values()) {
+  const failure = await verifyRemotePackage(installablePackage);
+  if (failure) {
+    failures.push(failure);
+  }
+}
+
+if (failures.length > 0) {
+  console.error(`Extension package verification failed:\n${failures.join("\n")}`);
+  process.exit(1);
+}
+
+console.log(`Verified ${installablePackages.size} installable extension package(s).`);