feat: pin and verify source sha256 across all 16 package families

bugra9 · bugra9 · commit 4974993fac03 · 2026-07-05T23:47:21.000+03:00
Roll out the source-integrity pin (added for tiff) to every package that builds from a
downloaded tarball: 15 more families now carry a sha256 next to getURL, verified byte-for-byte
at build time by downloadAndExtractFile.verifyIntegrity. So a hijacked mirror or a re-tagged
upstream can no longer feed arbitrary C++ into any package's compile.

- scripts/pin-source-hash.js: downloads a package's pinned-version tarball and writes its sha256
  into build.mjs. Run it after bumping nativeVersion (a bump without re-pinning fails the build
  on hash mismatch).
- scripts/check-source-hashes.js + 'pnpm run check:sources': gate that every source-building
  package pins a sha256, so a new package or version bump can't slip through unpinned. Wired
  into 'pnpm run check'.
diff --git a/cppjs-packages/cppjs-package-curl/cppjs-package-curl/build.mjs b/cppjs-packages/cppjs-package-curl/cppjs-package-curl/build.mjs
@@ -8,6 +8,7 @@ const platformBuild = {
 };
 
 export default {
+    sha256: 'fc5819cad3f9f5482669adcdc49a782c15f36d2a0715b395b06d9173593d2dc0', // curl-8.20.0.tar.gz
     getURL: (version) => `https://curl.se/download/curl-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: (target, depPaths) => [
diff --git a/cppjs-packages/cppjs-package-expat/cppjs-package-expat/build.mjs b/cppjs-packages/cppjs-package-expat/cppjs-package-expat/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'a52eb72108be160e190b5cafa5bba8663f1313f2013e26060d1c18e26e31067b', // expat-2.8.1.tar.gz
     getURL: (version) => `https://github.com/libexpat/libexpat/releases/download/R_${version.replaceAll('.', '_')}/expat-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: () => [
diff --git a/cppjs-packages/cppjs-package-gdal/cppjs-package-gdal/build.mjs b/cppjs-packages/cppjs-package-gdal/cppjs-package-gdal/build.mjs
@@ -6,6 +6,7 @@ const platformCmake = {
 const ifDep = (dep, params) => (dep ? params(dep) : []);
 
 export default {
+    sha256: 'e04e9813bd215b56753d5554330c53be25f3df2d7ed7e6413a19e6b66751c675', // gdal-3.13.1.tar.gz
     getURL: (version) => `https://github.com/OSGeo/gdal/releases/download/v${version}/gdal-${version}.tar.gz`,
     copyToSource: { 'assets/gdal_empty_file.cpp': 'gcore/gdal_empty_file.cpp' },
     replaceList: [
diff --git a/cppjs-packages/cppjs-package-geos/cppjs-package-geos/build.mjs b/cppjs-packages/cppjs-package-geos/cppjs-package-geos/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: '3c20919cda9a505db07b5216baa980bacdaa0702da715b43f176fb07eff7e716', // geos-3.14.1.tar.bz2
     getURL: (version) => `https://download.osgeo.org/geos/geos-${version}.tar.bz2`,
     buildType: 'cmake',
     getBuildParams: (target) => [
diff --git a/cppjs-packages/cppjs-package-geotiff/cppjs-package-geotiff/build.mjs b/cppjs-packages/cppjs-package-geotiff/cppjs-package-geotiff/build.mjs
@@ -15,6 +15,7 @@ const platformExtraLibs = {
 const ifDep = (dep, params) => (dep ? params(dep) : []);
 
 export default {
+    sha256: 'c598d04fdf2ba25c4352844dafa81dde3f7fd968daa7ad131228cd91e9d3dc47', // libgeotiff-1.7.4.tar.gz
     getURL: (version) => `https://download.osgeo.org/geotiff/libgeotiff/libgeotiff-${version}.tar.gz`,
     buildType: 'configure',
     getBuildParams: (target, depPaths) => [
diff --git a/cppjs-packages/cppjs-package-iconv/cppjs-package-iconv/build.mjs b/cppjs-packages/cppjs-package-iconv/cppjs-package-iconv/build.mjs
@@ -7,6 +7,7 @@ const platformBuild = {
 };
 
 export default {
+    sha256: '88dd96a8c0464eca144fc791ae60cd31cd8ee78321e67397e25fc095c4a19aa6', // libiconv-1.19.tar.gz
     getURL: (version) => `https://ftp.gnu.org/pub/gnu/libiconv/libiconv-${version}.tar.gz`,
     buildType: 'configure',
     getBuildParams: (target) => [
diff --git a/cppjs-packages/cppjs-package-jpegturbo/cppjs-package-jpegturbo/build.mjs b/cppjs-packages/cppjs-package-jpegturbo/cppjs-package-jpegturbo/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'ecae8008e2cc9ade2f2c1bb9d5e6d4fb73e7c433866a056bd82980741571a022', // libjpeg-turbo-3.1.4.1.tar.gz
     getURL: (version) => `https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/${version}/libjpeg-turbo-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: (target) => {
diff --git a/cppjs-packages/cppjs-package-lerc/cppjs-package-lerc/build.mjs b/cppjs-packages/cppjs-package-lerc/cppjs-package-lerc/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'f05b24d2368becab9144873878655bb718910631550d4f786262378c16ab94a7', // v4.1.0.tar.gz
     getURL: (version) => `https://github.com/Esri/lerc/archive/refs/tags/v${version}.tar.gz`,
     buildType: 'cmake',
 };
diff --git a/cppjs-packages/cppjs-package-openssl/cppjs-package-openssl/build.mjs b/cppjs-packages/cppjs-package-openssl/cppjs-package-openssl/build.mjs
@@ -1,6 +1,7 @@
 const CONFIGURE_FLAGS = ['--cross-compile-prefix=', 'cc', 'no-apps', 'no-docs', 'no-tests', 'no-shared', 'threads'];
 
 export default {
+    sha256: '2db3f3a0d6ea4b59e1f094ace2c8cd536dffb87cdc39084c5afa1e6f7f37dd09', // openssl-4.0.1.tar.gz
     getURL: (version) => `https://github.com/openssl/openssl/releases/download/openssl-${version}/openssl-${version}.tar.gz`,
     buildType: 'configure',
     getBuildParams: () => [...CONFIGURE_FLAGS],
diff --git a/cppjs-packages/cppjs-package-proj/cppjs-package-proj/build.mjs b/cppjs-packages/cppjs-package-proj/cppjs-package-proj/build.mjs
@@ -1,6 +1,7 @@
 const ifDep = (dep, params) => (dep ? params(dep) : []);
 
 export default {
+    sha256: 'af5b731c145c1d13c4e3b4eeb7d167e94e845e440f71e3496b4ed8dae0291960', // proj-9.8.1.tar.gz
     getURL: (version) => `https://download.osgeo.org/proj/proj-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: (target, depPaths) => [
diff --git a/cppjs-packages/cppjs-package-spatialite/cppjs-package-spatialite/build.mjs b/cppjs-packages/cppjs-package-spatialite/cppjs-package-spatialite/build.mjs
@@ -26,6 +26,7 @@ const platformSourceReplaceList = {
 const ifDep = (dep, params) => (dep ? params(dep) : []);
 
 export default {
+    sha256: '43be2dd349daffe016dd1400c5d11285828c22fea35ca5109f21f3ed50605080', // libspatialite-5.1.0.tar.gz
     getURL: (version) => `https://www.gaia-gis.it/gaia-sins/libspatialite-sources/libspatialite-${version}.tar.gz`,
     copyToSource: { 'config.sub': 'config.sub' },
     sourceReplaceList: (target) => [...(platformSourceReplaceList[target.platform] || [])],
diff --git a/cppjs-packages/cppjs-package-sqlite3/cppjs-package-sqlite3/build.mjs b/cppjs-packages/cppjs-package-sqlite3/cppjs-package-sqlite3/build.mjs
@@ -9,6 +9,7 @@ const platformBuild = {
 const SQLITE_DEFINES = '-DSQLITE_NOHAVE_SYSTEM -DSQLITE_DISABLE_LFS -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_NORMALIZE -DSQLITE_ENABLE_COLUMN_METADATA -DHAVE_GETHOSTUUID=0 -DSQLITE_ENABLE_RTREE=1';
 
 export default {
+    sha256: '588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316', // sqlite-autoconf-3530200.tar.gz
     // SQLite hosts each release under its release-year directory; bump RELEASE_YEAR together with
     // nativeVersion (the year cannot be derived from the version number).
     getURL: (version) => {
diff --git a/cppjs-packages/cppjs-package-webp/cppjs-package-webp/build.mjs b/cppjs-packages/cppjs-package-webp/cppjs-package-webp/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564', // libwebp-1.6.0.tar.gz
     getURL: (version) => `https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: (target) => [
diff --git a/cppjs-packages/cppjs-package-zlib/cppjs-package-zlib/build.mjs b/cppjs-packages/cppjs-package-zlib/cppjs-package-zlib/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16', // zlib-1.3.2.tar.gz
     getURL: (version) => `https://zlib.net/zlib-${version}.tar.gz`,
     buildType: 'cmake',
     getBuildParams: (target) => [
diff --git a/cppjs-packages/cppjs-package-zstd/cppjs-package-zstd/build.mjs b/cppjs-packages/cppjs-package-zstd/cppjs-package-zstd/build.mjs
@@ -1,4 +1,5 @@
 export default {
+    sha256: 'eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3', // zstd-1.5.7.tar.gz
     getURL: (version) => `https://github.com/facebook/zstd/releases/download/v${version}/zstd-${version}.tar.gz`,
     // zstd ships its CMake project under build/cmake/, not at the source root.
     // copyToSource places a thin wrapper CMakeLists.txt at the extracted
diff --git a/package.json b/package.json
@@ -50,7 +50,9 @@
         "check:native:strict": "node scripts/check-native-versions.js --check",
         "check:wiring": "node scripts/check-dependency-wiring.js",
         "check:wiring:strict": "node scripts/check-dependency-wiring.js --check",
-        "check": "pnpm run check:dist && pnpm run check:deps:strict && pnpm run check:native:strict && pnpm run check:wiring:strict",
+        "check:sources": "node scripts/check-source-hashes.js",
+        "check:sources:strict": "node scripts/check-source-hashes.js --check",
+        "check": "pnpm run check:dist && pnpm run check:deps:strict && pnpm run check:native:strict && pnpm run check:wiring:strict && pnpm run check:sources:strict",
         "help": "node scripts/help.js",
         "doctor": "bash scripts/doctor.sh",
         "scaffold:package": "node scripts/scaffold-package.js",
diff --git a/scripts/check-source-hashes.js b/scripts/check-source-hashes.js
@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Gate: every package build recipe that downloads its source (has a getURL) must also pin the
+// archive's sha256, so no package can ship fetching-and-compiling unverified C++ from an
+// upstream URL. The actual byte-for-byte verification runs at build time
+// (downloadAndExtractFile.verifyIntegrity); this is the presence gate that keeps a new package
+// or a version bump from slipping through unpinned.
+//
+//   node scripts/check-source-hashes.js            # report
+//   node scripts/check-source-hashes.js --check    # exit non-zero on any missing pin (CI gate)
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PKGROOT = path.join(ROOT, 'cppjs-packages');
+const STRICT = process.argv.includes('--check');
+
+const families = fs
+    .readdirSync(PKGROOT)
+    .filter((d) => d.startsWith('cppjs-package-'))
+    .map((d) => d.replace('cppjs-package-', ''))
+    .sort();
+
+const missing = [];
+let checked = 0;
+
+for (const family of families) {
+    const buildMjs = path.join(PKGROOT, `cppjs-package-${family}`, `cppjs-package-${family}`, 'build.mjs');
+    if (!fs.existsSync(buildMjs)) continue;
+    const recipe = (await import(pathToFileURL(buildMjs).href)).default;
+    if (typeof recipe?.getURL !== 'function') continue; // prebuilt-only, nothing downloaded
+    checked += 1;
+    if (!recipe.sha256 || !/^[0-9a-f]{64}$/i.test(String(recipe.sha256))) {
+        missing.push(family);
+    }
+}
+
+if (missing.length === 0) {
+    console.log(`cppjs: source hashes OK — every source-building package pins a sha256 (${checked} packages).`);
+    process.exit(0);
+}
+
+console.error('cppjs: packages that download their source but do NOT pin a sha256:\n');
+missing.forEach((f) => console.error(`  - @cpp.js/package-${f}`));
+console.error(`\nRun: node scripts/pin-source-hash.js ${missing.join(' ')}`);
+process.exit(STRICT ? 1 : 0);
diff --git a/scripts/pin-source-hash.js b/scripts/pin-source-hash.js
@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Downloads each package's pinned-version source tarball and writes its sha256 into the build
+// recipe (build.mjs), next to getURL, so cpp.js can verify the download at build time (see
+// downloadAndExtractFile.verifyIntegrity). Run after bumping a package's nativeVersion.
+//
+//   node scripts/pin-source-hash.js             # every family with a getURL recipe
+//   node scripts/pin-source-hash.js tiff gdal   # specific families
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PKGROOT = path.join(ROOT, 'cppjs-packages');
+const args = process.argv.slice(2).filter((a) => !a.startsWith('-'));
+
+function families() {
+    if (args.length) return args;
+    return fs
+        .readdirSync(PKGROOT)
+        .filter((d) => d.startsWith('cppjs-package-'))
+        .map((d) => d.replace('cppjs-package-', ''))
+        .sort();
+}
+
+function sha256OfUrl(url) {
+    const tmp = path.join(os.tmpdir(), `cppjs-pin-${crypto.randomBytes(6).toString('hex')}`);
+    try {
+        execFileSync('curl', ['-fsSL', '--retry', '2', url, '-o', tmp], { stdio: ['ignore', 'ignore', 'pipe'] });
+        return crypto.createHash('sha256').update(fs.readFileSync(tmp)).digest('hex');
+    } finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+
+// Insert or replace the `sha256:` field in a build.mjs. Replaces in place when present; new
+// pins go right under `export default {`.
+function writeSha256(buildMjsPath, hash, basename) {
+    let text = fs.readFileSync(buildMjsPath, 'utf8');
+    if (/sha256:\s*'[0-9a-fA-F]*'/.test(text)) {
+        text = text.replace(/sha256:\s*'[0-9a-fA-F]*'/, `sha256: '${hash}'`);
+    } else {
+        text = text.replace(/(export default \{\n)/, `$1    sha256: '${hash}', // ${basename}\n`);
+    }
+    fs.writeFileSync(buildMjsPath, text);
+}
+
+let pinned = 0;
+let skipped = 0;
+let failed = 0;
+
+for (const family of families()) {
+    const brandDir = path.join(PKGROOT, `cppjs-package-${family}`, `cppjs-package-${family}`);
+    const buildMjs = path.join(brandDir, 'build.mjs');
+    const pkgJson = path.join(brandDir, 'package.json');
+    if (!fs.existsSync(buildMjs) || !fs.existsSync(pkgJson)) {
+        continue;
+    }
+
+    const recipe = (await import(pathToFileURL(buildMjs).href)).default;
+    if (typeof recipe?.getURL !== 'function') {
+        console.log(`- ${family}: no getURL (prebuilt), skipped`);
+        skipped += 1;
+        continue;
+    }
+    const version = JSON.parse(fs.readFileSync(pkgJson, 'utf8')).nativeVersion;
+    if (!version) {
+        console.log(`- ${family}: no nativeVersion, skipped`);
+        skipped += 1;
+        continue;
+    }
+
+    const url = recipe.getURL(version);
+    try {
+        const hash = sha256OfUrl(url);
+        const basename = path.basename(new URL(url).pathname) || `${family}-${version}`;
+        writeSha256(buildMjs, hash, basename);
+        console.log(`✓ ${family}@${version}  ${hash}`);
+        pinned += 1;
+    } catch (e) {
+        console.error(`✗ ${family}@${version}  FAILED: ${String(e.message).split('\n')[0]}\n     ${url}`);
+        failed += 1;
+    }
+}
+
+console.log(`\npinned ${pinned}, skipped ${skipped}, failed ${failed}`);
+process.exit(failed ? 1 : 0);

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`export default {`
	`2`	`+ sha256: 'a52eb72108be160e190b5cafa5bba8663f1313f2013e26060d1c18e26e31067b', // expat-2.8.1.tar.gz`
`2`	`3`	getURL: (version) => `https://github.com/libexpat/libexpat/releases/download/R_${version.replaceAll('.', '_')}/expat-${version}.tar.gz`,
`3`	`4`	`buildType: 'cmake',`
`4`	`5`	`getBuildParams: () => [`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`export default {`
	`2`	`+ sha256: '3c20919cda9a505db07b5216baa980bacdaa0702da715b43f176fb07eff7e716', // geos-3.14.1.tar.bz2`
`2`	`3`	getURL: (version) => `https://download.osgeo.org/geos/geos-${version}.tar.bz2`,
`3`	`4`	`buildType: 'cmake',`
`4`	`5`	`getBuildParams: (target) => [`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`export default {`
	`2`	`+ sha256: 'ecae8008e2cc9ade2f2c1bb9d5e6d4fb73e7c433866a056bd82980741571a022', // libjpeg-turbo-3.1.4.1.tar.gz`
`2`	`3`	getURL: (version) => `https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/${version}/libjpeg-turbo-${version}.tar.gz`,
`3`	`4`	`buildType: 'cmake',`
`4`	`5`	`getBuildParams: (target) => {`