feat: add checksum verification

Author: nrigaudiere

packages/browser/src/download.ts

@@ -16,7 +16,17 @@
 import { constants, chmodSync, createWriteStream, existsSync, mkdirSync } from 'node:fs'
 import https from 'node:https'
 import { arch, exit, platform } from 'node:process'
-import { DEFAULT_CACHE_FOLDER, DEFAULT_EXECUTABLE_PATH, USER_EXECUTABLE_PATH } from './utils'
+import {
+  DEFAULT_CACHE_FOLDER,
+  DEFAULT_EXECUTABLE_PATH,
+  USER_EXECUTABLE_PATH,
+  checksumFile,
+} from './utils'
+
+type GH_ASSET = {
+  name: string
+  digest: string
+}
 
 const PLATFORMS = {
   darwin: {
@@ -66,18 +76,47 @@ export const download = async (): Promise<void> => {
     return new Promise((resolve, reject) => get(url, resolve, reject))
   }
 
+  const getGithubHash = async (path: string) => {
+    try {
+      const f = await fetch(path)
+      const data = await f.json()
+
+      const asset: GH_ASSET = data.assets.find(
+        (a: GH_ASSET) => a.name === `lightpanda-${platformPath}`,
+      )
+
+      if (asset) {
+        return asset.digest
+      }
+
+      return ''
+    } catch (e) {
+      throw new Error(e)
+    }
+  }
+
   if (platformPath) {
     if (USER_EXECUTABLE_PATH) {
       console.info('$LIGHTPANDA_EXECUTABLE_PATH found, skipping binary download…')
       exit(0)
     }
 
     try {
-      console.info('⏳ Downloading latest version of Lightpanda browser…')
-
+      console.info('⏳ Downloading latest version of Lightpanda browser…', '\n')
       await downloadBinary(
         `https://github.com/lightpanda-io/browser/releases/download/nightly/lightpanda-${platformPath}`,
       )
+
+      console.info('🔐 Getting and comparing checksums…', '\n')
+      const ghChecksum = await getGithubHash(
+        'https://api.github.com/repos/lightpanda-io/browser/releases/tags/nightly',
+      )
+      const lpChecksum = await checksumFile(DEFAULT_EXECUTABLE_PATH)
+
+      if (ghChecksum !== lpChecksum) {
+        throw new Error("🚫 Checksums don't match!")
+      }
+
       chmodSync(DEFAULT_EXECUTABLE_PATH, constants.S_IRWXU)
 
       console.info('✅ Done!')

packages/browser/src/utils.ts

@@ -13,6 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+import crypto, { type BinaryToTextEncoding } from 'node:crypto'
+import fs from 'node:fs'
 import os from 'node:os'
 
 export const DEFAULT_CACHE_FOLDER = `${os.homedir()}/.cache/lightpanda-node`
@@ -61,3 +64,23 @@ export const validatePort = (port: number): void => {
 export const getExecutablePath = () => {
   return USER_EXECUTABLE_PATH ?? DEFAULT_EXECUTABLE_PATH
 }
+
+/**
+ * Get checksum from file
+ */
+export const checksumFile = (
+  filePath: string,
+  algorithm = 'sha256',
+  encoding: BinaryToTextEncoding = 'hex',
+) => {
+  return new Promise((resolve, reject) => {
+    fs.readFile(filePath, (err, data) => {
+      if (err) {
+        reject(err)
+      }
+
+      const hash = crypto.createHash(algorithm).update(data).digest(encoding)
+      resolve(`${algorithm}:${hash}`)
+    })
+  })
+}