WIP

Author: nrigaudiere

packages/browser/src/download.ts

@@ -16,7 +16,17 @@
 import { constants, chmodSync, createWriteStream, existsSync, mkdirSync } from 'node:fs'
 import https from 'node:https'
 import { arch, exit, platform } from 'node:process'
-import { DEFAULT_CACHE_FOLDER, DEFAULT_EXECUTABLE_PATH, USER_EXECUTABLE_PATH } from './utils'
+import {
+  DEFAULT_CACHE_FOLDER,
+  DEFAULT_EXECUTABLE_PATH,
+  USER_EXECUTABLE_PATH,
+  checksumFile,
+} from './utils'
+
+type GH_ASSET = {
+  name: string
+  digest: string
+}
 
 const PLATFORMS = {
   darwin: {
@@ -66,6 +76,25 @@ export const download = async (): Promise<void> => {
     return new Promise((resolve, reject) => get(url, resolve, reject))
   }
 
+  const getGithubHash = async (path: string) => {
+    try {
+      const f = await fetch(path)
+      const data = await f.json()
+
+      const asset: GH_ASSET = data.assets.find(
+        (a: GH_ASSET) => a.name === `lightpanda-${platformPath}`,
+      )
+
+      if (asset) {
+        return asset.digest
+      }
+
+      return ''
+    } catch (e) {
+      throw new Error(e)
+    }
+  }
+
   if (platformPath) {
     if (USER_EXECUTABLE_PATH) {
       console.info('$LIGHTPANDA_EXECUTABLE_PATH found, skipping binary download…')
@@ -78,6 +107,15 @@ export const download = async (): Promise<void> => {
       await downloadBinary(
         `https://github.com/lightpanda-io/browser/releases/download/nightly/lightpanda-${platformPath}`,
       )
+      const ghChecksum = await getGithubHash(
+        'https://api.github.com/repos/lightpanda-io/browser/releases/tags/nightly',
+      )
+      const lpChecksum = await checksumFile(DEFAULT_EXECUTABLE_PATH)
+
+      if (ghChecksum !== lpChecksum) {
+        throw new Error("Checksums don't match!")
+      }
+
       chmodSync(DEFAULT_EXECUTABLE_PATH, constants.S_IRWXU)
 
       console.info('✅ Done!')

packages/browser/src/utils.ts

@@ -13,6 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+import crypto from 'node:crypto'
+import fs from 'node:fs'
 import os from 'node:os'
 
 export const DEFAULT_CACHE_FOLDER = `${os.homedir()}/.cache/lightpanda-node`
@@ -61,3 +64,29 @@ export const validatePort = (port: number): void => {
 export const getExecutablePath = () => {
   return USER_EXECUTABLE_PATH ?? DEFAULT_EXECUTABLE_PATH
 }
+
+/**
+ * Get checksum from file
+ */
+export const checksumFile = (filePath: string) => {
+  return new Promise((resolve, reject) => {
+    fs.stat(filePath, (err, stat) => {
+      if (!err && !stat.isFile()) {
+        throw new Error('Not a file')
+      }
+
+      if (err) {
+        reject(err)
+      }
+
+      const hash = crypto.createHash('sha256')
+      const fileStream = fs.createReadStream(filePath)
+
+      hash.setEncoding('hex')
+      fileStream.pipe(hash, { end: false }).on('end', () => {
+        hash.end()
+        resolve(hash.read())
+      })
+    })
+  })
+}