fix(cli): verify PTY binary integrity before execution#16
Open
Catafal wants to merge 1 commit into
Open
Conversation
The CLI was downloading a native PTY binary from GitHub Releases and executing it without any integrity check. Cached binaries were also trusted unconditionally on subsequent runs — a local filesystem replacement would be silently executed. - Pin SHA-256 hashes for all three platform targets in PTY_RELEASES - Verify the downloaded binary's hash in-memory before writing to disk; a mismatch aborts cleanly with no artifact on the filesystem - Verify cached binary hash in ensurePtyBinaryReady before returning the path; re-download automatically on mismatch (recover rather than hard-fail, since a stale cache from a previous CLI version is likely) - Add createHash to the crypto import (no new dependencies) Fixes lunel-dev#10 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #10 — PTY binaries downloaded and executed with no integrity verification.
The CLI fetches a native binary from GitHub Releases and spawns it directly. Without a checksum check, a compromised release asset, a MITM with a valid cert, or local filesystem tampering could cause arbitrary native code execution on the user's machine.
Changes
cli/src/index.tsPTY_RELEASES: addedsha256field with pinned hashes for all three platform targets (verified against the published v0 release assets)downloadPtyBinary: computes SHA-256 of the assembledBufferin-memory beforefs.writeFile. On mismatch: throws immediately — no bytes hit disk, no temp file left behindensurePtyBinaryReady: reads and hashes the cached binary afterfs.accessconfirms existence. On mismatch: deletes the stale file and re-downloads (auto-recover rather than hard-fail, since a CLI version bump may bring a new binary)createHash(Node built-in, no new dependencies)Pinned hashes (v0 release assets, verified 2026-04-10)
linux:x64lunel-pty-linux-x8664-0422c260e...darwin:arm64lunel-pty-macos-arm64-08d2fc8cf...win32:x64lunel-pty-windows-x8664-1.exec80c5220...Testing