34 lines
1.9 KiB
JavaScript
34 lines
1.9 KiB
JavaScript
import { readFile, readdir, stat } from "node:fs/promises";
|
|
import { createHash } from "node:crypto";
|
|
import { dirname, join, resolve } from "node:path";
|
|
|
|
const root = resolve(new URL("..", import.meta.url).pathname.replace(/^\/(.:)/, "$1"));
|
|
const manifest = JSON.parse(await readFile(join(root, "PUBLIC_SOURCE_MANIFEST.json"), "utf8"));
|
|
if (manifest.schemaVersion !== 1 || !/^[0-9a-f]{40}$/.test(manifest.sourceRevision) || !Array.isArray(manifest.files))
|
|
throw new Error("The public source manifest is malformed.");
|
|
|
|
const expected = new Map(manifest.files.map(entry => [entry.path, entry]));
|
|
if (expected.size !== manifest.files.length || !expected.has("LICENSE"))
|
|
throw new Error("The public source manifest has duplicate entries or no LICENSE.");
|
|
async function walk(directory, prefix = "") {
|
|
const found = [];
|
|
for (const entry of await readdir(directory, { withFileTypes: true })) {
|
|
if (!prefix && entry.name === ".git") continue;
|
|
const path = prefix ? `${prefix}/${entry.name}` : entry.name;
|
|
if (entry.isDirectory()) found.push(...await walk(join(directory, entry.name), path));
|
|
else if (entry.isFile() && path !== "PUBLIC_SOURCE_MANIFEST.json") found.push(path);
|
|
else if (!entry.isFile()) throw new Error(`Irregular public entry: ${path}`);
|
|
}
|
|
return found;
|
|
}
|
|
const actual = (await walk(root)).sort();
|
|
if (actual.length !== expected.size || actual.some(path => !expected.has(path)))
|
|
throw new Error("Files outside the reviewed public manifest are present.");
|
|
for (const path of actual) {
|
|
const data = await readFile(join(root, path));
|
|
const entry = expected.get(path);
|
|
if ((await stat(join(root, path))).size !== entry.bytes || createHash("sha256").update(data).digest("hex") !== entry.sha256)
|
|
throw new Error(`Public source integrity check failed: ${path}`);
|
|
}
|
|
console.log(`Validated ${actual.length} public files from canonical revision ${manifest.sourceRevision}`);
|