mirrors/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-11-14 03:56:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactor(core): clarify PTY binary validation (#45715)

Browse Source
This commit is contained in:
Kit Langton
2026-08-27 22:30:35 -04:00
committed by GitHub
Unverified
parent d34dd6c14a
commit e6d656dec1
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/persistent-pty/binary.bun.ts
+5 -6
View File
@@ -19,7 +19,7 @@ async function install(
const directory = path.join(root, `${input.version}-${input.sha256.slice(0, 16)}`)
await privateDirectory(directory)
const destination = path.join(directory, "opencode-pty")
if (await exists(destination, input.sha256)) return destination
if (await validateIfPresent(destination, input.sha256)) return destination
const bytes = new Uint8Array(await Bun.file(input.path).arrayBuffer())
if (sha256(bytes) !== input.sha256) throw new Error("Embedded opencode-pty checksum mismatch")
@@ -34,7 +34,7 @@ async function install(
}
await chmod(temporary, 0o755)
await rename(temporary, destination).catch(async (error) => {
if (!(await exists(destination, input.sha256))) throw error
if (!(await validateIfPresent(destination, input.sha256))) throw error
})
} finally {
await rm(temporary, { force: true })
@@ -52,7 +52,7 @@ async function privateDirectory(directory: string) {
await chmod(directory, 0o700)
}
async function exists(file: string, expected: string) {
async function validateIfPresent(file: string, expected: string) {
try {
await validate(file, expected)
return true
@@ -62,14 +62,13 @@ async function exists(file: string, expected: string) {
}
}
async function validate(file: string, expected?: string) {
async function validate(file: string, expected: string) {
const info = await lstat(file)
if (!info.isFile() || info.isSymbolicLink()) throw new Error(`Unsafe opencode-pty executable: ${file}`)
const uid = typeof process.getuid === "function" ? process.getuid() : undefined
if (uid !== undefined && info.uid !== uid)
throw new Error(`opencode-pty executable is owned by another user: ${file}`)
if (expected && sha256(await readFile(file)) !== expected)
throw new Error(`Cached opencode-pty checksum mismatch: ${file}`)
if (sha256(await readFile(file)) !== expected) throw new Error(`Cached opencode-pty checksum mismatch: ${file}`)
await chmod(file, 0o755)
return file
}