aporter/jwzoomswitcher
Watch
1
0
Fork
You've already forked jwzoomswitcher
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Build: verify koffi Windows binaries against the lockfile; release install steps #5

Merged
aporter merged 2 commits from fix/koffi-integrity-release into main 2026-11-03 22:11:58 +10:00
Conversation 0 Commits 2 Files changed 3 +176 -103
aporter commented 2026-11-03 22:09:15 +10:00
Owner

Verify koffi's Windows binaries; release install steps

The build downloads koffi's Windows native prebuilds with npm pack (npm only installs the host platform's) and previously checked only the version. It now hashes each downloaded tarball and requires it to match the sha512 integrity locked for that package in package-lock.json, failing closed if the entry is missing, at another version, or has no sha512 hash. The shipped native code is therefore exactly the locked version.

INSTALL.md gains From a release: download the plugin and SHA256SUMS.txt from the Forgejo release and check the file with PowerShell Get-FileHash.

Tested: normal build (both hashes match), corrupted lock hash (build fails), multi-hash lock entry (passes on its sha512), sha1-only entry (fails). 115 unit tests, manifest validation.

Review-gate: gpt-6.1-sol ship (nits on multi-hash parsing and INSTALL wording applied)

🤖 Generated with Claude Code

## Verify koffi's Windows binaries; release install steps The build downloads koffi's Windows native prebuilds with `npm pack` (npm only installs the host platform's) and previously checked only the version. It now hashes each downloaded tarball and requires it to match the sha512 integrity locked for that package in `package-lock.json`, failing closed if the entry is missing, at another version, or has no sha512 hash. The shipped native code is therefore exactly the locked version. INSTALL.md gains **From a release**: download the plugin and `SHA256SUMS.txt` from the Forgejo release and check the file with PowerShell `Get-FileHash`. Tested: normal build (both hashes match), corrupted lock hash (build fails), multi-hash lock entry (passes on its sha512), sha1-only entry (fails). 115 unit tests, manifest validation. Review-gate: gpt-6.1-sol ship (nits on multi-hash parsing and INSTALL wording applied) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Build: verify koffi's Windows binaries against package-lock.json; release install steps
All checks were successful
ci / secrets (pull_request) Successful in 9s
Details
ci / build (pull_request) Successful in 23s
Details
13e800e3c5 
The build downloads koffi's Windows prebuilds with `npm pack` (npm only
installs the host platform's) and checked only the version. It now hashes
each downloaded tarball and requires it to match the sha512 integrity
recorded for that package in package-lock.json, failing closed when the
entry is missing, at another version, or has no sha512 hash. Multi-hash
SRI entries are accepted when a sha512 token matches.

INSTALL.md: "From a release" with a PowerShell SHA-256 check against
SHA256SUMS.txt, and a note that a checksum from the same page detects a
damaged download but not a tampered release page.

Tested: normal build (both hashes match), corrupted hash -> fails,
multi-hash entry -> passes, sha1-only entry -> fails. 115 unit tests.

Review-gate: gpt-6.1-sol ship (nits on multi-hash parsing and INSTALL wording applied)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
README: current state (0.2.0), download from releases, what it installs and touches
All checks were successful
ci / secrets (pull_request) Successful in 9s
Details
ci / build (pull_request) Successful in 22s
Details
51c34def32 
Rewritten for 0.2.0: download and checksum from the Forgejo release,
requirements, the key states, refusal reasons, settings panel, where the
plugin's files, logs, settings and support files live, what it may touch
(no network, only Zoom's second window and JW's media window), how
detection works including the second paths, test coverage and known
limits, and the current source map. Fixes the action name (Zoom
participant -> TV (toggle)).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
aporter/jwzoomswitcher!5
No description provided.