fix(security): harden extension and engine trust

scripts/engine-payload-integrity.js

@@ -0,0 +1,45 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+export function collectRegularFiles(root, options = {}) {
+  const ignoredNames = new Set(options.ignoredNames || []);
+  const files = [];
+
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (ignoredNames.has(entry.name)) {
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Unsupported symlink in engine payload: ${relative}`);
+      }
+      if (entry.isDirectory()) {
+        walk(file);
+      } else if (entry.isFile()) {
+        files.push(file);
+      } else {
+        throw new Error(`Unsupported filesystem entry in engine payload: ${relative}`);
+      }
+    }
+  };
+
+  walk(root);
+  return files.sort((left, right) => left.localeCompare(right));
+}
+
+export function treeDigest(root) {
+  const files = collectRegularFiles(root);
+  const digest = crypto.createHash('sha256');
+  for (const file of files) {
+    const relative = path.relative(root, file).split(path.sep).join('/');
+    digest.update(`${relative}\0${sha256(file)}\n`);
+  }
+  return { files: files.length, sha256: digest.digest('hex') };
+}

scripts/engine-payload-integrity.test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { collectRegularFiles, treeDigest } from './engine-payload-integrity.js';
+
+test('collectRegularFiles returns regular files and honors ignored names', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.mkdirSync(path.join(root, 'nested'));
+    fs.writeFileSync(path.join(root, 'engine'), 'binary');
+    fs.writeFileSync(path.join(root, 'nested', 'runtime.dat'), 'runtime');
+    fs.writeFileSync(path.join(root, 'payload-manifest.json'), '{}');
+
+    const files = collectRegularFiles(root, {
+      ignoredNames: ['payload-manifest.json'],
+    }).map(file => path.relative(root, file).split(path.sep).join('/'));
+
+    assert.deepEqual(files, ['engine', 'nested/runtime.dat']);
+    const digest = treeDigest(path.join(root, 'nested'));
+    assert.equal(digest.files, 1);
+    assert.match(digest.sha256, /^[a-f0-9]{64}$/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('collectRegularFiles rejects symlinks in engine payloads', { skip: process.platform === 'win32' }, () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.writeFileSync(path.join(root, 'target'), 'target');
+    fs.symlinkSync('target', path.join(root, 'link'));
+
+    assert.throws(
+      () => collectRegularFiles(root),
+      /Unsupported symlink in engine payload: link/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/provision-engines.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
@@ -36,10 +36,6 @@ const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `firelink-engines-${targ
 const isWindows = target.includes('windows');
 const executableSuffix = isWindows ? '.exe' : '';
 
-function sha256(file) {
-  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-}
-
 async function download(name, source) {
   const sourcePath = new URL(source.url).pathname;
   const archive = path.join(
@@ -99,16 +95,9 @@ function copyExecutable(source, engine) {
 }
 
 function writePayloadManifest() {
-  const files = [];
-  const walk = directory => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const file = path.join(directory, entry.name);
-      if (entry.isDirectory()) walk(file);
-      else if (entry.isFile() && entry.name !== 'payload-manifest.json') files.push(file);
-    }
-  };
-  walk(destination);
-  files.sort((left, right) => left.localeCompare(right));
+  const files = collectRegularFiles(destination, {
+    ignoredNames: ['payload-manifest.json'],
+  });
   const manifest = {
     schemaVersion: 1,
     target,

scripts/stage-engines.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import crypto from 'node:crypto';
+import { collectRegularFiles, sha256, treeDigest } from './engine-payload-integrity.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
@@ -51,29 +51,6 @@ if (!source) {
   process.exit(1);
 }
 
-function sha256(file) {
-  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-}
-
-function treeDigest(root) {
-  const files = [];
-  const walk = directory => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const file = path.join(directory, entry.name);
-      if (entry.isDirectory()) walk(file);
-      else if (entry.isFile()) files.push(file);
-    }
-  };
-  walk(root);
-  files.sort((left, right) => left.localeCompare(right));
-  const digest = crypto.createHash('sha256');
-  for (const file of files) {
-    const relative = path.relative(root, file).split(path.sep).join('/');
-    digest.update(`${relative}\0${sha256(file)}\n`);
-  }
-  return { files: files.length, sha256: digest.digest('hex') };
-}
-
 if (targetLock) {
   for (const engine of engines) {
     const name = `${engine}-${target}${suffix}`;
@@ -115,17 +92,9 @@ if (targetLock) {
       process.exit(1);
     }
   }
-  const actualFiles = [];
-  const walk = directory => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const file = path.join(directory, entry.name);
-      if (entry.isDirectory()) walk(file);
-      else if (entry.isFile() && entry.name !== 'payload-manifest.json') {
-        actualFiles.push(path.relative(source, file).split(path.sep).join('/'));
-      }
-    }
-  };
-  walk(source);
+  const actualFiles = collectRegularFiles(source, {
+    ignoredNames: ['payload-manifest.json'],
+  }).map(file => path.relative(source, file).split(path.sep).join('/'));
   const expectedFiles = Object.keys(manifest.files || {}).sort();
   actualFiles.sort();
   if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {

scripts/verify-binaries.js

@@ -90,6 +90,31 @@ function ok(msg) {
   console.log(`[OK] ${msg}`);
 }
 
+function rejectSymlinks(root, label) {
+  if (!fs.existsSync(root)) {
+    return;
+  }
+
+  let symlinkCount = 0;
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (entry.isSymbolicLink()) {
+        fail(`Unsupported symlink in ${label}: ${relative}`);
+        symlinkCount += 1;
+      } else if (entry.isDirectory()) {
+        walk(file);
+      }
+    }
+  };
+
+  walk(root);
+  if (symlinkCount === 0) {
+    ok(`${label} contains no symlinks`);
+  }
+}
+
 function binName(engine) {
   return `${engine}${suffix}`;
 }
@@ -208,23 +233,7 @@ console.log('\n─── 6. yt-dlp packaging ───');
       } catch (e) {
         fail(`Cannot read _internal/: ${e.message}`);
       }
-      if (entries) {
-        let broken = 0;
-        for (const entry of entries) {
-          const ep = path.join(internalDir, entry);
-          if (fs.lstatSync(ep).isSymbolicLink()) {
-            try {
-              fs.accessSync(ep);
-            } catch {
-              fail(`Broken symlink in _internal/: ${entry}`);
-              broken++;
-            }
-          }
-        }
-        if (broken === 0) {
-          ok('_internal/ symlinks valid');
-        }
-      }
+      rejectSymlinks(internalDir, '_internal/');
 
       const requiredRuntimeFiles = [
         path.join(internalDir, 'yt_dlp_ejs', 'yt', 'solver', 'core.min.js'),
@@ -253,6 +262,11 @@ console.log('\n─── 6. yt-dlp packaging ───');
   }
 }
 
+const aria2LibsDir = path.join(binariesDir, 'aria2-libs');
+if (fs.existsSync(aria2LibsDir) && fs.statSync(aria2LibsDir).isDirectory()) {
+  rejectSymlinks(aria2LibsDir, 'aria2-libs/');
+}
+
 // ───── Check 7, 8 & 9: Engine version self-tests ─────
 console.log('\n─── 7 & 8 & 9. Engine version self-tests ───');