zidane/dist-feed

Throws a DistVerificationError unless data has the artifact's size and SHA-256.

function checkDistArtifact(
  data: Uint8Array,
  artifact: Pick<DistArtifact, 'name' | 'sha256' | 'size'>,
): void

src/dist/manifest.ts:290

Semver order of two versions (-1, 0, 1): a release is newer than its prereleases, numeric prerelease parts compare as numbers. Unparseable versions compare equal (never "newer").

function compareVersions(a: string, b: string): -1 | 0 | 1

src/dist/manifest.ts:311

The feed's base URL: ZIDANE_DIST_URL when set, else DIST_BASE_URL; no trailing slash.

function distBaseUrl(env?: Record<string, string | undefined>): string

src/dist/manifest.ts:100

The manifest URL: the newest release's, or version's (while the feed still keeps it).

function distManifestUrl(baseUrl: string, version?: string): string

src/dist/manifest.ts:119

The public key clients trust: ZIDANE_DIST_PUBLIC_KEY when set, else DIST_PUBLIC_KEY.

function distPublicKey(env?: Record<string, string | undefined>): string

src/dist/manifest.ts:109

The feed's names for this host's OS and CPU, or null when the feed has no build for it.

function distTarget(
  platform?: string,
  arch?: string,
): { arch: DistArch; os: DistOs } | null

src/dist/manifest.ts:130

Downloads and verifies a manifest: the newest release's, or version's. A pinned version must be the one the manifest names.

function fetchDistManifest(
  options?: { baseUrl?: string; fetch?: (url: string, init?: RequestInit) => Promise<Response>; publicKey?: string; timeoutMs?: number; version?: string },
): Promise<DistManifest>

src/dist/manifest.ts:228

The artifact of kind for os / arch (default: this host), or undefined.

function findDistArtifact(
  manifest: DistManifest,
  kind: DistArtifactKind,
  target?: { arch: DistArch; os: DistOs } | null,
): DistArtifact | undefined

src/dist/manifest.ts:271

Parses and validates a manifest's JSON (no signature check: see verifyDistManifest).

function parseDistManifest(text: string): DistManifest

src/dist/manifest.ts:165

Parses a public key file (minisign.pub) or its bare base64 line.

function parseMinisignPublicKey(text: string): MinisignPublicKey

src/dist/minisign.ts:88

Lower-case hex SHA-256 of data.

function sha256Hex(data: Uint8Array): string

src/dist/manifest.ts:280

Checks json against its minisign signature file, then parses it. Throws a DistVerificationError when either fails.

function verifyDistManifest(
  json: string | Uint8Array<ArrayBufferLike>,
  signature: string,
  publicKey?: string,
): DistManifest

src/dist/manifest.ts:211

Checks a minisign signature file against message and publicKey (a minisign.pub file, its base64 line, or a parsed key): the key id, the signature of the prehashed message, then the trusted comment's signature. Returns the trusted comment; throws on any mismatch.

function verifyMinisign(
  message: Uint8Array,
  signatureFile: string,
  publicKey: string | MinisignPublicKey,
): { trustedComment: string }

src/dist/minisign.ts:118

A manifest or artifact that does not check out: a bad or missing signature, a malformed manifest, another release than asked for, a wrong checksum or size. Not a network failure: something served is not what was signed.

class DistVerificationError extends Error

Constructor

new DistVerificationError(message: string, options?: ErrorOptions)

src/dist/manifest.ts:141

Where the feed lives. ZIDANE_DIST_URL overrides it (a mirror, a test server).

const DIST_BASE_URL = 'https://zidane.si/dl'

src/dist/manifest.ts:22

What DistManifest.image looks like: a repository pinned by digest.

const DIST_IMAGE_PATTERN: RegExp

src/dist/manifest.ts:93

The newest release's manifest, at the feed's root.

const DIST_LATEST_FILE = 'latest.json'

src/dist/manifest.ts:32

The minisign public key that signs the feed (src/dist/minisign.pub). Check by hand: minisign -Vm latest.json -P <this>. ZIDANE_DIST_PUBLIC_KEY overrides it (a test feed).

const DIST_PUBLIC_KEY = 'RWTeH2EIT+uzHQnG7U5bcHFzskL0m++wKuc3U5zEom2+tRn/8UukIDGk'

src/dist/manifest.ts:29

A release's manifest, inside its v<version>/ folder.

const DIST_RELEASE_FILE = 'manifest.json'

src/dist/manifest.ts:34

One downloadable file of a release.

interface DistArtifact

src/dist/manifest.ts:49

A file of a release that runs nowhere (its notes).

interface DistFile

src/dist/manifest.ts:67

The signed manifest of one release.

interface DistManifest

src/dist/manifest.ts:79

A minisign public key.

interface MinisignPublicKey

src/dist/minisign.ts:37

A CPU architecture the feed ships for.

type DistArch = 'arm64' | 'x64'

src/dist/manifest.ts:41

What an artifact is: the TUI binary archive, the server binary archive, or one of the desktop app's packages. Clients skip kinds they do not know.

type DistArtifactKind =
  | 'tui'
  | 'server'
  | 'desktop-dmg'
  | 'desktop-zip'
  | 'desktop-appimage'
  | 'desktop-deb'

src/dist/manifest.ts:46

An operating system the feed ships for.

type DistOs = 'darwin' | 'linux'

src/dist/manifest.ts:39