{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAUA,4BAmBC;AAED,kDAGC;AAmBD,sCA0BC;AAED,wBA2BC;AA5GD,kCAAiC;AACjC,+CAAuD;AACvD,wDAAoD;AAEpD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,sDAAsD;QACtD,kBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oGAAoG,CAAC,CAAA;IACzH,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAiC,eAAe,CAAC,CAAA;IAC5H,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC;QAC5C,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,EAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC;QACtF,SAAS,EAAE,yBAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,0IAA0I,KAAK,GAAG,CAAC,CAAA;IAClL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,6EAA6E,CAAC,CAAA;IACzJ,CAAC;IACD,IAAI,GAAW,CAAA;IACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,KAAK,MAAM,CAAA;IAChF,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,EAAE,SAAS,CAAC,CAAA;IACrG,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,mBAAmB,GAAG;YAC1B,iDAAiD;YACjD,iDAAiD;YACjD,yDAAyD;YACzD,sCAAsC;SAC9B,CAAA;QACV,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;QACvH,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QAC5H,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as fs from \"fs/promises\"\nimport { log, parseValidEnvVarUrl } from \"builder-util\"\nimport { dynamicImport } from \"./util/dynamicImport\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise {\n const filenameWithExt = path.basename(new URL(url).pathname)\n if (checksum == null) {\n // Without a checksum, a download intercepted via a rogue mirror, tampered CDN\n // edge, or DNS spoofing can substitute a malicious payload undetected.\n // Callers should supply a checksum whenever possible.\n log.warn({ url }, \"downloading without an integrity checksum — the download is not verified against a known-good hash\")\n }\n const { downloadArtifact, ElectronDownloadCacheMode } = await dynamicImport(\"@electron/get\")\n const downloadedFile = await downloadArtifact({\n version: \"9.9.9\",\n artifactName: filenameWithExt,\n cacheRoot: path.resolve(getCacheDirectory({ allowEnvVarOverride: true }), \"downloads\"),\n cacheMode: ElectronDownloadCacheMode.ReadWrite,\n ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n isGeneric: true,\n })\n await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise {\n const dirName = `${name}-${version}`\n return getBin(dirName, binariesLocUrl, checksum)\n}\n\n/**\n * Validates a binary-download custom-directory value read from an environment\n * variable. These values are interpolated directly into a download URL; a\n * malicious value (e.g. set via a postinstall hook in node_modules) could\n * redirect tool downloads to an attacker-controlled server.\n *\n * Allowed: relative path components such as \"v1.0.0-custom\" or \"my-mirror/nsis\".\n * Rejected: anything containing \"://\", \"..\" (traversal), or a leading \"/\" (which\n * could make the resulting URL protocol-relative or change the host).\n */\nfunction validateBinaryCustomDir(envVarName: string, value: string): string {\n if (value.includes(\"://\") || value.includes(\"..\") || value.startsWith(\"/\")) {\n throw new Error(`${envVarName} must be a safe relative path component (e.g. \"v1.0.0-custom\"). Values containing \"://\", \"..\", or a leading \"/\" are not allowed. Got: \"${value}\"`)\n }\n return value\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise {\n if (/[/\\\\]|^\\.\\./.test(filenameWithExt) || filenameWithExt.includes(\"..\")) {\n throw new Error(`getBinFromUrl: unsafe filenameWithExt \"${filenameWithExt}\" — must be a plain filename with no path separators or traversal sequences`)\n }\n let url: string\n const allowHttp = process.env[\"ELECTRON_BUILDER_BINARIES_ALLOW_HTTP\"] === \"true\"\n const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\", allowHttp)\n if (overrideUrl != null) {\n url = overrideUrl + \"/\" + filenameWithExt\n } else {\n const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n // Any of these env vars can redirect downloads to a custom release directory.\n // Validate each one before interpolating into the URL.\n const CUSTOM_DIR_ENV_VARS = [\n \"NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n \"npm_config_electron_builder_binaries_custom_dir\",\n \"npm_package_config_electron_builder_binaries_custom_dir\",\n \"ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n ] as const\n const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null)\n const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value!) : releaseName\n url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n }\n\n const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise {\n const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n let promise = versionToPromise.get(cacheName)\n if (promise != null) {\n return promise\n }\n\n if (url == null) {\n throw new Error(\n `getBin(\"${cacheKey}\"): a download URL is required. ` +\n `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n `it now downloads from winCodeSign-2.6.0 automatically.`\n )\n }\n\n const filenameWithExt = path.basename(url)\n const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n const releaseName = path.basename(overrideUrl)\n\n promise = downloadBuilderToolset({\n releaseName,\n filenameWithExt,\n checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n overrideUrl,\n })\n versionToPromise.set(cacheName, promise)\n return promise\n}\n"]}