Skip to content

Commit 83fcd11

Browse files
jdaltonjdalton
authored
fix(hooks): normalize platform keys and strip host prefix from repository (#1194)
- Normalize hook checksums to platform-keyed `{ asset, sha256 }` format - Use `win-` platform prefix in hook config for Windows keys - Strip any `<host>:` prefix from repository values (not just `github:`) using `/^[^:]+:/` for generic host prefix handling - Fix missing prefix stripping in update.mts and build scripts
1 parent 6364fa1 commit 83fcd11

File tree

5 files changed

+88
-60
lines changed

5 files changed

+88
-60
lines changed

‎.claude/hooks/setup-security-tools/external-tools.json‎

Lines changed: 66 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,59 +4,86 @@
44
"zizmor": {
55
"description": "GitHub Actions security scanner",
66
"version": "1.23.1",
7-
"repository": "zizmorcore/zizmor",
8-
"assets": {
9-
"darwin-arm64": "zizmor-aarch64-apple-darwin.tar.gz",
10-
"darwin-x64": "zizmor-x86_64-apple-darwin.tar.gz",
11-
"linux-arm64": "zizmor-aarch64-unknown-linux-gnu.tar.gz",
12-
"linux-x64": "zizmor-x86_64-unknown-linux-gnu.tar.gz",
13-
"win32-x64": "zizmor-x86_64-pc-windows-msvc.zip"
14-
},
7+
"repository": "github:zizmorcore/zizmor",
8+
"release": "asset",
159
"checksums": {
16-
"zizmor-aarch64-apple-darwin.tar.gz": "2632561b974c69f952258c1ab4b7432d5c7f92e555704155c3ac28a2910bd717",
17-
"zizmor-aarch64-unknown-linux-gnu.tar.gz": "3725d7cd7102e4d70827186389f7d5930b6878232930d0a3eb058d7e5b47e658",
18-
"zizmor-x86_64-apple-darwin.tar.gz": "89d5ed42081dd9d0433a10b7545fac42b35f1f030885c278b9712b32c66f2597",
19-
"zizmor-x86_64-pc-windows-msvc.zip": "33c2293ff02834720dd7cd8b47348aafb2e95a19bdc993c0ecaca9c804ade92a",
20-
"zizmor-x86_64-unknown-linux-gnu.tar.gz": "67a8df0a14352dd81882e14876653d097b99b0f4f6b6fe798edc0320cff27aff"
10+
"darwin-arm64": {
11+
"asset": "zizmor-aarch64-apple-darwin.tar.gz",
12+
"sha256": "2632561b974c69f952258c1ab4b7432d5c7f92e555704155c3ac28a2910bd717"
13+
},
14+
"darwin-x64": {
15+
"asset": "zizmor-x86_64-apple-darwin.tar.gz",
16+
"sha256": "89d5ed42081dd9d0433a10b7545fac42b35f1f030885c278b9712b32c66f2597"
17+
},
18+
"linux-arm64": {
19+
"asset": "zizmor-aarch64-unknown-linux-gnu.tar.gz",
20+
"sha256": "3725d7cd7102e4d70827186389f7d5930b6878232930d0a3eb058d7e5b47e658"
21+
},
22+
"linux-x64": {
23+
"asset": "zizmor-x86_64-unknown-linux-gnu.tar.gz",
24+
"sha256": "67a8df0a14352dd81882e14876653d097b99b0f4f6b6fe798edc0320cff27aff"
25+
},
26+
"win-x64": {
27+
"asset": "zizmor-x86_64-pc-windows-msvc.zip",
28+
"sha256": "33c2293ff02834720dd7cd8b47348aafb2e95a19bdc993c0ecaca9c804ade92a"
29+
}
2130
}
2231
},
2332
"sfw-free": {
2433
"description": "Socket Firewall (free tier)",
2534
"version": "v1.6.1",
26-
"repository": "SocketDev/sfw-free",
27-
"platforms": {
28-
"darwin-arm64": "macos-arm64",
29-
"darwin-x64": "macos-x86_64",
30-
"linux-arm64": "linux-arm64",
31-
"linux-x64": "linux-x86_64",
32-
"win32-x64": "windows-x86_64"
33-
},
35+
"repository": "github:SocketDev/sfw-free",
36+
"release": "asset",
3437
"checksums": {
35-
"linux-arm64": "df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1",
36-
"linux-x86_64": "4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff",
37-
"macos-arm64": "bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555",
38-
"macos-x86_64": "724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566",
39-
"windows-x86_64": "c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af"
38+
"darwin-arm64": {
39+
"asset": "sfw-free-macos-arm64",
40+
"sha256": "bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555"
41+
},
42+
"darwin-x64": {
43+
"asset": "sfw-free-macos-x86_64",
44+
"sha256": "724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566"
45+
},
46+
"linux-arm64": {
47+
"asset": "sfw-free-linux-arm64",
48+
"sha256": "df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1"
49+
},
50+
"linux-x64": {
51+
"asset": "sfw-free-linux-x86_64",
52+
"sha256": "4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff"
53+
},
54+
"win-x64": {
55+
"asset": "sfw-free-windows-x86_64.exe",
56+
"sha256": "c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af"
57+
}
4058
},
4159
"ecosystems": ["npm", "yarn", "pnpm", "pip", "uv", "cargo"]
4260
},
4361
"sfw-enterprise": {
4462
"description": "Socket Firewall (enterprise tier)",
4563
"version": "v1.6.1",
46-
"repository": "SocketDev/firewall-release",
47-
"platforms": {
48-
"darwin-arm64": "macos-arm64",
49-
"darwin-x64": "macos-x86_64",
50-
"linux-arm64": "linux-arm64",
51-
"linux-x64": "linux-x86_64",
52-
"win32-x64": "windows-x86_64"
53-
},
64+
"repository": "github:SocketDev/firewall-release",
65+
"release": "asset",
5466
"checksums": {
55-
"linux-arm64": "671270231617142404a1564e52672f79b806f9df3f232fcc7606329c0246da55",
56-
"linux-x86_64": "9115b4ca8021eb173eb9e9c3627deb7f1066f8debd48c5c9d9f3caabb2a26a4b",
57-
"macos-arm64": "acad0b517601bb7408e2e611c9226f47dcccbd83333d7fc5157f1d32ed2b953d",
58-
"macos-x86_64": "01d64d40effda35c31f8d8ee1fed1388aac0a11aba40d47fba8a36024b77500c",
59-
"windows-x86_64": "9a50e1ddaf038138c3f85418dc5df0113bbe6fc884f5abe158beaa9aea18d70a"
67+
"darwin-arm64": {
68+
"asset": "sfw-macos-arm64",
69+
"sha256": "acad0b517601bb7408e2e611c9226f47dcccbd83333d7fc5157f1d32ed2b953d"
70+
},
71+
"darwin-x64": {
72+
"asset": "sfw-macos-x86_64",
73+
"sha256": "01d64d40effda35c31f8d8ee1fed1388aac0a11aba40d47fba8a36024b77500c"
74+
},
75+
"linux-arm64": {
76+
"asset": "sfw-linux-arm64",
77+
"sha256": "671270231617142404a1564e52672f79b806f9df3f232fcc7606329c0246da55"
78+
},
79+
"linux-x64": {
80+
"asset": "sfw-linux-x86_64",
81+
"sha256": "9115b4ca8021eb173eb9e9c3627deb7f1066f8debd48c5c9d9f3caabb2a26a4b"
82+
},
83+
"win-x64": {
84+
"asset": "sfw-windows-x86_64.exe",
85+
"sha256": "9a50e1ddaf038138c3f85418dc5df0113bbe6fc884f5abe158beaa9aea18d70a"
86+
}
6087
},
6188
"ecosystems": ["npm", "yarn", "pnpm", "pip", "uv", "cargo", "gem", "bundler", "nuget"]
6289
}

‎.claude/hooks/setup-security-tools/index.mts‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -121,12 +121,14 @@ async function setupZizmor(): Promise<boolean> {
121121
}
122122

123123
// Download archive via dlx (handles caching + checksum).
124-
const platformKey = `${process.platform}-${process.arch}`
125-
const asset = ZIZMOR.assets?.[platformKey]
126-
if (!asset) throw new Error(`Unsupported platform: ${platformKey}`)
127-
const expectedSha = ZIZMOR.checksums?.[asset]
128-
if (!expectedSha) throw new Error(`No checksum for: ${asset}`)
129-
const url = `https://github.com/${ZIZMOR.repository}/releases/download/v${ZIZMOR.version}/${asset}`
124+
const platformKey = `${process.platform === 'win32' ? 'win' : process.platform}-${process.arch}`
125+
const platformEntry = ZIZMOR.checksums?.[platformKey]
126+
if (!platformEntry) {
127+
throw new Error(`Unsupported platform: ${platformKey}`)
128+
}
129+
const { asset, sha256: expectedSha } = platformEntry
130+
const repo = ZIZMOR.repository?.replace(/^[^:]+:/, '') ?? ''
131+
const url = `https://github.com/${repo}/releases/download/v${ZIZMOR.version}/${asset}`
130132

131133
logger.log(`Downloading zizmor v${ZIZMOR.version} (${asset})...`)
132134
const { binaryPath: archivePath, downloaded } = await downloadBinary({
@@ -174,17 +176,16 @@ async function setupSfw(apiKey: string | undefined): Promise<boolean> {
174176
logger.log(`=== Socket Firewall (${isEnterprise ? 'enterprise' : 'free'}) ===`)
175177

176178
// Platform.
177-
const platformKey = `${process.platform}-${process.arch}`
178-
const sfwPlatform = sfwConfig.platforms?.[platformKey]
179-
if (!sfwPlatform) throw new Error(`Unsupported platform: ${platformKey}`)
179+
const platformKey = `${process.platform === 'win32' ? 'win' : process.platform}-${process.arch}`
180+
const platformEntry = sfwConfig.checksums?.[platformKey]
181+
if (!platformEntry) {
182+
throw new Error(`Unsupported platform: ${platformKey}`)
183+
}
180184

181185
// Checksum + asset.
182-
const sha256 = sfwConfig.checksums?.[sfwPlatform]
183-
if (!sha256) throw new Error(`No checksum for: ${sfwPlatform}`)
184-
const prefix = isEnterprise ? 'sfw' : 'sfw-free'
185-
const suffix = sfwPlatform.startsWith('windows') ? '.exe' : ''
186-
const asset = `${prefix}-${sfwPlatform}${suffix}`
187-
const url = `https://github.com/${sfwConfig.repository}/releases/download/${sfwConfig.version}/${asset}`
186+
const { asset, sha256 } = platformEntry
187+
const repo = sfwConfig.repository?.replace(/^[^:]+:/, '') ?? ''
188+
const url = `https://github.com/${repo}/releases/download/${sfwConfig.version}/${asset}`
188189
const binaryName = isEnterprise ? 'sfw' : 'sfw-free'
189190

190191
// Download (with cache + checksum).

‎.claude/hooks/setup-security-tools/update.mts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
146146
return { tool, skipped: true, updated: false, reason: 'not in config' }
147147
}
148148

149-
const repo = toolConfig.repository ?? 'zizmorcore/zizmor'
149+
const repo = toolConfig.repository?.replace(/^[^:]+:/, '') ?? 'zizmorcore/zizmor'
150150

151151
let release: GhRelease
152152
try {
@@ -265,7 +265,7 @@ async function updateSfwTool(
265265
return { tool: toolName, skipped: true, updated: false, reason: 'not in config' }
266266
}
267267

268-
const repo = toolConfig.repository
268+
const repo = toolConfig.repository?.replace(/^[^:]+:/, '')
269269
if (!repo) {
270270
return { tool: toolName, skipped: true, updated: false, reason: 'no repository' }
271271
}

‎packages/cli/scripts/sea-build-utils/downloads.mjs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,11 +261,11 @@ export async function downloadExternalTools(platform, arch, isMusl = false) {
261261
// Filter by release === 'asset' to include all GitHub-released tools.
262262
for (const [toolName, toolConfig] of Object.entries(externalTools)) {
263263
if (toolConfig.release === 'asset') {
264-
const repoPath = toolConfig.repository.replace(/^github:/, '')
264+
const repoPath = toolConfig.repository.replace(/^[^:]+:/, '')
265265
const parts = repoPath.split('/')
266266
if (parts.length !== 2 || !parts[0] || !parts[1]) {
267267
throw new Error(
268-
`Invalid repository format for ${toolName}: expected 'github:owner/repo', got '${toolConfig.repository}'`,
268+
`Invalid repository format for ${toolName}: expected '<host>:owner/repo', got '${toolConfig.repository}'`,
269269
)
270270
}
271271
const [owner, repo] = parts
@@ -534,7 +534,7 @@ export async function downloadExternalTools(platform, arch, isMusl = false) {
534534
// socket_basics orchestrates the security tools (trivy, trufflehog, opengrep).
535535
const socketBasicsConfig = externalTools['socket-basics']
536536
if (socketBasicsConfig && socketBasicsConfig.release === 'archive') {
537-
const repoPath = socketBasicsConfig.repository.replace(/^github:/, '')
537+
const repoPath = socketBasicsConfig.repository.replace(/^[^:]+:/, '')
538538
const releaseVersion = socketBasicsConfig.version
539539
const version = releaseVersion.replace(/^v/, '') // Remove 'v' prefix for version
540540

‎packages/cli/scripts/sync-checksums.mjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ async function main() {
216216
let failed = 0
217217

218218
for (const tool of githubTools) {
219-
const repoPath = tool.repository.replace(/^github:/, '')
219+
const repoPath = tool.repository.replace(/^[^:]+:/, '')
220220
const releaseTag = tool.tag ?? tool.version
221221
console.log(`[${tool.key}] ${repoPath} @ ${releaseTag}`)
222222

0 commit comments

Comments
 (0)