fix: npm SHA-1 checksums and drop sh package invoke

.github/workflows/ci.yml

@@ -5,12 +5,17 @@ on:
     branches: [master, main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   in-cli:
     name: in-cli (fmt/clippy/test)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -29,6 +34,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Build protocol-gen
         run: cargo build --bin protocol-gen
@@ -44,6 +51,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Install rust-src
         run: rustup component add rust-src
@@ -64,6 +73,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Install rust-src
         run: rustup component add rust-src
@@ -80,6 +91,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Install rust-src
         run: rustup component add rust-src

.github/workflows/release.yml

@@ -19,6 +19,8 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Install rust-src (for self-host sysroot)
         run: rustup component add rust-src
@@ -67,6 +69,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}

apps/package-ecosystem-sample/adapters/go:fiber/inauguration.adapter.json

@@ -4,12 +4,12 @@
       "symbol": "fiber_greet",
       "returns": "string",
       "invoke": {
-        "program": "sh",
+        "program": "go",
         "args": [
-          "-c",
-          "cd inauguration-invoke && go run ."
+          "run",
+          "./inauguration-invoke"
         ]
       }
     }
   ]
-}
+}

in-cli/Cargo.toml

@@ -31,6 +31,7 @@ libc = "0.2"
 quote = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+sha1 = "0.11"
 sha2 = "0.11"
 syn = { version = "2", features = ["full"] }
 thiserror = "2"

in-cli/src/package_install.rs

@@ -761,7 +761,7 @@ fn verify_archive_checksum(path: &Path, checksum: &ArtifactChecksum) -> Result<(
     match checksum {
         ArtifactChecksum::Sha1Hex(expected) => verify_hex_digest(
             expected,
-            &hex_encode(&sha2::Sha256::digest(&data)),
+            &hex_encode(&sha1::Sha1::digest(&data)),
             path,
             "sha1",
         ),
@@ -1045,6 +1045,7 @@ fn curl_to_file(url: &str, path: &Path) -> Result<(), String> {
         })?;
     }
     let status = Command::new("curl")
+        .env_clear()
         .args([
             "-fsSL",
             "-A",
@@ -1079,6 +1080,13 @@ pub fn lock_dependencies(path: &Path) -> Result<(PathBuf, PackageLock), String>
 mod tests {
     use super::*;
 
+    #[test]
+    fn require_https_rejects_non_https() {
+        assert!(require_https("https://example.com/pkg").is_ok());
+        assert!(require_https("http://example.com/pkg").is_err());
+        assert!(require_https("file:///tmp/pkg").is_err());
+    }
+
     #[test]
     fn verify_archive_checksum_error_paths() {
         let dir = tempfile_dir("verify-checksum-err");
@@ -1087,6 +1095,12 @@ mod tests {
 
         let sha1 = ArtifactChecksum::Sha1Hex("badsha1".to_string());
         assert!(verify_archive_checksum(&path, &sha1).is_err());
+        let sha1_ok =
+            ArtifactChecksum::Sha1Hex("2aae6c35c94fcfb415dbe95f408b9ce91ee846ed".to_string());
+        assert!(
+            verify_archive_checksum(&path, &sha1_ok).is_ok(),
+            "npm shasum is SHA-1 of the archive bytes, not SHA-256"
+        );
 
         let sha256 = ArtifactChecksum::Sha256Hex("badsha256".to_string());
         assert!(verify_archive_checksum(&path, &sha256).is_err());

in-cli/src/package_runtime.rs

@@ -85,7 +85,7 @@ pub fn invoke_package_export(
     }
 }
 
-const ALLOWED_INVOKE_PROGRAMS: &[&str] = &["echo", "node", "python3", "cargo", "go", "sh", "true"];
+const ALLOWED_INVOKE_PROGRAMS: &[&str] = &["echo", "node", "python3", "cargo", "go", "true"];
 
 pub fn run_invoke(spec: &PackageInvokeSpec, install_path: &Path) -> Result<String, String> {
     if !ALLOWED_INVOKE_PROGRAMS.contains(&spec.program.as_str()) {
@@ -176,6 +176,16 @@ mod tests {
         assert_eq!(value, Value::String("ok".to_string()));
     }
 
+    #[test]
+    fn rejects_shell_invoke_program() {
+        let spec = PackageInvokeSpec {
+            program: "sh".to_string(),
+            args: vec!["-c".to_string(), "echo pwned".to_string()],
+        };
+        let err = run_invoke(&spec, Path::new(".")).expect_err("sh must not be allowlisted");
+        assert!(err.contains("not in the allowlist"));
+    }
+
     #[test]
     fn test_binding_return_type_mapping() {
         let cases = vec![