2 Commits

Include renames

Author	SHA1	Message	Date
Martin Vogel	c1eb3dd2d1	Comprehensive security hardening across all installers ... install.sh: - Wrap entire body in main() to prevent partial execution from curl|bash (interrupted download would execute truncated script) install.ps1: - Enforce TLS 1.2+ (older PowerShell defaults to TLS 1.0) PyPI (_cli.py): - Add SHA256 checksum verification against checksums.txt (was the only installer without checksums) npm (install.js): - Add SHA256 checksum verification against checksums.txt - Validate HTTPS on every redirect hop (max 5 redirects) - Replace execSync string interpolation with execFileSync array args (eliminates shell injection vector in tar/PowerShell calls) - Add path traversal check on extracted binary npm (bin.js): - Auto-download binary if missing (handles --ignore-scripts / pnpm) Go wrapper (main.go): - Custom HTTP client with CheckRedirect that rejects non-HTTPS redirects (Go's default http.Get follows redirects without scheme validation) - Fix variable name bug in error message (url → rawURL)	2026-04-14 21:00:42 +02:00
DeusData	592be8ea42	Add pkg/ — distribution wrappers for npm, PyPI, Homebrew, Scoop, Winget, Chocolatey, AUR ... Introduces pkg/ as a self-contained home for all package registry wrappers. Each subdirectory is a ready-to-publish package that downloads the appropriate pre-built binary from GitHub Releases — no source compilation at install time. - pkg/npm/ — postinstall downloads binary; bin.js shim for CLI - pkg/pypi/ — lazy download on first run via _cli.py; pipx-friendly - pkg/homebrew/ — multi-arch formula (darwin/linux × arm64/amd64) - pkg/scoop/ — Windows bucket manifest with autoupdate + checksum - pkg/winget/ — v1.6.0 manifests (version + installer + locale) - pkg/chocolatey/ — nuspec + install/uninstall scripts - pkg/aur/ — PKGBUILD + .SRCINFO for x86_64 and aarch64 All hashes are real SHA-256 checksums from the v0.6.0 release.	2026-04-12 17:54:53 +01:00