Add Ed25519 signature verification to auto-updater (v1.0.4)

com.pdma.notion-timer.sdPlugin/bin/plugin.js

@@ -6383,7 +6383,7 @@ async function fetchProjects(token, dbId) {
       sorts: [{ property: "Project name", direction: "ascending" }]
     })
   });
-  if (!resp.ok) throw new Error(`Notion error ${resp.status}: ${await resp.text()}`);
+  if (!resp.ok) throw new Error(`Notion error ${resp.status}`);
   const data = await resp.json();
   return data.results.map((page) => {
     const titleArr = page.properties?.["Project name"]?.title ?? [];
@@ -6413,7 +6413,7 @@ async function startTimer(token, timingDbId, projectId, projectName, userId) {
       }
     })
   });
-  if (!resp.ok) throw new Error(`Failed to start timer: ${await resp.text()}`);
+  if (!resp.ok) throw new Error(`Failed to start timer: ${resp.status}`);
   const data = await resp.json();
   return data.id;
 }
@@ -6429,26 +6429,49 @@ async function stopTimer(token, entryId) {
       }
     })
   });
-  if (!resp.ok) throw new Error(`Failed to stop timer: ${await resp.text()}`);
+  if (!resp.ok) throw new Error(`Failed to stop timer: ${resp.status}`);
 }
 
 // src/plugin.ts
-var CURRENT_VERSION = "1.0.3";
+var CURRENT_VERSION = "1.0.4";
 var GITEA_BASE = "http://100.120.125.113:3000/pdm/stream_deck_notion_timer/raw/branch/master";
+var SIGNING_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAN7ko8TUpuPzPAJuKAZCRjV0c4ZSlou5d9pUAF6o12b4=
+-----END PUBLIC KEY-----`;
+function isNewerVersion(remote, current) {
+  const parse = (v) => v.split(".").map(Number);
+  const [rMaj, rMin, rPat] = parse(remote);
+  const [cMaj, cMin, cPat] = parse(current);
+  if (rMaj !== cMaj) return rMaj > cMaj;
+  if (rMin !== cMin) return rMin > cMin;
+  return rPat > cPat;
+}
 async function checkForUpdates() {
   try {
     const resp = await fetch(`${GITEA_BASE}/version.json`);
     if (!resp.ok) return;
     const { version } = await resp.json();
-    if (version === CURRENT_VERSION) return;
-    const pluginResp = await fetch(`${GITEA_BASE}/com.pdma.notion-timer.sdPlugin/bin/plugin.js`);
-    if (!pluginResp.ok) return;
+    if (!/^\d+\.\d+\.\d+$/.test(version)) return;
+    if (!isNewerVersion(version, CURRENT_VERSION)) return;
+    const [pluginResp, sigResp] = await Promise.all([
+      fetch(`${GITEA_BASE}/com.pdma.notion-timer.sdPlugin/bin/plugin.js`),
+      fetch(`${GITEA_BASE}/com.pdma.notion-timer.sdPlugin/bin/plugin.js.sig`)
+    ]);
+    if (!pluginResp.ok || !sigResp.ok) return;
     const newCode = await pluginResp.text();
+    const sigBytes = Buffer.from(await sigResp.arrayBuffer());
+    const { verify } = await import("node:crypto");
+    const valid = verify(null, Buffer.from(newCode), SIGNING_PUBLIC_KEY, sigBytes);
+    if (!valid) {
+      plugin_default.logger.error("Update rejected: signature verification failed");
+      return;
+    }
     const fs3 = await import("fs");
     fs3.writeFileSync(__filename, newCode);
     plugin_default.logger.info(`Updated to ${version}, restarting\u2026`);
     process.exit(0);
-  } catch {
+  } catch (err) {
+    plugin_default.logger.error(`Update check failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 var HARDCODED = {

com.pdma.notion-timer.sdPlugin/bin/plugin.js.sig

@@ -0,0 +1 @@
+MžsRE¸IŹ ć6TÝßţă<ćÝE]&Z¸pŚĐÝĽŤÓĐ^ßlt!°BDuÖs屟ę1)Žë€6Ç_/ř`9