cve-differential/lib/verifier.js

/**
 * Architecture mapping and cryptographic checksum verification.
 */

const fs = require('node:fs');
const crypto = require('node:crypto');

function mapArch(unameArch) {
  const normalized = (unameArch || '').trim().toLowerCase();
  switch (normalized) {
    case 'x86_64':
    case 'amd64':
      return '64bit';
    case 'aarch64':
    case 'arm64':
      return 'ARM64';
    default:
      throw new Error(`Unsupported architecture: ${unameArch}`);
  }
}

function parseChecksums(checksumsContent) {
  const map = new Map();
  if (!checksumsContent) return map;

  const lines = checksumsContent.split(/\r?\n/);
  for (const line of lines) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith('#')) continue;
    // Format: <hash>  <filename>
    const match = trimmed.match(/^([a-fA-F0-9]{64})\s+(.+)$/);
    if (match) {
      const hash = match[1].toLowerCase();
      const filename = match[2].trim();
      map.set(filename, hash);
    }
  }
  return map;
}

function verifyFileSha256(filePath, expectedHash) {
  if (!fs.existsSync(filePath) || !expectedHash) return false;
  try {
    const fileBuffer = fs.readFileSync(filePath);
    const actualHash = crypto.createHash('sha256').update(fileBuffer).digest('hex');
    return actualHash.toLowerCase() === expectedHash.toLowerCase();
  } catch {
    return false;
  }
}

module.exports = {
  mapArch,
  parseChecksums,
  verifyFileSha256,
};