check-noise-core.mjs

1// PB-26-003: verify the committed Noise WASM still matches crypto-core source.2// Rebuilds via npm run build:noise-core and fails if any shipped artifact3// drifts, so "reviewed source → shipped binary" is machine-enforced.4import { spawnSync } from "node:child_process";5import { createHash } from "node:crypto";6import { readFileSync } from "node:fs";7import { dirname, resolve } from "node:path";8import { fileURLToPath } from "node:url";910const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");11const dest = resolve(root, "src/shared/noise-core-wasm");12const files = [13  "peach_noise_core.js",14  "peach_noise_core.d.ts",15  "peach_noise_core_bg.wasm",16  "peach_noise_core_bg.wasm.d.ts",17  "peach_noise_core_bytes.ts",18];1920function hashTree() {21  return Object.fromEntries(22    files.map((f) => [23      f,24      createHash("sha256").update(readFileSync(resolve(dest, f))).digest("hex"),25    ]),26  );27}2829const before = hashTree();30const build = spawnSync("npm", ["run", "build:noise-core"], { stdio: "inherit" });31if (build.status !== 0) {32  console.error(33    "noise-core rebuild failed — committed WASM provenance cannot be verified (PB-26-003)",34  );35  process.exit(build.status ?? 1);36}3738const after = hashTree();39const drifted = files.filter((f) => before[f] !== after[f]);40if (drifted.length > 0) {41  console.error(42    `committed Noise WASM does not match crypto-core/src/lib.rs — drifted: ${drifted.join(", ")}\n` +43      "run `npm run build:noise-core` and commit the regenerated files",44  );45  process.exit(1);46}47console.log("committed Noise WASM matches crypto-core source");