fix(anime): pin linux-x64 bridge checksum and fetch release by tag

- Add PINNED_BUNDLE_SHA256 entry for linux-x64-bundle.zip so Linux no longer refuses to start with "No pinned checksum"
- Fetch the bridge release by its pinned tag (releases/tags/<tag>) instead of listing newest releases, so an upstream publish can't swap in an unverified asset
- Update docs and changelog to describe the pin/tag behavior

changes/anime-browser.md

@@ -13,3 +13,5 @@ area: anime
 - Added `anime.repos`, `anime.extensionsDir`, and `anime.preferredQuality` config keys. SubMiner ships no extension repositories and performs no discovery.
 - Anime playback targets Japanese audio: dub-labelled entries are skipped when the source offers an alternative, `alang` prefers Japanese, and the source's own audio and subtitle tracks are loaded into mpv (Japanese selected) instead of being discarded, so all of them can be switched from mpv's track menu.
 - The primary subtitle slot stays reserved for Japanese: a source that only has, say, English subtitles gets them added with a normalized language tag (`English` → `en`) but not selected, so the regular `secondarySub` auto-load can route them to the secondary slot instead.
+- The Linux x64 bridge bundle is verified and pinned, so the anime browser starts on Linux instead of refusing with "No pinned checksum for linux-x64-bundle.zip".
+- The bridge bundle is fetched from the pinned release tag rather than whatever release is newest, so an upstream publish no longer breaks every install with a checksum mismatch.

docs-site/anime-browser.md

@@ -129,9 +129,11 @@ credentials, it is written with owner-only permissions.
 ## The bridge
 
 The first launch downloads a platform bundle (~130 MB) containing the server and
-a matching Java runtime, so no system JDK is required. It is verified against a
-pinned SHA-256 before running, unpacked into `<userData>/anime-bridge`, and
-reused after that. Progress appears in the banner at the top of the window.
+a matching Java runtime, so no system JDK is required. SubMiner pins one
+upstream release tag and the SHA-256 of each asset it has verified; the download
+is checked against that hash before anything runs, then unpacked into
+`<userData>/anime-bridge` and reused after that. Progress appears in the banner
+at the top of the window.
 
 The bridge stays running while the window is open. Resolved video URLs point at
 its own loopback proxy so the extension's cookies and headers apply, which means
@@ -142,8 +144,10 @@ Two known limits:
 
 - There is no Android WebView, so extensions that need one (typically for
   Cloudflare challenges) will fail with an error from the source.
-- Bundles are published for macOS (arm64, x64), Linux (x64), and Windows (x64).
-  Other platforms are unsupported.
+- Bundles are published for macOS (arm64, x64), Linux (x64), and Windows (x64),
+  but only the ones we have hashed ourselves will run: currently macOS arm64 and
+  Linux x64. The rest stop with "No pinned checksum for …" until a maintainer
+  verifies them. Other platforms are unsupported outright.
 
 ## Playback
 

src/anime-bridge/sidecar-bundle.test.ts

@@ -4,6 +4,7 @@ import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import {
+  bundleReleaseUrl,
   findBundleBinaries,
   PINNED_BUNDLE_SHA256,
   PINNED_BUNDLE_TAG,
@@ -26,34 +27,71 @@ test('resolveBundleAssetName returns null for unpublished combinations', () => {
   assert.equal(resolveBundleAssetName('freebsd', 'x64'), null);
 });
 
-test('selectBundleAsset skips releases without a matching asset', () => {
-  const releases = [
-    // The iOS runtime release carries no desktop bundle.
-    { tag_name: 'ios-runtime-v7', assets: [{ name: 'MExtensionServer-ios.jar' }] },
+const PINNED_RELEASE = {
+  tag_name: PINNED_BUNDLE_TAG,
+  assets: [
     {
-      tag_name: 'v1.0.6.0',
-      assets: [
-        {
-          name: 'macOS-arm64-bundle.zip',
-          browser_download_url: 'https://example.test/macOS-arm64-bundle.zip',
-          size: 133_058_560,
-        },
-      ],
+      name: 'macOS-arm64-bundle.zip',
+      browser_download_url: 'https://example.test/macOS-arm64-bundle.zip',
+      size: 133_058_560,
     },
-  ];
+  ],
+};
 
-  const asset = selectBundleAsset(releases, 'macOS-arm64-bundle.zip');
-  assert.equal(asset?.tagName, 'v1.0.6.0');
+test('selectBundleAsset reads the by-tag endpoint payload', () => {
+  const asset = selectBundleAsset(PINNED_RELEASE, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
   assert.equal(asset?.downloadUrl, 'https://example.test/macOS-arm64-bundle.zip');
   assert.equal(asset?.sizeBytes, 133_058_560);
 });
 
+test('selectBundleAsset skips releases without a matching asset', () => {
+  const releases = [
+    // The iOS runtime release carries no desktop bundle.
+    { tag_name: 'ios-runtime-v7', assets: [{ name: 'MExtensionServer-ios.jar' }] },
+    PINNED_RELEASE,
+  ];
+
+  const asset = selectBundleAsset(releases, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
+});
+
+test('selectBundleAsset ignores releases newer than the pin', () => {
+  const releases = [
+    {
+      tag_name: 'v9.9.9.9',
+      assets: [
+        {
+          name: 'macOS-arm64-bundle.zip',
+          browser_download_url: 'https://example.test/unpinned.zip',
+          size: 1,
+        },
+      ],
+    },
+    PINNED_RELEASE,
+  ];
+
+  const asset = selectBundleAsset(releases, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
+  assert.equal(asset?.downloadUrl, 'https://example.test/macOS-arm64-bundle.zip');
+});
+
 test('selectBundleAsset returns null when nothing matches', () => {
-  assert.equal(selectBundleAsset([{ tag_name: 'v1', assets: [] }], 'linux-x64-bundle.zip'), null);
+  assert.equal(
+    selectBundleAsset([{ tag_name: PINNED_BUNDLE_TAG, assets: [] }], 'linux-x64-bundle.zip'),
+    null,
+  );
   assert.equal(selectBundleAsset([], 'linux-x64-bundle.zip'), null);
   assert.equal(selectBundleAsset({ message: 'rate limited' }, 'linux-x64-bundle.zip'), null);
 });
 
+test('bundleReleaseUrl targets the pinned tag', () => {
+  assert.equal(
+    bundleReleaseUrl(),
+    `https://api.github.com/repos/1Selxo/M-Extension-Server/releases/tags/${PINNED_BUNDLE_TAG}`,
+  );
+});
+
 test('findBundleBinaries locates the nested jre and jar', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'subminer-bundle-'));
   await mkdir(path.join(root, 'jre', 'jre', 'bin'), { recursive: true });
@@ -103,15 +141,19 @@ test('verifyPinnedBundle accepts a matching hash and rejects a mismatch', () =>
 });
 
 test('verifyPinnedBundle refuses an asset that has no pin', () => {
-  const result = verifyPinnedBundle('linux-x64-bundle.zip', new Uint8Array([1, 2, 3]));
+  const result = verifyPinnedBundle('windows-x64-bundle.zip', new Uint8Array([1, 2, 3]));
   assert.equal(result.ok, false);
   assert.match((result as { reason: string }).reason, /No pinned checksum/);
 });
 
-test('the pinned tag and macOS arm64 hash are the verified release', () => {
+test('the pinned tag and hashes are the verified release', () => {
   assert.equal(PINNED_BUNDLE_TAG, 'v1.0.6.0');
   assert.equal(
     PINNED_BUNDLE_SHA256['macOS-arm64-bundle.zip'],
     '5f4fb03abfe88bc46ddf5f4d8221156ee2d66b9cbad7c4bc3ade4baf3a4266e6',
   );
+  assert.equal(
+    PINNED_BUNDLE_SHA256['linux-x64-bundle.zip'],
+    'c2b869d3905b06a308517fec0b44f70ff76f7212230c60710bba39a7025c3a69',
+  );
 });

src/anime-bridge/sidecar-bundle.ts

@@ -8,8 +8,15 @@ import path from 'node:path';
  * required.
  */
 
-export const BUNDLE_RELEASES_URL =
-  'https://api.github.com/repos/1Selxo/M-Extension-Server/releases?page=1&per_page=10';
+const BUNDLE_REPO_API = 'https://api.github.com/repos/1Selxo/M-Extension-Server';
+
+/**
+ * Fetch the pinned release by tag rather than listing releases: upstream ships
+ * several a week, so a paged list would scroll the pinned tag off page one.
+ */
+export function bundleReleaseUrl(tagName: string = PINNED_BUNDLE_TAG): string {
+  return `${BUNDLE_REPO_API}/releases/tags/${encodeURIComponent(tagName)}`;
+}
 
 /**
  * The bridge release this integration was verified against.
@@ -24,6 +31,7 @@ export const PINNED_BUNDLE_TAG = 'v1.0.6.0';
 /** SHA-256 of each pinned asset, keyed by release asset name. */
 export const PINNED_BUNDLE_SHA256: Readonly<Record<string, string>> = {
   'macOS-arm64-bundle.zip': '5f4fb03abfe88bc46ddf5f4d8221156ee2d66b9cbad7c4bc3ade4baf3a4266e6',
+  'linux-x64-bundle.zip': 'c2b869d3905b06a308517fec0b44f70ff76f7212230c60710bba39a7025c3a69',
 };
 
 /**
@@ -130,12 +138,23 @@ interface GithubRelease {
 }
 
 /**
- * Pick the newest release carrying an asset for this platform. Releases are
- * returned newest-first, and some (the iOS runtime) carry no desktop bundle.
+ * Pick the asset for this platform from the pinned release. Selecting "newest"
+ * instead would download a release whose checksum we never computed, so every
+ * upstream publish would break the install with a mismatch.
  */
-export function selectBundleAsset(releases: unknown, assetName: string): BundleAsset | null {
-  if (!Array.isArray(releases)) return null;
-  for (const release of releases as GithubRelease[]) {
+export function selectBundleAsset(
+  releases: unknown,
+  assetName: string,
+  tagName: string = PINNED_BUNDLE_TAG,
+): BundleAsset | null {
+  // Accepts either a single release (the by-tag endpoint) or a list.
+  const candidates = Array.isArray(releases)
+    ? releases
+    : releases && typeof releases === 'object'
+      ? [releases]
+      : [];
+  for (const release of candidates as GithubRelease[]) {
+    if (release.tag_name !== tagName) continue;
     const asset = release.assets?.find((candidate) => candidate.name === assetName);
     if (asset?.browser_download_url && release.tag_name) {
       return {

src/main/runtime/anime-bridge-installer.ts

@@ -2,8 +2,9 @@ import { spawn } from 'node:child_process';
 import { chmod, mkdir, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import {
-  BUNDLE_RELEASES_URL,
+  bundleReleaseUrl,
   findBundleBinaries,
+  PINNED_BUNDLE_TAG,
   resolveBundleAssetName,
   selectBundleAsset,
   verifyPinnedBundle,
@@ -121,16 +122,18 @@ export async function ensureBridgeBinaries(options: EnsureBridgeOptions): Promis
   }
 
   options.onProgress?.({ stage: 'locating', progress: null });
-  const releasesResponse = await fetchImpl(BUNDLE_RELEASES_URL, {
+  const releasesResponse = await fetchImpl(bundleReleaseUrl(), {
     headers: { Accept: 'application/vnd.github+json' },
     signal: AbortSignal.timeout(RELEASES_TIMEOUT_MS),
   });
   if (!releasesResponse.ok) {
-    throw new Error(`Could not list anime bridge releases (${releasesResponse.status}).`);
+    throw new Error(
+      `Could not read anime bridge release ${PINNED_BUNDLE_TAG} (${releasesResponse.status}).`,
+    );
   }
   const asset = selectBundleAsset(await releasesResponse.json(), assetName);
   if (asset === null) {
-    throw new Error(`No published anime bridge release contains ${assetName}.`);
+    throw new Error(`Anime bridge release ${PINNED_BUNDLE_TAG} has no ${assetName}.`);
   }
 
   options.onProgress?.({ stage: 'downloading', progress: 0 });