Merge pull request #193 from cargo-prebuilt/fetch

Use fetch instead of http-client

package.json

@@ -27,7 +27,6 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/exec": "^1.1.1",
-    "@actions/http-client": "^2.2.0",
     "@actions/tool-cache": "^2.0.1"
   },
   "devDependencies": {

src/minisign.ts

@@ -1,17 +1,12 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as tc from '@actions/tool-cache'
-import * as httpm from '@actions/http-client'
 import {arch, platform} from 'node:process'
 import {hashFile} from './sha256'
-import {DL_URL} from './vals'
+import {DL_URL, PREBUILT_INDEX_PUB_KEY, RSIGN_DL_URL} from './vals'
 import path from 'node:path'
 import {writeFileSync} from 'node:fs'
 
-const DL =
-  'https://github.com/cargo-prebuilt/index/releases/download/rsign2-0.6.3/'
-const PUB_KEY = 'RWTSqAR1Hbfu6mBFiaz4hb9I9gikhMmvKkVbyz4SJF/oxJcbbScmCqqO'
-
 export async function verifyFileMinisign(
   version: string,
   fileName: string,
@@ -20,19 +15,18 @@ export async function verifyFileMinisign(
   return new Promise(async resolve => {
     const rsign2 = await installRsign2()
 
-    const archivePath = path.dirname(filePath)
-    const client = new httpm.HttpClient('minisign downloader')
-    const res = await client.get(`${DL_URL}${version}/${fileName}.minisig`)
-    const minisignFile = await res.readBody()
+    const res = await fetch(`${DL_URL}${version}/${fileName}.minisig`)
+    const minisignFile = (await res.text()).trim()
 
+    const archivePath = path.dirname(filePath)
     const minisignFilePath = `${archivePath}/${fileName}.minisig`
     writeFileSync(minisignFilePath, minisignFile)
 
     await exec.exec(rsign2, [
       'verify',
       `${filePath}`,
       '-P',
-      `${PUB_KEY}`,
+      `${PREBUILT_INDEX_PUB_KEY}`,
       '-x',
       `${minisignFilePath}`
     ])
@@ -99,7 +93,7 @@ async function installRsign2(): Promise<string> {
 
     if (!dlFile) throw new Error('unsupported or missing platform')
 
-    const toolPath = await tc.downloadTool(`${DL}${dlFile}.tar.gz`)
+    const toolPath = await tc.downloadTool(`${RSIGN_DL_URL}${dlFile}.tar.gz`)
     const hash = await hashFile(toolPath)
 
     if (hash !== dlHash)

src/sha256.ts

@@ -1,4 +1,3 @@
-import * as httpm from '@actions/http-client'
 import {readFileSync} from 'node:fs'
 import {createHash} from 'node:crypto'
 import {DL_URL} from './vals'
@@ -8,9 +7,8 @@ export async function verifyFileHash(
   filePath: string
 ): Promise<void> {
   return new Promise(async resolve => {
-    const client = new httpm.HttpClient('sha256 downloader')
-    const res = await client.get(`${DL_URL}${version}/hashes.sha256`)
-    const sha256File = await res.readBody()
+    const res = await fetch(`${DL_URL}${version}/hashes.sha256`)
+    const sha256File = (await res.text()).trim()
 
     const fileHash = await hashFile(filePath)
 

src/vals.ts

@@ -1,2 +1,6 @@
 export const DL_URL =
   'https://github.com/cargo-prebuilt/cargo-prebuilt/releases/download/v'
+export const RSIGN_DL_URL =
+  'https://github.com/cargo-prebuilt/index/releases/download/rsign2-0.6.3/'
+export const PREBUILT_INDEX_PUB_KEY =
+  'RWTSqAR1Hbfu6mBFiaz4hb9I9gikhMmvKkVbyz4SJF/oxJcbbScmCqqO'