feat: move opkssh and warpgate into plugins (C3)

plugins/opkssh/src/backend/binary.ts

@@ -0,0 +1,77 @@
+import path from "node:path";
+import type { PluginBinarySpec } from "@termix/plugin-sdk/backend";
+
+export const DEFAULT_VERSION = "v0.16.0";
+
+const DEFAULT_CHECKSUMS: Record<string, string> = {
+  "opkssh-linux-amd64":
+    "c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf",
+  "opkssh-linux-arm64":
+    "9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44",
+  "opkssh-osx-amd64":
+    "e1ccddb4a73c7dd24e0677e9c933462b954dde9a151fcd96c8ee7ba83bc3f146",
+  "opkssh-osx-arm64":
+    "be279812cc4d44a28f8cb6eef4b13515fae16b6d00ae61e21630e0c061b02cbd",
+  "opkssh-windows-amd64.exe":
+    "db8991ceaac7ac224b704510ca6fba2114998291d4283de4bc2d3b8efa66ad07",
+  "opkssh-windows-arm64.exe":
+    "c35352dc2d12ef3775b280aa85dc1e97ff90cd8ad4beb62c3e2357fdf80ba5af",
+};
+
+const OS_NAMES: Record<string, string> = {
+  linux: "linux",
+  darwin: "osx",
+  win32: "windows",
+};
+
+const ARCH_NAMES: Record<string, string> = {
+  x64: "amd64",
+  arm64: "arm64",
+};
+
+/** The release asset name for this server, e.g. "opkssh-linux-amd64". */
+export function binaryName(
+  platform: string = process.platform,
+  arch: string = process.arch,
+): string {
+  const os = OS_NAMES[platform] ?? platform;
+  const cpu = ARCH_NAMES[arch] ?? arch;
+  return `opkssh-${os}-${cpu}${platform === "win32" ? ".exe" : ""}`;
+}
+
+/**
+ * What ctx.process.ensureBinary needs for OPKSSH.
+ *
+ * The pinned version is trusted by its built-in checksums. OPKSSH_VERSION
+ * picks another release, and then OPKSSH_SHA256 must give its checksum.
+ *
+ * The Docker image bakes the binary into /app/opkssh-bundled (the
+ * opkssh-downloader stage), which is checked first so an offline install
+ * never downloads. OPKSSH_BUNDLED_DIR points somewhere else.
+ */
+export function binarySpec(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: string = process.platform,
+  arch: string = process.arch,
+  cwd: string = process.cwd(),
+): PluginBinarySpec {
+  const name = binaryName(platform, arch);
+  const version = env.OPKSSH_VERSION || DEFAULT_VERSION;
+  const sha256 =
+    version === DEFAULT_VERSION
+      ? DEFAULT_CHECKSUMS[name]
+      : env.OPKSSH_SHA256?.trim().toLowerCase();
+  if (!sha256 || !/^[0-9a-f]{64}$/.test(sha256)) {
+    throw new Error(
+      `OPKSSH ${version} has no trusted SHA-256 checksum for ${name}`,
+    );
+  }
+  const bundledDir = env.OPKSSH_BUNDLED_DIR || path.join(cwd, "opkssh-bundled");
+  return {
+    name,
+    version,
+    sha256,
+    url: `https://github.com/openpubkey/opkssh/releases/download/${version}/${name}`,
+    prebuilt: [path.join(bundledDir, name)],
+  };
+}