@commercient/dlake

npm wrapper for the Commercient Data Lake CLI (dlake). Installing the package downloads the platform-matched, self-contained native binary and exposes it as the dlake command.

Install

npm install -g @commercient/dlake
dlake login --domain mycompany --api-key dlk_...

postinstall (install.js) resolves your platform to a runtime id (win-x64 / linux-x64 / linux-arm64 / osx-arm64 / osx-x64), downloads the matching binary into bin/, and bin/dlake.js execs it — forwarding argv, stdio, and the exit code.

macOS: ad-hoc sign the downloaded binary

The macOS builds are cross-compiled on Windows and ship unsigned, and this wrapper does not sign what it downloads. After installing, run once:

codesign --force --sign - "$(npm root -g)/@commercient/dlake/bin/dlake"

On Apple Silicon this is a reliability fix, not just a Gatekeeper one: an unsigned Mach-O is validated page-by-page as it runs, so dlake can abort intermittently at startup (System.AccessViolationException ... at Thread+StartHelper.InitializeCulture()) — typically on rapid back-to-back invocations, where a retry succeeds. Ad-hoc signing removes it.

Configuration

| Env var | Default | Purpose | |---|---|---| | DLAKE_DOWNLOAD_BASE | https://downloads.datalake.commercient.com/downloads/dlake | Binary mirror base URL | | DLAKE_VERSION | this package's version | Which binary version to fetch (may not be older — see below) | | DLAKE_SHA256 | — | Operator-pinned expected digest (64 hex); skips the manifest entirely | | DLAKE_ALLOW_MIRROR_CHECKSUMS | off | Trust a mirror's own SHA256SUMS (unsafe — see below) | | DLAKE_ALLOW_DOWNGRADE | off | Permit DLAKE_VERSION older than this package |

Download URL layout: <base>/<version>/<rid>/dlake[.exe].

Integrity / trust model

The downloaded binary is verified against a SHA-256 digest before it is made executable or moved into place, over HTTPS only, with redirects restricted to allowlisted hosts.

Where that digest comes from matters. Mirroring the binary with DLAKE_DOWNLOAD_BASE does not move the SHA256SUMS manifest: the manifest is always fetched from the canonical host (downloads.datalake.commercient.com), and the mirror's host is not even in the allowlist for that fetch. If both halves came from the mirror, the checksum would prove only that the mirror is self-consistent — anyone who can set the env var could serve a malicious binary and its matching digest. Splitting them means a mirror can only serve bytes the publisher already vouched for.

Two explicit escape hatches exist for installs that genuinely cannot reach the canonical host. Both print a warning banner:

• DLAKE_SHA256=<64-hex> — verify against a digest you obtained out of band. This is the recommended air-gapped option.
• DLAKE_ALLOW_MIRROR_CHECKSUMS=1 — restore the old behaviour and take the manifest from the mirror too. This transfers full trust to the mirror host.

Version floor. DLAKE_VERSION may pin the same or a newer build, but an older one is refused: an out-of-date binary can be perfectly checksummed and still carry fixed vulnerabilities. Install the matching @commercient/dlake@<version> instead, or set DLAKE_ALLOW_DOWNGRADE=1 if the downgrade is deliberate.

Supported platforms

• Windows x64 (win-x64)
• Linux x64 (linux-x64)
• Linux ARM64 (linux-arm64)
• macOS Apple Silicon (osx-arm64)
• macOS Intel (osx-x64)

Other platforms (e.g. Windows on ARM) fail fast with a clear message naming the detected platform and arch — the installer never falls back to a mismatched binary.

Development

rid.js holds the pure resolution logic (mirrors the C# RidResolver); run its checks with node test-rid.js. install.js exports its pure trust-policy helpers (version floor, checksum provenance, temp-path generation); run their checks with node test-install.js. npm test runs both. See ../../docs/cli.md for the full CLI guide.