@treeship/cli-linux-x64

Platform-specific binary for the Treeship CLI on Linux x86_64 (GNU).

This package is not meant to be installed directly. It is automatically downloaded when you run:

npm install -g treeship

The main treeship package detects your platform and pulls the correct binary.

Binary integrity

The package ships a single-line expected-checksum.txt with the SHA-256 of the binary it downloads from the matching GitHub Release. The postinstall script:

1. Reads the expected hash from the package (delivered via npm).
2. Downloads the binary from https://github.com/zerkerlabs/treeship/releases/download/v<version>/treeship-linux-x86_64.
3. Verifies the downloaded bytes match the expected hash.
4. Atomically renames the partial download into place only on match. On mismatch, the partial file is deleted and install fails (exit 1).

Because the hash is delivered via npm and the binary is delivered via GitHub Releases, an attacker would need to compromise both trust roots simultaneously to slip a tampered binary past install. A compromise of either alone produces a verification failure.

If the package was published without expected-checksum.txt, the postinstall refuses to install. That's intentional: a binary with no published checksum is unverifiable.

Repository

github.com/zerkerlabs/treeship