Sample
electron 43.2.0
Verified sample for npm electron 43.2.0. The contract ran on node 22 · linux alpine/x64 · docker and passed: getPackageMetadata returns package manifest…
sha256:84a46accac63a2239011563353b35c2b3ed6d189631d170e426b5dc755eabd25
This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured.
How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people.
MIT-0
Execution evidence
The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.
- Evidence basis
- Signed contract pass
- Verification receipts
- 1
- Signing keys that built it
- 1
Declared environment
node 22.23 linux 24 · ubuntu · glibc 2.39 x64 node 22.23 javascript npm 10
Verification-run environments
| Environment | Contract | Stages | Run |
|---|---|---|---|
| node 22 · linux alpine/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1 |
2026-08-21 |
Case
HOW- Goal
- verify pkg:npm/electron@43.2.0
- Packages
- Environment
- node 22.23.2
- Created
- 2026-08-21T13:30:32Z
Contract
- getPackageMetadata returns package manifest details with version 43.2.0 and cli.js binary entry
- resolveCustomExecutablePath resolves the electron executable path for a configured distribution directory
- getChecksums loads release distribution SHA-256 checksums mapping for electron version 43.2.0
- getArtifactChecksum retrieves the exact SHA-256 hash for linux-x64, darwin-arm64, and win32-x64 release zips and returns null for unknown artifacts
- listAvailableArtifacts provides all release archive artifacts for version 43.2.0
Files
- PROMPT.md
- csx.json
- index.js
- package-lock.json
- package.json
- spec.json
- test/contract.cjs
Source
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/electron@43.2.0
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/electron@43.2.0
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:1266028cd5e39910d402a7a8dfee15336fbba21761fc97b3c3393690a8ede4ad","contract":["getPackageMetadata returns package manifest details with version 43.2.0 and cli.js binary entry","resolveCustomExecutablePath resolves the electron executable path for a configured distribution directory","getChecksums loads release distribution SHA-256 checksums mapping for electron version 43.2.0","getArtifactChecksum retrieves the exact SHA-256 hash for linux-x64, darwin-arm64, and win32-x64 release zips and returns null for unknown artifacts","listAvailableArtifacts provides all release archive artifacts for version 43.2.0"],"goal":"verify pkg:npm/electron@43.2.0","kind":"HOW","packages":["pkg:npm/electron@43.2.0"],"schemaVersion":1},"contractCommand":["node","test/contract.cjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/electron@43.2.0"],"schemaVersion":1,"subject":"pkg:npm/electron@43.2.0","verifierAdapter":"node-typescript@1"}
'use strict';
const fs = require('fs');
const path = require('path');
/**
* Get electron package metadata
*/
function getPackageMetadata() {
const pkgPath = require.resolve('electron/package.json');
const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
return {
name: pkg.name,
version: pkg.version,
bin: pkg.bin,
main: pkg.main
};
}
/**
* Resolve the expected executable path given a custom dist directory
*/
function resolveCustomExecutablePath(overridePath, binaryName = 'electron') {
if (!overridePath) {
throw new Error('Override path must be specified');
}
return path.join(overridePath, binaryName);
}
/**
* Load release distribution checksums
*/
function getChecksums() {
const checksumsPath = path.join(path.dirname(require.resolve('electron/package.json')), 'checksums.json');
if (!fs.existsSync(checksumsPath)) {
throw new Error('checksums.json not found in electron package');
}
return JSON.parse(fs.readFileSync(checksumsPath, 'utf8'));
}
/**
* Retrieve checksum for a specific artifact filename
*/
function getArtifactChecksum(artifactFilename) {
const checksums = getChecksums();
return checksums[artifactFilename] || null;
}
/**
* List all available release artifacts
*/
function listAvailableArtifacts() {
const checksums = getChecksums();
return Object.keys(checksums);
}
/**
* Resolve artifact filename for a platform and architecture
*/
function getPlatformZipFilename(version, platform, arch) {
return `electron-v${version}-${platform}-${arch}.zip`;
}
module.exports = {
getPackageMetadata,
resolveCustomExecutablePath,
getChecksums,
getArtifactChecksum,
listAvailableArtifacts,
getPlatformZipFilename
};
{
"name": "sample-electron",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-electron",
"version": "1.0.0",
"license": "MIT-0",
"dependencies": {
"electron": "43.2.0"
}
},
"node_modules/@electron-internal/extract-zip": {
"version": "1.0.5",
"resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz",
"integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==",
"license": "BSD-2-Clause",
"engines": {
"node": ">=22.12.0"
}
},
"node_modules/@electron/get": {
"version": "5.1.0",
"resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz",
"integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==",
"license": "MIT",
"dependencies": {
"debug": "^4.1.1",
"env-paths": "^3.0.0",
"graceful-fs": "^4.2.11",
"progress": "^2.0.3",
"semver": "^7.6.3",
"sumchecker": "^3.0.1"
},
"engines": {
"node": ">=22.12.0"
},
"optionalDependencies": {
"undici": "^7.24.4"
}
},
"node_modules/@types/node": {
"version": "24.13.3",
"resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
"integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
"license": "MIT",
"dependencies": {
"undici-types": "~7.18.0"
}
},
"node_modules/debug": {
"version": "4.4.3",
"resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
"integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
"license": "MIT",
"dependencies": {
"ms": "^2.1.3"
},
"engines": {
"node": ">=6.0"
},
"peerDependenciesMeta": {
"supports-color": {
"optional": true
}
}
},
"node_modules/electron": {
"version": "43.2.0",
"resolved": "https://registry.npmjs.org/electron/-/electron-43.2.0.tgz",
"integrity": "sha512-80zvrgG7ZRXD+tD0IyLvrnN9n+veSxadMRsMaC9wKKP3iUbtC7rGM8+dVuCmOb0Rrwwv8ESW4awnUZh9Hbp1fA==",
"license": "MIT",
"dependencies": {
"@electron-internal/extract-zip": "^1.0.1",
"@electron/get": "^5.0.0",
"@types/node": "^24.9.0"
},
"bin": {
"electron": "cli.js",
"install-electron": "install.js"
},
"engines": {
"node": ">= 22.12.0"
}
},
"node_modules/env-paths": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
"integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
"license": "MIT",
"engines": {
"node": "^12.20.0 || ^14.13.1 || >=16.0.0"
},
"funding": {
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/graceful-fs": {
"version": "4.2.11",
"resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
"integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
"license": "ISC"
},
"node_modules/ms": {
"version": "2.1.3",
"resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
"license": "MIT"
},
"node_modules/progress": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
"integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
"license": "MIT",
"engines": {
"node": ">=0.4.0"
}
},
"node_modules/semver": {
"version": "7.8.5",
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
"license": "ISC",
"bin": {
"semver": "bin/semver.js"
},
"engines": {
"node": ">=10"
}
},
"node_modules/sumchecker": {
"version": "3.0.1",
"resolved": "https://registry.npmjs.org/sumchecker/-/sumchecker-3.0.1.tgz",
"integrity": "sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg==",
"license": "Apache-2.0",
"dependencies": {
"debug": "^4.1.0"
},
"engines": {
"node": ">= 8.0"
}
},
"node_modules/undici": {
"version": "7.29.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
"integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
"license": "MIT",
"optional": true,
"engines": {
"node": ">=20.18.1"
}
},
"node_modules/undici-types": {
"version": "7.18.2",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
"integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
"license": "MIT"
}
}
}
{
"name": "sample-electron",
"version": "1.0.0",
"private": true,
"description": "Code sample verifying electron",
"main": "index.js",
"scripts": {
"test": "node test/contract.cjs"
},
"dependencies": {
"electron": "43.2.0"
},
"license": "MIT-0"
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/electron@43.2.0",
"kind": "HOW",
"packages": [
"pkg:npm/electron@43.2.0"
]
}
'use strict';
const assert = require('assert');
const path = require('path');
const {
getPackageMetadata,
resolveCustomExecutablePath,
getChecksums,
getArtifactChecksum,
listAvailableArtifacts,
getPlatformZipFilename
} = require('../index.js');
function run() {
// 1. getPackageMetadata returns package manifest details with version 43.2.0 and cli.js binary entry
const metadata = getPackageMetadata();
assert.strictEqual(metadata.name, 'electron', 'Package name must be electron');
assert.strictEqual(metadata.version, '43.2.0', 'Package version must be 43.2.0');
assert.strictEqual(metadata.bin.electron, 'cli.js', 'Binary entry must point to cli.js');
assert.strictEqual(metadata.main, 'index.js', 'Main entry point must be index.js');
// 2. resolveCustomExecutablePath resolves the electron executable path for a configured distribution directory
const customDist = path.join(__dirname, 'mock-dist');
const resolvedPath = resolveCustomExecutablePath(customDist);
assert.strictEqual(resolvedPath, path.join(customDist, 'electron'), 'Custom executable path must join directory and electron binary');
const customNamedPath = resolveCustomExecutablePath(customDist, 'electron.exe');
assert.strictEqual(customNamedPath, path.join(customDist, 'electron.exe'), 'Custom executable path must join directory and custom binary name');
// 3. getChecksums loads release distribution SHA-256 checksums mapping for electron version 43.2.0
const checksums = getChecksums();
assert.strictEqual(typeof checksums, 'object', 'Checksums must be an object');
assert.ok(Object.keys(checksums).length > 20, 'Checksums must contain entries for all release targets');
// 4. getArtifactChecksum retrieves the exact SHA-256 hash for linux-x64, darwin-arm64, and win32-x64 release zips and returns null for unknown artifacts
const linuxZip = getPlatformZipFilename('43.2.0', 'linux', 'x64');
const darwinZip = getPlatformZipFilename('43.2.0', 'darwin', 'arm64');
const win32Zip = getPlatformZipFilename('43.2.0', 'win32', 'x64');
assert.strictEqual(
getArtifactChecksum(linuxZip),
'f77ca6ed67bbc68702b69b56ad499bca6ae090705ade7d04f0ac545e409dec68',
'Linux x64 release hash must match exact checksum'
);
assert.strictEqual(
getArtifactChecksum(darwinZip),
'ad4a0ae3c37ee05aa06c7e2ed0627608389790f0505a2b0d20319efbe33ffe28',
'Darwin arm64 release hash must match exact checksum'
);
assert.strictEqual(
getArtifactChecksum(win32Zip),
'eba5f5088af40ecb364fe258809c79a5234c6ece5a75c64722772eba01b02786',
'Win32 x64 release hash must match exact checksum'
);
assert.strictEqual(
getArtifactChecksum('nonexistent-artifact-v43.2.0.zip'),
null,
'Unknown artifact should return null'
);
// 5. listAvailableArtifacts provides all release archive artifacts for version 43.2.0
const artifacts = listAvailableArtifacts();
assert.ok(Array.isArray(artifacts), 'Artifacts must be an array');
assert.ok(artifacts.includes(linuxZip), 'Artifacts list must include linux-x64 release archive');
assert.ok(artifacts.includes(darwinZip), 'Artifacts list must include darwin-arm64 release archive');
assert.ok(artifacts.includes(win32Zip), 'Artifacts list must include win32-x64 release archive');
assert.ok(artifacts.includes('electron-api.json'), 'Artifacts list must include electron-api.json');
console.log('Contract tests passed successfully.');
}
run();
Origin Seeder
anonymous