external-tools.json

{
  "$schema": "./packages/build-infra/lib/external-tools-schema.json",
  "description": "Socket-btm root manifest. Inherits the foundational tool set from packages/build-infra. Package-specific tools live in each packages/<name>/external-tools.json and are loaded alongside these via the hierarchical merging in packages/build-infra/lib/pinned-versions.mts.",
  "extends": "./packages/build-infra/external-tools.json",
  "tools": {
    "sfw-free": {
      "notes": [
        "SFW (Socket Firewall) free flavor (public, SocketDev/sfw-free). Ships a 7-platform set: linux-{x64,arm64}{,-musl}, darwin-{x64,arm64}, win-x64. win-arm64 is intentionally absent — upstream does not yet build it. SFW is a required dependency of the install flow, so consumers on win-arm64 skip SFW-dependent steps until upstream support lands.",
        "Installed when neither SOCKET_API_KEY nor SOCKET_API_TOKEN is set; the enterprise flavor (sfw-enterprise) is selected when one of those is present. The two flavors share a version and install to the same `sfw` binary name."
      ],
      "description": "Socket Firewall (free tier) — package manager command wrapper",
      "version": "1.12.0",
      "repository": "github:SocketDev/sfw-free",
      "binaryName": "sfw",
      "release": "asset",
      "platforms": {
        "darwin-arm64": {
          "asset": "sfw-free-macos-arm64",
          "integrity": "sha512-lwh/AIf7HXVIrE28LDfvtJqnaGb7azC+Up8Hi/c9hIfn9wMRt55misCKx9b6CjYi+d3bHladYNYPlqVtlqNpcQ=="
        },
        "darwin-x64": {
          "asset": "sfw-free-macos-x86_64",
          "integrity": "sha512-iBLJ7bzrnnUPmUbN8FFzmXNYowWnahOD4DWzKYbneeCsvFa1xlHT4LaLWTysatd5npJIO7QOiRow6yw/tgjCWw=="
        },
        "linux-arm64": {
          "asset": "sfw-free-linux-arm64",
          "integrity": "sha512-TZ0hzAzPyNfi1PgqU5+TzkrlBcWXZlXaSHkx1/wzIck4vlZXFQI8i7CCvWYihrJQ3zgEwVI30MmrqsJ9W7xWQw=="
        },
        "linux-arm64-musl": {
          "asset": "sfw-free-musl-linux-arm64",
          "integrity": "sha512-O+X0JxQJJn2YpAJFP38ZuG156pewgk+HJBVUTJZM8AMZSbERLy6LLDD2S8uwPXpMXDD9uRy8/h7EpRcu1OQLcw=="
        },
        "linux-x64": {
          "asset": "sfw-free-linux-x86_64",
          "integrity": "sha512-Yuu+qoqxa0n7WIS9NMI3uuitUMoELbbUqJm3W6L2AsMJNZpVekXKmrZIhEjxWjJqvKt3mErKxK+izdP3/F+64Q=="
        },
        "linux-x64-musl": {
          "asset": "sfw-free-musl-linux-x86_64",
          "integrity": "sha512-U4WJeq+/Z634uFvW0+Hvmb/BUutMeiZQ1dwP40/wKMiCDwKGPr+Unl4KqwaG3qaLjkTRJ938sUWQy+/gFeEmDg=="
        },
        "win-x64": {
          "asset": "sfw-free-windows-x86_64.exe",
          "integrity": "sha512-tkZHeaxydBStW6SsCi5S2jLMtdj2UQ/PdZb/ch8W532UjFdZUJD0oygW/YWliK0HQkcyw5GQm2d1iZU0P/yElg=="
        }
      }
    },
    "sfw-enterprise": {
      "notes": [
        "SFW (Socket Firewall) enterprise flavor (private, SocketDev/firewall-release). Same 7-platform set as sfw-free. Enterprise downloads require GITHUB_TOKEN auth (private repo); install-tool.mjs forwards GITHUB_TOKEN automatically when set.",
        "Installed when SOCKET_API_KEY (or SOCKET_API_TOKEN) is set; otherwise the free flavor (sfw-free) is used. The two flavors share a version and install to the same `sfw` binary name."
      ],
      "description": "Socket Firewall (enterprise tier) — package manager command wrapper",
      "version": "1.12.0",
      "repository": "github:SocketDev/firewall-release",
      "binaryName": "sfw",
      "release": "asset",
      "platforms": {
        "darwin-arm64": {
          "asset": "sfw-macos-arm64",
          "integrity": "sha512-G7te2xB1Q+K/k/2Wijbn96eJZUZoNFlDNKURydLBLB69Jkuc1M1lNFbqxiyP8tfOlMIBKWxRwfZyeX9ipPy4Ew=="
        },
        "darwin-x64": {
          "asset": "sfw-macos-x86_64",
          "integrity": "sha512-/ogpJY01pDTEcvDPq09FNxGP5eXu4d+ab2RxT1r4he0ptfCOGOO3rQXfxTFqrOmS+OSz5RZe+4qPupM4nGriMQ=="
        },
        "linux-arm64": {
          "asset": "sfw-linux-arm64",
          "integrity": "sha512-oXhTWx/I/1yZRn0ik3DL5y2/4RZqv/msJpTi6m190jBGg/x7bgqJO4uCOUJe1+iudK3bNGsYB8zs6vIJTLwA7g=="
        },
        "linux-arm64-musl": {
          "asset": "sfw-musl-linux-arm64",
          "integrity": "sha512-VtvO4OkLNO7XW1YwY73WoIZeRp7sMg+LbdeL2CVy5bgysTnuBxKrkkJvW41BsuScVdf7nt/bh5V8ZBAMN993rg=="
        },
        "linux-x64": {
          "asset": "sfw-linux-x86_64",
          "integrity": "sha512-91W90AOLI0RBN6lsPor2wf7wUvV3hzebXf0SM7SEzVPGM76Yjwj2D5E/jtJ8LjNNE7afggUDEtgMvFSTmgnZDg=="
        },
        "linux-x64-musl": {
          "asset": "sfw-musl-linux-x86_64",
          "integrity": "sha512-5CUE3LnXKzRqoT7SmT/yDBtyVyiUqwKtgS11j7qEhb2KJI3kztBuUQwBoOKPxxwpS0X7R/DuANvax7pQ76f4xw=="
        },
        "win-x64": {
          "asset": "sfw-windows-x86_64.exe",
          "integrity": "sha512-GXKV67rN0XTP+2v9VTfzz84N09x9UkEItj2wmcA7pmy5YoLPF/+Z/XkVGoUHzVSTTeivbYicRLAxl8BNkoUZ6w=="
        }
      }
    },
    "zizmor": {
      "description": "GitHub Actions security linter — audits .github/ for workflow-injection / credential-leak patterns.",
      "version": "1.25.2",
      "repository": "github:zizmorcore/zizmor",
      "release": "asset",
      "notes": [
        "Required: CI (blocks merges on medium+ findings)",
        "Installed by the setup-and-install composite; SRI-verified (sha512) per platform"
      ],
      "platforms": {
        "darwin-arm64": {
          "asset": "zizmor-aarch64-apple-darwin.tar.gz",
          "integrity": "sha512-LUPNdfltqkBiFfPSUAWJovrH4kaqOoFQgn1ISEKc6yOmsUD1cYmKvnnsYfDP/Y1KsMua+BKNWJ3B9IMb0D1lpg=="
        },
        "darwin-x64": {
          "asset": "zizmor-x86_64-apple-darwin.tar.gz",
          "integrity": "sha512-M/T9PX+FRG1VvfS34T3aXXJ95DjpnsxcJV767BHYfKhmy/oUecI4v3jIwDBGnDt52oDtZTHx9H0uMVKg9NaNOA=="
        },
        "linux-arm64": {
          "asset": "zizmor-aarch64-unknown-linux-gnu.tar.gz",
          "integrity": "sha512-SBFp8h++QWZEZ5SfkmPxElDUYy5u0JUkgbzlz90gmB3UPbKgOcYqKOn6mY1tha5+RriMmuNtZxtrAiihECMOFA=="
        },
        "linux-x64": {
          "asset": "zizmor-x86_64-unknown-linux-gnu.tar.gz",
          "integrity": "sha512-FSmYWvlOzySHwlI2IkoEQNHfRU/UitumuQJc+umYyYcDr50colg0Bzio74YS19sGH41leMdXu4KJtB5XM45eUg=="
        },
        "win-x64": {
          "asset": "zizmor-x86_64-pc-windows-msvc.zip",
          "integrity": "sha512-OhgPngI8gKygJFKa3VGk5y4S7KUuW5CPyBiI1WvfM58OHd5rUbdillfJeLsLhRbOMFAdigdUeZtNDyR6VPIs1A=="
        }
      }
    },
    "pnpm": {
      "description": "pnpm — the fleet's package manager.",
      "version": "11.8.0",
      "packageManager": "pnpm",
      "repository": "github:pnpm/pnpm",
      "release": "asset",
      "notes": [
        "Required: yes",
        "Bootstrap locally via `corepack enable pnpm` (the version resolves from package.json's packageManager field)",
        "CI downloads + SRI-verifies (sha512) the pinned tarball directly"
      ],
      "platforms": {
        "darwin-arm64": {
          "asset": "pnpm-darwin-arm64.tar.gz",
          "integrity": "sha512-kgYcLu653+Gx7l7qEtM2zMNLBvb96ABcRSkzOrbfvkndb+veMt6lHJK5r3wTfuRYlDb8Lnk/h0wUD6sP3taJ9g=="
        },
        "darwin-x64": {
          "asset": "pnpm-11.8.0.tgz",
          "integrity": "sha512-wfXnxMskHI8XS3Q4UdgvQrgCMkr8iw8Ra5atsVqgZmSUjd42lgo7oQebpbSyndAUATW5S1tfUmNZIknWjlVfJg=="
        },
        "linux-arm64": {
          "asset": "pnpm-linux-arm64.tar.gz",
          "integrity": "sha512-p1IcVUlwYf3OJQYmdHGFr08d1BOSatHEmLJSBSdoNPGqOqfslFHjSqiuZ/3yuQxxypqp8OfnM3ci3Jh7ZEBlSw=="
        },
        "linux-arm64-musl": {
          "asset": "pnpm-linux-arm64-musl.tar.gz",
          "integrity": "sha512-u5Do3diwK7FL5vk+i/x2I4q4ujdZ5gSoLNgmlt1w2C7NOjAZOpDK0CJYM4gDa5BetEwzdNpuN/gaMqzJk6I5NA=="
        },
        "linux-x64": {
          "asset": "pnpm-linux-x64.tar.gz",
          "integrity": "sha512-Sn7hG4Xsq6pmi8TE8lpIkwRzAYzf5qtFk8zSsZWkSJFcmv5FlsrO8UP3lLRI+ppcRNYS10FMCTwXe3Nt66A0Pg=="
        },
        "linux-x64-musl": {
          "asset": "pnpm-linux-x64-musl.tar.gz",
          "integrity": "sha512-5WXlo2yCDmoBIue5iHRK3zNSPVAmzci+5RhuxwUA4hnH9W3TFjDnQHyAzDVnkY878mfTXE35THZeEc1OKYPmag=="
        },
        "win-arm64": {
          "asset": "pnpm-win32-arm64.zip",
          "integrity": "sha512-iv1hJEj9FUiVFae2cmCYjbRK0Xn27Uh+kpglT2LWvQyl4WeIOgs1ouKrptVxk3X3t7DB5vuYKbsmE+9BnoQ4FA=="
        },
        "win-x64": {
          "asset": "pnpm-win32-x64.zip",
          "integrity": "sha512-jyqMgedndbck/xJjXPem5Lw7V0YtDfiUJIB81e/hmnrg3yLKPoyCKO5ILegYkLPIr945IJRcVoJZwjtog8FCqg=="
        }
      }
    }
  }
}