Source of blob committed

[Et7f3]

Hello akkishore,

First thanks for this project. Do you know where I can find original version of:

https://github.com/akkishore/multissh/blob/090a60d31574088475fad45aeb2d452db41f3405/public/xterm-addon-fit.js https://github.com/akkishore/multissh/blob/090a60d31574088475fad45aeb2d452db41f3405/public/xterm.js https://github.com/akkishore/multissh/blob/090a60d31574088475fad45aeb2d452db41f3405/release/multissh-linux/pty.node (and other version like win/mac) https://github.com/akkishore/multissh/blob/090a60d31574088475fad45aeb2d452db41f3405/release/multissh-linux/xdg-open

Knowing origin of content allow to reduce effort (imagine I find a bug in pty.node I can fix it upstream) make harder to do supply chain attack.

[akkishore]

xterm is at: http://xtermjs.org/ 'pty.node' is generated by nodejs 'node-pty' library (https://www.npmjs.com/package/node-pty) 'xdg-open' is generated by nodejs 'open' library (https://www.npmjs.com/package/open)

[Et7f3]

Re, thanks for those information. I tried to recreate binary blob but it was half a success

$ sha1sum $(find -name pty.node)
ac1b1a6624da18107e661418822930877e3e4936  ./node_modules/node-pty/build/Release/pty.node
2c263ed2eaed9dbc980fab4a99aba8c940238155  ./release/multissh-linux/pty.node
5008df85a5db28fbf1e4d22fef45f2eab494878f  ./release/multissh-win/pty.node
ae7f24ccf5fe27169e5e263d1a78ed0ec48f550e  ./release/multissh-macos/pty.node

most probably due to using another distro (I used nvm 0.39.7 to install node v10.24.1 on ubuntu 20.04 with g++ 9.4.0-1ubuntu1~20.04.2)

When using native node version on focal it is nodejs 10.19.0~dfsg-3ubuntu1.3 It was already EOL upstream but supported by ubuntu.

So quick three questions:

• [ ] I consider to switching to native node feature instead of [pkg that is deprecated](https://github.com/vercel/pkg?tab=readme-ov-file#pkg] it require to use nodejs 21
• [ ] I consider upgrading version used in package.json (some have vulnerabilities)
• [ ] I consider doing a pipeline like this https://github.com/yao-pkg/pkg-fetch/actions/runs/6394053624 to avoid committing blob to git (and better reproducibility)

I can test on linux and mac