107 lines
6 KiB
TypeScript
107 lines
6 KiB
TypeScript
#!/usr/bin/env bun
|
|
// Compiles the storebound CLI into single-file executables for the desktop app's sidecar (Tauri `externalBin`).
|
|
// bun tools/build-sidecars.ts every target
|
|
// bun tools/build-sidecars.ts --host only this machine's target (what `tauri dev` needs)
|
|
// bun tools/build-sidecars.ts --target bun-linux-x64[,bun-windows-x64]
|
|
// Output: apps/desktop/src-tauri/binaries/storebound-<rust target triple>[.exe] (Tauri's sidecar naming; gitignored).
|
|
// macOS outputs are re-signed ad hoc: the signature `bun build --compile` leaves is invalid once the payload is
|
|
// appended, and the kernel kills such a binary on start (exit 137). Release builds re-sign with Developer ID (D5).
|
|
// Every output is scanned for the build machine's home and checkout paths: nothing private may ship.
|
|
import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
|
|
import { homedir, tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
|
|
export const TARGETS: Record<string, string> = {
|
|
'bun-darwin-arm64': 'aarch64-apple-darwin',
|
|
'bun-darwin-x64': 'x86_64-apple-darwin',
|
|
'bun-linux-x64': 'x86_64-unknown-linux-gnu',
|
|
'bun-linux-arm64': 'aarch64-unknown-linux-gnu',
|
|
'bun-windows-x64': 'x86_64-pc-windows-msvc',
|
|
};
|
|
|
|
export const ROOT = join(import.meta.dir, '..');
|
|
/** Modules playwright-core references but the sidecar never loads (Electron apps, the WebDriver BiDi protocol). */
|
|
export const SIDECAR_EXTERNALS = ['electron', 'chromium-bidi'];
|
|
export const OUT_DIR = join(ROOT, 'apps/desktop/src-tauri/binaries');
|
|
|
|
export function hostTarget(): string {
|
|
const os = process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'windows' : 'linux';
|
|
const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
|
|
return `bun-${os}-${arch}`;
|
|
}
|
|
|
|
export const outName = (target: string): string => `storebound-${TARGETS[target]}${target.includes('windows') ? '.exe' : ''}`;
|
|
|
|
/** Home folders of build accounts that name nobody (a CI container runs as root). They are not searched for: "/root"
|
|
* is a substring of the bun runtime itself (root_certs.cpp, ICU's root.res). privacy-scan still checks every home. */
|
|
export const GENERIC_HOME = /^(\/root|\/home\/(runner|ubuntu|build|builder|ci|docker|node|user))\/?$/;
|
|
|
|
/** Paths of this machine that must not appear in a shipped binary. */
|
|
export function privateStrings(home = homedir(), root = ROOT): string[] {
|
|
return [...new Set([GENERIC_HOME.test(home) ? '' : home, root].filter(s => s.length > 4))];
|
|
}
|
|
|
|
export function leaks(file: string, needles = privateStrings()): string[] {
|
|
const buf = readFileSync(file);
|
|
return needles.filter(n => buf.includes(Buffer.from(n)));
|
|
}
|
|
|
|
/** Neutral prefix the checkout path is replaced with in the bundle (bundled packages carry their own paths). */
|
|
export const NEUTRAL_ROOT = '/storebound';
|
|
|
|
/**
|
|
* Stage 1: one JavaScript bundle of the CLI (target bun, platform independent). playwright-core is bundled, so
|
|
* screenshot renders work without playwright in the user's project (it drives the app-managed Chrome for Testing,
|
|
* STOREBOUND_CHROME); its Electron and BiDi loaders are never used and stay out. Bundled CommonJS modules carry their
|
|
* absolute source paths (__dirname, require.resolve): the checkout path becomes NEUTRAL_ROOT, so no build machine
|
|
* path ships. Those paths only matter for features the sidecar never uses (Electron, trace viewer, app icon).
|
|
*/
|
|
export function bundle(): string {
|
|
const dir = mkdtempSync(join(tmpdir(), 'sb-sidecar-'));
|
|
const p = Bun.spawnSync(['bun', 'build', 'cli/index.ts', '--target=bun', ...SIDECAR_EXTERNALS.flatMap(e => ['--external', e]), '--outdir', dir],
|
|
{ cwd: ROOT, stdout: 'pipe', stderr: 'pipe' });
|
|
if (p.exitCode !== 0) throw new Error(`bundle failed\n${p.stderr.toString()}${p.stdout.toString()}`);
|
|
const entry = join(dir, 'index.js');
|
|
writeFileSync(entry, neutralize(readFileSync(entry, 'utf8')));
|
|
return entry;
|
|
}
|
|
|
|
/** The checkout path out of a bundle. `require.resolve("<checkout>/...")` of a bundled file (playwright-core asks
|
|
* for its own package.json, only to know its folder) becomes the plain path string, so it cannot throw at run time. */
|
|
export function neutralize(js: string, root = ROOT): string {
|
|
const esc = root.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
return js.replace(new RegExp(`__require\\.resolve\\(("${esc}[^"]*")\\)`, 'g'), '$1').split(root).join(NEUTRAL_ROOT);
|
|
}
|
|
|
|
let bundled: string | null = null;
|
|
|
|
export async function buildOne(target: string, outDir = OUT_DIR): Promise<string> {
|
|
if (!TARGETS[target]) throw new Error(`unknown target ${target} (${Object.keys(TARGETS).join(', ')})`);
|
|
mkdirSync(outDir, { recursive: true });
|
|
const out = join(outDir, outName(target));
|
|
rmSync(out, { force: true });
|
|
const t = Date.now();
|
|
bundled ??= bundle();
|
|
const p = Bun.spawnSync(['bun', 'build', '--compile', `--target=${target}`, '--minify-syntax', '--minify-whitespace', bundled, '--outfile', out],
|
|
{ cwd: ROOT, stdout: 'pipe', stderr: 'pipe' });
|
|
if (p.exitCode !== 0) throw new Error(`${target}: bun build failed\n${p.stderr.toString()}${p.stdout.toString()}`);
|
|
if (target.startsWith('bun-darwin') && process.platform === 'darwin') {
|
|
const s = Bun.spawnSync(['codesign', '--force', '--sign', '-', out], { stdout: 'pipe', stderr: 'pipe' });
|
|
if (s.exitCode !== 0) throw new Error(`${target}: ad-hoc codesign failed: ${s.stderr.toString()}`);
|
|
}
|
|
const hits = leaks(out);
|
|
if (hits.length) throw new Error(`${target}: ${out} contains private paths (${hits.length}); refusing to keep it`);
|
|
console.log(`sidecar ${target} -> ${out} (${(statSync(out).size / 1e6).toFixed(1)} MB, ${((Date.now() - t) / 1000).toFixed(1)}s)`);
|
|
return out;
|
|
}
|
|
|
|
if (import.meta.main) {
|
|
const argv = process.argv.slice(2);
|
|
const i = argv.indexOf('--target');
|
|
const targets = argv.includes('--host') ? [hostTarget()] : i >= 0 ? (argv[i + 1] ?? '').split(',').filter(Boolean) : Object.keys(TARGETS);
|
|
let failed = 0;
|
|
for (const t of targets) {
|
|
try { await buildOne(t); } catch (e) { failed++; console.error(`sidecar ${t}: ${(e as Error).message}`); }
|
|
}
|
|
if (failed) process.exit(1);
|
|
}
|