mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-10-16 05:00:59 +08:00
Chris Tate
64b2a285d5
* feat(runtime): ship precompiled macOS artifacts - Add a versioned macOS arm64 runtime pack with deterministic feature selection and artifact verification. - Link LLVM helper objects against release-built runtime and vendor inputs without compiling user-machine C. - Wire package publishing, cache validation, documentation, and full-gate coverage for the new path. * fix(runtime): harden precompiled artifact handling * fix(runtime): make precompiled artifacts reproducible * fix(runtime): reject opaque linkers from executable cache * fix(runtime): normalize precompiled archive metadata * fix(runtime): harden precompiled artifact caching * fix(runtime): close executable cache link race * fix(runtime): stage verified pack artifacts * fix(runtime): bracket helper cache inputs * fix(runtime): preserve executable link identity * fix(runtime): trace selected linker dependencies
51 lines
2.0 KiB
JavaScript
51 lines
2.0 KiB
JavaScript
#!/usr/bin/env node
|
|
import { createHash } from "node:crypto";
|
|
import { access, readFile } from "node:fs/promises";
|
|
import { dirname, join } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const root = dirname(dirname(fileURLToPath(import.meta.url)));
|
|
const manifest = JSON.parse(await readFile(join(root, "runtime-pack.json"), "utf8"));
|
|
const packageManifest = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
|
|
if (
|
|
manifest.schema !== "scriptc.runtime-pack.v1" || manifest.format !== 1 ||
|
|
manifest.package !== packageManifest.name || manifest.version !== packageManifest.version
|
|
) throw new Error("runtime pack identity does not match package.json");
|
|
const artifacts = [
|
|
...Object.values(manifest.flavors).flatMap((flavor) =>
|
|
flavor.runtime_units.flatMap((unit) => unit.variants)),
|
|
...manifest.archives,
|
|
];
|
|
|
|
function printableStrings(bytes) {
|
|
const strings = [];
|
|
let start = -1;
|
|
for (let i = 0; i <= bytes.length; i++) {
|
|
const byte = bytes[i];
|
|
if (byte !== undefined && byte >= 0x20 && byte <= 0x7e) {
|
|
if (start === -1) start = i;
|
|
continue;
|
|
}
|
|
if (start !== -1 && i - start >= 4) strings.push(bytes.subarray(start, i).toString("ascii"));
|
|
start = -1;
|
|
}
|
|
return strings;
|
|
}
|
|
|
|
for (const artifact of artifacts) {
|
|
const path = join(root, artifact.path);
|
|
const bytes = await readFile(path);
|
|
const digest = createHash("sha256").update(bytes).digest("hex");
|
|
if (bytes.length !== artifact.size || digest !== artifact.sha256) {
|
|
throw new Error(`runtime pack hash mismatch: ${artifact.path}`);
|
|
}
|
|
const checkoutPath = printableStrings(bytes).find((value) =>
|
|
value.startsWith("/") && value.includes("/packages/runtime/")
|
|
);
|
|
if (checkoutPath !== undefined) {
|
|
throw new Error(`runtime pack contains an absolute source path in ${artifact.path}: ${checkoutPath}`);
|
|
}
|
|
}
|
|
for (const license of manifest.licenses) await access(join(root, license.path));
|
|
process.stdout.write(`verified ${manifest.package}@${manifest.version}: ${artifacts.length} artifacts\n`);
|