199 lines
10 KiB
JavaScript
199 lines
10 KiB
JavaScript
import { cp, lstat, mkdtemp, open, readFile, readdir, realpath, rm, stat, writeFile } from 'node:fs/promises';
|
|
import { basename, dirname, join, relative, resolve, sep } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { createRequire } from 'node:module';
|
|
import { checkLockSync } from './check-lock-sync.mjs';
|
|
import { copyReleaseTree, under } from './copy-release-tree.mjs';
|
|
const [arch = 'x64', libc = 'glibc', ...extra] = process.argv.slice(2);
|
|
if (!['x64', 'arm64'].includes(arch) || !['glibc', 'musl'].includes(libc) || extra.length) {
|
|
throw new Error('Usage: node scripts/prepare-production-runtime.mjs [x64|arm64] [glibc|musl]');
|
|
}
|
|
const root = await realpath(resolve(dirname(fileURLToPath(import.meta.url)), '..'));
|
|
const dist = join(root, 'dist');
|
|
const source = join(dist, 'production');
|
|
const target = join(dist, `production-linux-${arch}-${libc}`);
|
|
if (dirname(target) !== dist || !/^production-linux-(x64|arm64)-(glibc|musl)$/.test(basename(target))) {
|
|
throw new Error('Runtime destination must be a fixed repository dist directory');
|
|
}
|
|
checkLockSync(root);
|
|
for (const directory of [dist, source]) {
|
|
const info = await lstat(directory);
|
|
if (info.isSymbolicLink() || !info.isDirectory() || await realpath(directory) !== directory) {
|
|
throw new Error(`Unsafe build directory: ${directory}`);
|
|
}
|
|
}
|
|
const oldTarget = await lstat(target).catch((error) => {
|
|
if (error.code !== 'ENOENT')
|
|
throw error;
|
|
return null;
|
|
});
|
|
if (oldTarget?.isSymbolicLink())
|
|
throw new Error('Runtime destination cannot be a symbolic link');
|
|
async function requireFile(base, name) {
|
|
const path = join(base, name);
|
|
const real = await realpath(path).catch(() => null);
|
|
if (!real || !under(real, base))
|
|
throw new Error(`Missing, empty or unsafe runtime file: ${name}`);
|
|
const info = await stat(path);
|
|
if (!info.isFile() || info.size === 0)
|
|
throw new Error(`Missing, empty or unsafe runtime file: ${name}`);
|
|
}
|
|
const required = ['start.mjs', 'server.js', '.next/BUILD_ID', 'config/production.env'];
|
|
for (const file of required)
|
|
await requireFile(source, file);
|
|
for (const directory of ['.next/static', 'public']) {
|
|
if (!(await lstat(join(source, directory))).isDirectory())
|
|
throw new Error(`Missing ${directory}`);
|
|
}
|
|
for (const file of ['package.json', 'package-lock.json'])
|
|
await requireFile(root, file);
|
|
const originalLock = JSON.parse(await readFile(join(root, 'package-lock.json'), 'utf8'));
|
|
for (const file of await matchingFiles(join(source, 'node_modules'), /^package\.json$/)) {
|
|
const locked = originalLock.packages[relative(source, dirname(file))];
|
|
if (locked && JSON.parse(await readFile(file, 'utf8')).version !== locked.version) {
|
|
throw new Error(`Traced dependency does not match the root lockfile: ${file}`);
|
|
}
|
|
}
|
|
// npm flat trees and pnpm link farms both resolve through Node; keep next aligned with package-lock.
|
|
const standaloneNext = createRequire(join(source, 'package.json'))('next/package.json').version;
|
|
if (standaloneNext !== originalLock.packages['node_modules/next']?.version) {
|
|
throw new Error(`Standalone next@${standaloneNext} does not match package-lock.json`);
|
|
}
|
|
const npmVersion = spawnSync('npm', ['--version'], { cwd: root, encoding: 'utf8' });
|
|
if (npmVersion.error || npmVersion.status !== 0)
|
|
throw new Error('Cannot read the current npm version');
|
|
const version = npmVersion.stdout.trim();
|
|
const match = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/.exec(version);
|
|
const [major = 0, minor = 0, patch = 0] = match ? match.slice(1).map(Number) : [];
|
|
if (major < 10 || major === 10 && (minor < 9 || minor === 9 && patch < 2)) {
|
|
throw new Error(`npm >=10.9.2 is required for cross-platform installation; found ${version}`);
|
|
}
|
|
// Only this validated, fixed dist destination can be removed; source and host dependencies stay intact.
|
|
const sharpPlatform = `${libc === 'musl' ? 'linuxmusl' : 'linux'}-${arch}`;
|
|
const packages = [
|
|
[`@img/sharp-${sharpPlatform}`, /\.node$/],
|
|
[`@img/sharp-libvips-${sharpPlatform}`, /libvips.*\.so(?:\.\d+)*$/],
|
|
];
|
|
await rm(target, { recursive: true, force: true });
|
|
const filter = async (path) => {
|
|
const name = basename(path);
|
|
if (name.startsWith('.env') || name.endsWith('.local.env') ||
|
|
name.startsWith('._') || name === '.DS_Store' || name.endsWith('.log'))
|
|
return false;
|
|
const scope = basename(dirname(path));
|
|
if (scope === '@next' && name.startsWith('swc-'))
|
|
return false;
|
|
if (scope === '@img' && name.startsWith('sharp-') && name !== 'sharp-wasm32' &&
|
|
!packages.some(([packageName]) => packageName === `@img/${name}`))
|
|
return false;
|
|
// copyReleaseTree rewrites safe in-tree links; reject targets outside the production package / repo.
|
|
if ((await lstat(path)).isSymbolicLink()) {
|
|
const linkTarget = await realpath(path).catch(() => null);
|
|
if (!linkTarget || (!under(linkTarget, source) && !under(linkTarget, root)))
|
|
throw new Error(`Runtime source contains a symbolic link: ${path}`);
|
|
}
|
|
return true;
|
|
};
|
|
// Prefer relocatable in-tree links; materialize any leftover links that still point at the build tree.
|
|
await copyReleaseTree(source, target, { root, filter });
|
|
for (const file of ['package.json', 'package-lock.json'])
|
|
await cp(join(root, file), join(target, file));
|
|
// Preserve Next's traced JS tree. Install only the two platform packages, never the full app dependency graph.
|
|
const nativeDir = await mkdtemp(join(dist, '.production-native-'));
|
|
try {
|
|
const optionalDependencies = {}, records = {};
|
|
for (const [name] of packages) {
|
|
const entry = originalLock.packages[`node_modules/${name}`];
|
|
if (!entry?.version || !entry.resolved || !entry.integrity)
|
|
throw new Error(`Missing locked native package: ${name}`);
|
|
optionalDependencies[name] = entry.version;
|
|
const record = { ...entry, optional: true };
|
|
delete record.dev;
|
|
delete record.devOptional;
|
|
records[`node_modules/${name}`] = record;
|
|
}
|
|
const manifest = { name: 'jgdj-native-runtime', version: '1.0.0', private: true, optionalDependencies };
|
|
await writeFile(join(nativeDir, 'package.json'), JSON.stringify(manifest));
|
|
await writeFile(join(nativeDir, 'package-lock.json'), JSON.stringify({ name: manifest.name,
|
|
version: manifest.version, lockfileVersion: 3, requires: true, packages: { '': manifest, ...records } }));
|
|
console.log(`Installing two locked Linux ${arch}/${libc} native packages with npm ${version}`);
|
|
const install = spawnSync('npm', ['ci', '--omit=dev', '--include=optional', '--ignore-scripts',
|
|
'--no-audit', '--no-fund', '--os=linux', `--cpu=${arch}`, `--libc=${libc}`], { cwd: nativeDir, stdio: 'inherit' });
|
|
if (install.error || install.status !== 0)
|
|
throw new Error(`Native npm ci failed (${install.status ?? install.error?.message})`);
|
|
for (const [name, pattern] of packages) {
|
|
const directory = join(nativeDir, 'node_modules', name);
|
|
const metadata = JSON.parse(await readFile(join(directory, 'package.json'), 'utf8'));
|
|
if (metadata.name !== name || metadata.version !== optionalDependencies[name] ||
|
|
!metadata.os?.includes('linux') || !metadata.cpu?.includes(arch))
|
|
throw new Error(`Incorrect native package: ${name}`);
|
|
const binaries = await matchingFiles(directory, pattern);
|
|
if (!binaries.length)
|
|
throw new Error(`Native runtime binary is missing: ${name}`);
|
|
for (const binary of binaries)
|
|
await verifyELF(binary);
|
|
await cp(directory, join(target, 'node_modules', name), { recursive: true });
|
|
}
|
|
}
|
|
finally {
|
|
await rm(nativeDir, { recursive: true, force: true });
|
|
}
|
|
for (const file of required)
|
|
await requireFile(target, file);
|
|
// npm hoists these to node_modules/*; pnpm keeps them under .pnpm — resolve from next / package root.
|
|
const rootRequire = createRequire(join(target, 'package.json'));
|
|
const nextRequire = createRequire(join(await realpath(join(target, 'node_modules/next')), 'package.json'));
|
|
if (typeof rootRequire('dotenv').parse !== 'function')
|
|
throw new Error('Runtime dotenv is unavailable');
|
|
for (const name of ['sharp', 'detect-libc', 'semver', '@img/colour']) {
|
|
try {
|
|
nextRequire.resolve(name);
|
|
}
|
|
catch {
|
|
throw new Error(`Runtime ${name} is unavailable`);
|
|
}
|
|
}
|
|
for (const [name] of packages)
|
|
await requireFile(target, `node_modules/${name}/package.json`);
|
|
async function matchingFiles(directory, pattern, rootDir = directory) {
|
|
const rootReal = await realpath(rootDir);
|
|
const found = [];
|
|
for (const entry of await readdir(directory, { withFileTypes: true })) {
|
|
const path = join(directory, entry.name);
|
|
if (entry.isSymbolicLink()) {
|
|
const linkTarget = await realpath(path).catch(() => null);
|
|
if (!linkTarget || !under(linkTarget, rootReal))
|
|
continue;
|
|
const info = await stat(path);
|
|
if (info.isDirectory())
|
|
found.push(...await matchingFiles(path, pattern, rootReal));
|
|
else if (info.isFile() && pattern.test(entry.name))
|
|
found.push(path);
|
|
continue;
|
|
}
|
|
if (entry.isDirectory())
|
|
found.push(...await matchingFiles(path, pattern, rootReal));
|
|
else if (entry.isFile() && pattern.test(entry.name))
|
|
found.push(path);
|
|
}
|
|
return found;
|
|
}
|
|
async function verifyELF(path) {
|
|
const file = await open(path, 'r');
|
|
const header = Buffer.alloc(64);
|
|
try {
|
|
await file.read(header, 0, header.length, 0);
|
|
}
|
|
finally {
|
|
await file.close();
|
|
}
|
|
if (!header.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) ||
|
|
header[4] !== 2 || header[5] !== 1 || header.readUInt16LE(18) !== (arch === 'x64' ? 62 : 183)) {
|
|
throw new Error(`Native runtime is not a Linux ${arch} ELF binary: ${path}`);
|
|
}
|
|
}
|
|
// These public target details describe the package; environment values and credentials are never copied here.
|
|
await writeFile(join(target, 'runtime-target.json'), JSON.stringify({ platform: 'linux', arch, libc, packaging: 'standalone' }, null, 2) + '\n');
|
|
console.log(`Linux runtime ready: ${target}`);
|