ocran 1.4.6 → 1.5.0

data/lib/ocran/wasm_compatibility.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+require_relative "compatibility_scan"
+
+module Ocran
+  # Whether a program is likely to run in the browser on ruby.wasm, CRuby
+  # compiled to WebAssembly (--wasm).
+  #
+  # ruby.wasm is CRuby with its whole standard library, so the language is
+  # not the problem; the platform is. WASI has no threads, no processes and
+  # no sockets, the browser has no standard input, and a blocking call
+  # freezes the page. Gems reach the module only through a Gemfile, which
+  # rbwasm packs, cross-compiling C extensions for WASI where it can.
+  #
+  # All of it fails at run time, when the program gets there, so what is
+  # found here is reported as warnings: a program that never takes the path
+  # works fine.
+  class RubyWasmCompatibility < CompatibilityScan
+    # Libraries that load, but whose point is something the browser does not
+    # offer.
+    UNAVAILABLE = {
+      "socket" => "WebAssembly in the browser has no sockets; talk to servers with fetch through the js gem",
+      "net/http" => "WebAssembly in the browser has no sockets; use fetch through the js gem (JS.global.fetch(url).await)",
+      "net/https" => "WebAssembly in the browser has no sockets; use fetch through the js gem",
+      "open-uri" => "WebAssembly in the browser has no sockets; use fetch through the js gem",
+      "open3" => "WebAssembly has no processes to run",
+      "pty" => "WebAssembly has no processes or terminals",
+      "io/console" => "the browser has no console to control",
+      "readline" => "the browser has no terminal input",
+      "reline" => "the browser has no terminal input",
+    }.freeze
+
+    PROCESS_CALLS = %i[system spawn exec fork].freeze
+
+    # bundle: the Gem::Specifications of the application's Gemfile.lock, as
+    #         Bundler resolves them (so a gem installed from a path is among
+    #         them), or nil when it has no Gemfile
+    def initialize(script, bundle: nil, project_dirs: nil)
+      super(script, project_dirs: project_dirs)
+      @bundle = bundle
+    end
+
+    def target = "ruby.wasm"
+
+    private
+
+    def feature_problem(feature)
+      reason = UNAVAILABLE[feature] or return nil
+      [:warning, reason]
+    end
+
+    # The whole standard library is in ruby.wasm.
+    def provided_feature?(feature)
+      return true if stdlib_feature?(feature)
+
+      spec = find_gem(feature)
+      spec&.default_gem? || false
+    end
+
+    def missing_stdlib_message(_name) = nil
+
+    # The bundle's own gems first: a gem Bundler installs from a path or a
+    # git checkout is not among the installed gems.
+    def find_gem(feature)
+      (@bundle || []).find { |spec| spec.full_require_paths.any? { |dir| File.file?(File.join(dir, "#{feature}.rb")) } } ||
+        super
+    end
+
+    def gem_problem(gem)
+      return nil if gem.stdlib
+
+      if @bundle.nil?
+        [:error, "the application has no Gemfile, and ruby.wasm only contains the gems a Gemfile lists"]
+      elsif @bundle.none? { |spec| spec.name == gem.name }
+        [:error, "not in the application's Gemfile.lock, and ruby.wasm only contains the gems it lists"]
+      elsif gem.native
+        [:warning, "has a C extension, which rbwasm cross-compiles for WASI; extensions that link system " \
+                   "libraries (libxml2, sqlite, openssl, ...) usually fail to build"]
+      end
+    end
+
+    def check_call(node, name, args, receiver, kernel)
+      case name
+      when *PROCESS_CALLS
+        if kernel || constant?(receiver, :Process)
+          flag(:warning, node, "#{name}: WebAssembly has no processes to run")
+        end
+      when :popen
+        flag(:warning, node, "IO.popen: WebAssembly has no processes to run") if constant?(receiver, :IO)
+      when :new, :start, :fork
+        if constant?(receiver, :Thread)
+          flag(:warning, node, "Thread.#{name}: ruby.wasm has no threads (WASI provides none); " \
+                               "use Fiber, or JS promises with #await")
+        end
+      when :gets, :readline, :readlines
+        if kernel || constant?(receiver, :STDIN)
+          flag(:warning, node, "#{name}: the browser has no standard input; read from the page through the js gem")
+        end
+      when :sleep
+        if kernel && !args.empty?
+          flag(:warning, node, "sleep blocks the browser's only thread and freezes the page while it waits")
+        end
+      when :trap
+        flag(:warning, node, "trap: there are no signals in the browser") if kernel || constant?(receiver, :Signal)
+      end
+    end
+
+    def check_global(node)
+      return unless node.name == :$stdin
+
+      flag(:warning, node, "$stdin: the browser has no standard input")
+    end
+
+    def check_xstring(node)
+      flag(:warning, node, "backticks: WebAssembly has no processes to run")
+    end
+  end
+
+  # Whether a program is likely to run in the browser on PicoRuby
+  # (--wasm=picoruby), the mruby-based Ruby for microcontrollers and
+  # WebAssembly.
+  #
+  # PicoRuby implements the core language but not CRuby's standard library
+  # or RubyGems: `require` finds only the libraries compiled into the
+  # runtime and files on its own virtual file system, which in the browser
+  # holds nothing of the application. OCRAN therefore bundles the
+  # program's own files into one script, and anything else it requires
+  # has to be one of PicoRuby's built-in libraries.
+  class PicoRubyCompatibility < CompatibilityScan
+    # Libraries compiled into @picoruby/wasm-wasi, by require name: each
+    # picoruby-<name> gem in build_config/picoruby-wasm.rb and its stdlib
+    # gembox registers as <name>. PicoRuby's require answers nothing else
+    # from the runtime - not even `require "enumerator"` - while the mruby
+    # core gems (String/Array/Hash extensions, Math, IO, Dir, Task, eval,
+    # ObjectSpace) are loaded from the start and need no require at all.
+    FEATURES = %w[
+      js json yaml base64 base16 rng marshal data
+      indexeddb funicular markdown drb sqlite3 dfu
+    ].freeze
+
+    def target = "PicoRuby"
+
+    private
+
+    def provided_feature?(feature) = FEATURES.include?(feature)
+
+    def gem_problem(gem)
+      if gem.stdlib
+        [:error, "Ruby standard library that PicoRuby does not have"]
+      else
+        [:error, "PicoRuby cannot load RubyGems gems; only its built-in libraries (#{FEATURES.first(8).join(", ")}, ...)"]
+      end
+    end
+
+    def missing_stdlib_message(name)
+      "require #{name.inspect}: part of CRuby's standard library, which PicoRuby does not have"
+    end
+
+    def dynamic_require_message(name)
+      "#{name} with a computed name: OCRAN bundles the program's files ahead of time, so the name must be a string literal"
+    end
+
+    def check_call(node, name, args, receiver, kernel)
+      case name
+      when :system, :spawn, :exec, :fork
+        flag(:error, node, "#{name}: there are no processes in the browser") if kernel || constant?(receiver, :Process)
+      when :new, :start
+        if constant?(receiver, :Thread)
+          flag(:error, node, "Thread.#{name}: PicoRuby has no Thread; use Task, its cooperative tasks")
+        end
+      when :autoload
+        flag(:error, node, "autoload is not supported by PicoRuby; require the file instead") if kernel || receiver
+      when :refine, :using
+        if receiver.nil? && args.size == 1 && (node.block || name == :using)
+          flag(:error, node, "refinements (refine / using) are not supported by PicoRuby")
+        end
+      when :load
+        flag(:error, node, "load: the application's files are not on PicoRuby's file system in the browser") if kernel && !args.empty?
+      when :gets, :readline
+        flag(:warning, node, "#{name}: the browser has no standard input") if kernel || constant?(receiver, :STDIN)
+      when :force_encoding, :encode
+        flag(:warning, node, "#{name}: PicoRuby strings are UTF-8 only, without CRuby's encodings")
+      end
+    end
+
+    def check_constant(node)
+      case node.name
+      when :Ractor
+        flag(:error, node, "Ractor is not supported by PicoRuby")
+      when :Encoding
+        flag(:warning, node, "Encoding: PicoRuby strings are UTF-8 only, without CRuby's encodings")
+      end
+    end
+
+    def check_xstring(node)
+      flag(:error, node, "backticks: there are no processes in the browser")
+    end
+  end
+end

data/lib/ocran/windows_command_escaping.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
+require "pathname"
+require_relative "build_constants"
 
 module Ocran
   module WindowsCommandEscaping
+    # The extraction root placeholder (see BuildConstants) at the start of a
+    # packed path, with either separator.
+    EXTRACT_ROOT_PREFIX = %r{#{Regexp.escape(BuildConstants::EXTRACT_ROOT.to_s)}[/\\]}
+
     module_function
 
     def escape_double_quotes(s)
@@ -11,5 +17,20 @@ module Ocran
     def quote_and_escape(s)
       "\"#{escape_double_quotes(s)}\""
     end
+
+    # Doubles percent signs so that cmd.exe does not expand text between
+    # them as a variable reference when the string is part of a batch file.
+    def escape_percent(s)
+      s.to_s.gsub("%", "%%")
+    end
+
+    # Renders a build-time value for a batch file, for use inside double
+    # quotes: percent signs are escaped so cmd.exe takes the value literally,
+    # then the extraction root placeholder becomes +root+, a batch
+    # expression for the application directory that ends in a backslash
+    # (e.g. "%~dp0").
+    def batch_value(s, root)
+      escape_percent(s).gsub(EXTRACT_ROOT_PREFIX) { root }
+    end
   end
 end

data/lib/ocran/zip_payload_builder.rb

@@ -43,10 +43,11 @@ module Ocran
     # Uncompressed size of everything packed, for the build summary.
     attr_reader :data_size
 
-    def initialize(path, cosmo_ruby:, chdir_before: false, debug_mode: false)
+    def initialize(path, cosmo_ruby:, chdir_before: false, chdir_exe_dir: false, debug_mode: false)
       @path = Pathname(path)
       @cosmo_ruby = Pathname(cosmo_ruby)
       @chdir_before = chdir_before
+      @chdir_exe_dir = chdir_exe_dir
       @debug_mode = debug_mode
       @entries = []
       @names = {}
@@ -200,15 +201,23 @@ module Ocran
     # here: the application lives inside the archive and zipos cannot be a
     # working directory. The directory holding the executable is the
     # closest equivalent, and the one an application that keeps data next
-    # to itself actually wants.
+    # to itself actually wants. That is exactly what --chdir-exe-dir asks
+    # for, so both options do the same in this mode.
     def chdir_source
-      return "" unless @chdir_before
-
-      <<~RUBY.chomp
-        # --chdir-first: the archive cannot be a working directory, so use
-        # the directory the executable was started from.
-        Dir.chdir(File.dirname(executable))
-      RUBY
+      if @chdir_exe_dir
+        <<~RUBY.chomp
+          # --chdir-exe-dir: start in the directory holding the executable.
+          Dir.chdir(File.dirname(executable))
+        RUBY
+      elsif @chdir_before
+        <<~RUBY.chomp
+          # --chdir-first: the archive cannot be a working directory, so use
+          # the directory the executable was started from.
+          Dir.chdir(File.dirname(executable))
+        RUBY
+      else
+        ""
+      end
     end
 
     # Environment variables other than the load-path ones, exported as is.

data/lib/ocran/zip_writer.rb

@@ -41,6 +41,11 @@ module Ocran
     # Markers of the ZIP64 format extensions. OCRAN never writes them; an
     # input archive that uses them is rejected rather than corrupted.
     ZIP64_EOCD_LOCATOR_SIGNATURE = "PK\x06\x07".b
+    ZIP64_EOCD_LOCATOR_SIZE = 20
+
+    # Limits of the format without ZIP64.
+    MAX_ENTRIES = 0xffff
+    MAX_OFFSET = 0xffffffff
 
     CENTRAL_SIGNATURE = "PK\x01\x02".b
     LOCAL_SIGNATURE = "PK\x03\x04".b
@@ -87,6 +92,12 @@ module Ocran
 
         (data || File.binread(source)).b
       end
+
+      def content_size
+        return 0 if directory?
+
+        data ? data.bytesize : File.size(source)
+      end
     end
 
     module_function
@@ -115,6 +126,7 @@ module Ocran
         end
 
         entries = with_parent_directories(entries, existing)
+        check_limits(eocd, central, entries)
 
         before = io.size
         io.truncate(eocd[:cd_offset])
@@ -147,10 +159,31 @@ module Ocran
         }
         missing = parents.reject { |name| seen[name] }
         missing.each { |name| seen[name] = true }
-        missing.map { |name| Entry.new(name: name) } << entry
+        # Dated like the entry, so that packing stays reproducible.
+        missing.map { |name| Entry.new(name: name, mtime: entry.mtime) } << entry
       }
     end
 
+    # Raises when the archive would outgrow the format without ZIP64 -
+    # before anything is written, so that a refused append leaves the file
+    # as it was. The size is an upper bound: an entry is never stored larger
+    # than its content (see compress).
+    def check_limits(eocd, central, entries)
+      total_entries = eocd[:total_entries] + entries.size
+      if total_entries > MAX_ENTRIES
+        raise "too many ZIP entries (#{total_entries}); OCRAN does not write ZIP64 archives"
+      end
+
+      size = eocd[:cd_offset] + central.bytesize + EOCD_SIZE
+      entries.each do |entry|
+        name = entry.name.bytesize
+        size += 30 + name + 46 + name + entry.content_size
+      end
+      if size > MAX_OFFSET
+        raise "the packaged archive would exceed 4 GiB; OCRAN does not write ZIP64 archives"
+      end
+    end
+
     # Locates and decodes the end-of-central-directory record. The record
     # is searched for from the end of the file because a ZIP archive is
     # identified by its tail, which is what allows one to be appended to an
@@ -167,10 +200,6 @@ module Ocran
               "it cannot be a cosmopolitan APE with an embedded ZIP store"
       end
 
-      if tail.rindex(ZIP64_EOCD_LOCATOR_SIGNATURE)
-        raise "#{path} uses the ZIP64 format extensions, which OCRAN cannot append to"
-      end
-
       _signature, _disk, _cd_disk, _disk_entries, total_entries, cd_size, cd_offset, comment_length =
         tail.byteslice(offset, EOCD_SIZE).unpack("a4vvvvVVv")
 
@@ -179,6 +208,14 @@ module Ocran
         raise "#{path} has trailing data after its ZIP archive; OCRAN cannot append to it"
       end
 
+      # A ZIP64 archive has its end-of-central-directory locator right
+      # before this record. Only that position counts: the same four bytes
+      # anywhere else in the tail are file data or names.
+      locator_offset = offset - ZIP64_EOCD_LOCATOR_SIZE
+      if locator_offset >= 0 && tail.byteslice(locator_offset, 4) == ZIP64_EOCD_LOCATOR_SIGNATURE
+        raise "#{path} uses the ZIP64 format extensions, which OCRAN cannot append to"
+      end
+
       { cd_offset: cd_offset, cd_size: cd_size, total_entries: total_entries }
     end
 
@@ -264,10 +301,10 @@ module Ocran
     end
 
     def end_of_central_directory(total_entries, cd_size, cd_offset)
-      if total_entries > 0xffff
+      if total_entries > MAX_ENTRIES
         raise "too many ZIP entries (#{total_entries}); OCRAN does not write ZIP64 archives"
       end
-      if cd_offset + cd_size > 0xffffffff
+      if cd_offset + cd_size > MAX_OFFSET
         raise "the packaged archive would exceed 4 GiB; OCRAN does not write ZIP64 archives"
       end
 
@@ -276,9 +313,11 @@ module Ocran
     end
 
     # MS-DOS packed time and date. The format has two-second resolution and
-    # starts in 1980, so earlier timestamps are clamped.
+    # starts in 1980, so earlier timestamps are clamped. It has no time zone:
+    # file times are written as local time, as zip tools do, and a UTC time
+    # as given, so that a fixed time packs to the same bytes everywhere.
     def dos_timestamp(time)
-      time = time.getlocal
+      time = time.getlocal unless time.utc? || time.utc_offset.zero?
       year = [time.year, 1980].max
       [(time.hour << 11) | (time.min << 5) | (time.sec / 2),
        ((year - 1980) << 9) | (time.month << 5) | time.day]

data/src/Makefile

@@ -8,6 +8,7 @@ UNAME           := $(shell uname -s 2>/dev/null || echo Windows)
 IS_POSIX        := $(filter $(UNAME),Linux Darwin)
 
 CC              := gcc
+WINDRES         ?= windres
 CFLAGS          := -Wall -O2 -DWITH_LZMA -Ilzma
 LDFLAGS         := -s
 
@@ -21,6 +22,9 @@ ifneq ($(IS_POSIX),)
   RESOURCE_OBJ    :=
 else
   EXEEXT          := .exe
+  # No build time in the PE header, so that the stubs (and the platform
+  # gem that ships them) build reproducibly.
+  LDFLAGS         += -Wl,--no-insert-timestamp
   LDLIBS          := -lbcrypt
   GUI_LDFLAGS     := -mwindows
   STUB_CFLAGS     := $(CFLAGS) -D_CONSOLE
@@ -36,7 +40,7 @@ BINARIES        := $(addsuffix $(EXEEXT), $(PROG_NAMES))
 LZMA_SRCS       := lzma/LzmaDec.c
 LZMA_OBJS       := $(LZMA_SRCS:.c=.o)
 
-COMMON_SRCS     := $(SYSTEM_UTILS_SRC) inst_dir.c script_info.c unpack.c
+COMMON_SRCS     := $(SYSTEM_UTILS_SRC) path_utils.c inst_dir.c script_info.c unpack.c
 COMMON_OBJS     := $(COMMON_SRCS:.c=.o) $(LZMA_OBJS) $(RESOURCE_OBJ)
 
 VARIANT_SRCS    := stub.c error.c
@@ -46,6 +50,18 @@ WINDOW_OBJS     := $(VARIANT_SRCS:.c=_window.o)
 .PHONY: all clean install
 all: $(BINARIES)
 
+# Header dependencies: every object depends on every header it could
+# include. Coarse, but it needs no compiler support (gcc, mingw and cosmocc
+# all build from this Makefile), leaves no generated files behind, and
+# cannot go stale as includes change. Rebuilding everything takes seconds.
+HEADERS         := $(wildcard *.h)
+LZMA_HEADERS    := $(wildcard lzma/*.h)
+
+$(filter-out $(LZMA_OBJS) $(RESOURCE_OBJ), $(COMMON_OBJS)) \
+$(CONSOLE_OBJS) $(WINDOW_OBJS): $(HEADERS) $(LZMA_HEADERS)
+
+$(LZMA_OBJS): $(LZMA_HEADERS)
+
 %.o: %.c
 	$(CC) $(CFLAGS) -c $< -o $@
 
@@ -57,7 +73,7 @@ all: $(BINARIES)
 
 ifeq ($(IS_POSIX),)
 stub.res: stub.rc
-	windres -i stub.rc -O coff -o stub.res
+	$(WINDRES) -i stub.rc -O coff -o stub.res
 endif
 
 stub$(EXEEXT): $(COMMON_OBJS) $(CONSOLE_OBJS)

data/src/Makefile.mswin

@@ -0,0 +1,65 @@
+# NMAKE makefile for building the Windows stubs with Microsoft Visual C++
+# (for mswin Ruby, which has no MinGW/MSYS2 toolchain). Run it from a
+# Visual Studio developer prompt (vcvars64.bat), in this directory:
+#
+#   nmake -f Makefile.mswin [install|clean]
+#
+# The stubs link the C runtime statically (/MT): they run before anything
+# is extracted, so they must not depend on vcruntime140.dll themselves.
+
+CC              = cl
+RC              = rc
+CFLAGS          = -nologo -W3 -O2 -MT -DWITH_LZMA -D_CRT_SECURE_NO_WARNINGS -Ilzma
+LDFLAGS         = -nologo -release -manifest:no
+LDLIBS          = bcrypt.lib shell32.lib user32.lib advapi32.lib
+
+BINDIR          = ..\share\ocran
+
+COMMON_OBJS     = system_utils.obj path_utils.obj inst_dir.obj script_info.obj \
+                  unpack.obj lzma\LzmaDec.obj stub.res
+CONSOLE_OBJS    = stub_console.obj error_console.obj
+WINDOW_OBJS     = stub_window.obj error_window.obj
+
+all: stub.exe stubw.exe
+
+# Coarse header dependencies, as in Makefile
+HEADERS         = error.h inst_dir.h script_info.h system_utils.h unpack.h \
+                  lzma\LzmaDec.h lzma\7zTypes.h lzma\Compiler.h
+
+.c.obj:
+	$(CC) $(CFLAGS) -c $< -Fo$@
+
+lzma\LzmaDec.obj: lzma\LzmaDec.c $(HEADERS)
+	$(CC) $(CFLAGS) -c lzma\LzmaDec.c -Fo$@
+
+system_utils.obj path_utils.obj inst_dir.obj script_info.obj unpack.obj: $(HEADERS)
+
+stub_console.obj: stub.c $(HEADERS)
+	$(CC) $(CFLAGS) -D_CONSOLE -c stub.c -Fo$@
+
+error_console.obj: error.c $(HEADERS)
+	$(CC) $(CFLAGS) -D_CONSOLE -c error.c -Fo$@
+
+stub_window.obj: stub.c $(HEADERS)
+	$(CC) $(CFLAGS) -c stub.c -Fo$@
+
+error_window.obj: error.c $(HEADERS)
+	$(CC) $(CFLAGS) -c error.c -Fo$@
+
+stub.res: stub.rc stub.manifest vit-ruby.ico
+	$(RC) -nologo -fo stub.res stub.rc
+
+stub.exe: $(COMMON_OBJS) $(CONSOLE_OBJS)
+	link $(LDFLAGS) -subsystem:console -out:$@ $** $(LDLIBS)
+
+# -mwindows equivalent: GUI subsystem, but keep main() as the entry point
+stubw.exe: $(COMMON_OBJS) $(WINDOW_OBJS)
+	link $(LDFLAGS) -subsystem:windows -entry:mainCRTStartup -out:$@ $** $(LDLIBS)
+
+install: all
+	if not exist $(BINDIR) mkdir $(BINDIR)
+	copy /y stub.exe $(BINDIR)\stub.exe >nul
+	copy /y stubw.exe $(BINDIR)\stubw.exe >nul
+
+clean:
+	-del /q stub.exe stubw.exe *.obj lzma\*.obj stub.res 2>nul

data/src/inst_dir.c

@@ -99,14 +99,17 @@ const char *CreateInstDir(bool is_extract_to_exe_dir)
     }
 
     /* Normalize 8.3 short names (e.g. a TEMP under C:\Users\RUNNER~1) so all
-       paths derived from the extraction dir use one consistent spelling. */
+       paths derived from the extraction dir use one consistent spelling.
+       The directory exists by now: should that fail, keep the spelling at
+       hand, so that the directory is still known and gets deleted. */
     char *long_dir = ToLongPath(inst_dir);
-    free(inst_dir);
-    if (!long_dir) {
-        return NULL;
+    if (long_dir) {
+        free(inst_dir);
+        InstDir = long_dir;
+    } else {
+        APP_ERROR("Failed to normalize the extraction directory path");
+        InstDir = inst_dir;
     }
-
-    InstDir = long_dir;
     return InstDir;
 }
 
@@ -310,6 +313,25 @@ cleanup:
 }
 
 #ifndef _WIN32
+/* Whether a symlink target names a sibling of the link: a single clean
+   path segment. That is all the packer emits (shared library aliases like
+   libruby.so -> libruby.so.3.4.1 in bin), and it keeps every link, and
+   every path running through one, inside the installation directory. An
+   absolute target, or one climbing out with "..", would let the files
+   extracted after it land anywhere. */
+static bool is_sibling_name(const char *name)
+{
+    if (!IsCleanRelativePath(name)) {
+        return false;
+    }
+    for (const char *p = name; *p; p++) {
+        if (is_path_separator(*p)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 bool CreateSymlinkUnderInstDir(const char *rel_link_path, const char *target)
 {
     if (!IsInstDirSet()) {
@@ -327,6 +349,12 @@ bool CreateSymlinkUnderInstDir(const char *rel_link_path, const char *target)
         return false;
     }
 
+    if (!is_sibling_name(target)) {
+        APP_ERROR("symlink target '%s' of '%s' is not a file name in the same "
+                  "directory", target, rel_link_path);
+        return false;
+    }
+
     char *link_path = ExpandInstDirPath(rel_link_path);
     if (!link_path) {
         return false;