ruby_everywhere 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c87aa5a2416d070a8047b790f28c7230882999b7df4f7f584256ee96852f066
-  data.tar.gz: 6fa25612acf17e6d90b3302a4e7f93a8d5ded79fd8ffb39aec318b908df32bcf
+  metadata.gz: 83b4d5f0135bc80870fdacccaf5014ee478cbaa2bad08541871ab67a6485d3fc
+  data.tar.gz: dd86792cae35b098877012c42ebe0286ada230909a8588c9a4c933c7c8771137
 SHA512:
-  metadata.gz: 69fb1bdb659b8b886d9b602e09e21d8016caf140ac401ee371d4b0eaab2e06f3b342fb7742e2684570b80e71768fb2c5ede34dca3f1d5b9015185b93b176ba59
-  data.tar.gz: 450a804d3bf9765ea664e0728c66df31019e5633393680120ef9ec7ba40def7e69f163b9aaaf6b2d2fcec948e62c5d3821b26bb553924666dfb57b7d1c6b29cd
+  metadata.gz: 97ad2a4b22e6255abcf6e68850ef9c2615ca725bfac46f62db9d7f2423314afdd882088589670cd609e3f9a8da854616b1b7af0015dd29e2bafff587664ff838
+  data.tar.gz: ec09e6586570025a8e02acb4d61f323f841201441341de7aa1cf3cfa621c74d331d1e48794e6e88e87990511e4a215233b990c86cfca11829aa52be0ea82b12a

data/exe/every

@@ -2,5 +2,16 @@
 # frozen_string_literal: true
 
 require "everywhere/cli"
+require "everywhere/ui"
 
-Dry::CLI.new(Everywhere::CLI).call
+begin
+  Dry::CLI.new(Everywhere::CLI).call
+rescue Interrupt
+  # ^C is an answer, not a crash: no backtrace, and the shell's own convention
+  # for "killed by SIGINT".
+  exit 130
+rescue Everywhere::Error => e
+  # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
+  # printed its own line passes straight through here.
+  Everywhere::UI.die!(e.message)
+end

data/exe/rbe

@@ -2,5 +2,16 @@
 # frozen_string_literal: true
 
 require "everywhere/cli"
+require "everywhere/ui"
 
-Dry::CLI.new(Everywhere::CLI).call
+begin
+  Dry::CLI.new(Everywhere::CLI).call
+rescue Interrupt
+  # ^C is an answer, not a crash: no backtrace, and the shell's own convention
+  # for "killed by SIGINT".
+  exit 130
+rescue Everywhere::Error => e
+  # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
+  # printed its own line passes straight through here.
+  Everywhere::UI.die!(e.message)
+end

data/lib/everywhere/agents_guide.rb

@@ -51,7 +51,9 @@ module Everywhere
       path = File.join(template_dir, *parts)
       File.exist?(path) or UI.die!("couldn't find the bundled AGENTS.md template at #{path}; " \
                                    "reinstall ruby_everywhere")
-      File.read(path)
+      # The templates are UTF-8 prose; under LANG=C the gsub below would raise
+      # on them rather than substitute.
+      File.read(path, encoding: "UTF-8").scrub
     end
   end
 end

data/lib/everywhere/blake2b.rb

@@ -68,7 +68,12 @@ module Everywhere
       rescue StandardError
         nil
       end
-      return digest(File.binread(path), 64) unless md
+      # `digest` is one-shot (no incremental update), so the fallback has to hold
+      # the whole artifact in memory — worth warning about on a 300MB .zip.
+      unless md
+        warn_pure_ruby_fallback(path)
+        return digest(File.binread(path), 64)
+      end
 
       File.open(path, "rb") do |io|
         while (chunk = io.read(1 << 20))
@@ -78,6 +83,17 @@ module Everywhere
       md.digest
     end
 
+    # Once per process — signing prehashes the same artifact more than once.
+    def warn_pure_ruby_fallback(path)
+      return if @warned_fallback
+
+      @warned_fallback = true
+      require_relative "ui"
+      mb = (File.size(path) / 1024.0 / 1024.0).round(1)
+      Everywhere::UI.warn("this Ruby's OpenSSL has no BLAKE2b512 — hashing #{mb}MB in pure Ruby " \
+                          "(slow, and the file is read into memory)")
+    end
+
     def compress(h, block, t, last)
       m = block.unpack("Q<16")
       v = h + IV

data/lib/everywhere/boot.rb

@@ -64,15 +64,32 @@ module Everywhere
     def default_app_data
       case RUBY_PLATFORM
       when /darwin/
-        File.join(Dir.home, "Library", "Application Support", config.bundle_id)
+        File.join(home, "Library", "Application Support", config.bundle_id)
       when /mingw|mswin/
-        File.join(ENV.fetch("APPDATA"), config.bundle_id)
+        File.join(app_data_env("APPDATA"), config.bundle_id)
       else
-        File.join(ENV.fetch("XDG_DATA_HOME", File.join(Dir.home, ".local", "share")),
-                  config.bundle_id)
+        # `||`, not ENV.fetch's default: the fallback resolves a home that a
+        # machine setting XDG_DATA_HOME needn't have.
+        File.join(ENV["XDG_DATA_HOME"] || File.join(home, ".local", "share"), config.bundle_id)
       end
     end
 
+    # Only reached in a standalone run — the shell always passes NATIVE_APPDATA.
+    # Dir.home raises when HOME is unset and there's no passwd entry (a
+    # container run with --user), which is a bare ArgumentError otherwise.
+    def home
+      Dir.home
+    rescue ArgumentError
+      raise Error, app_data_hint("no home directory")
+    end
+
+    def app_data_env(key)
+      ENV[key] or raise Error, app_data_hint("#{key} is unset")
+    end
+
+    def app_data_hint(reason) = "can't work out where to keep app data (#{reason}) — " \
+                                "set NATIVE_APPDATA (or HOME / APPDATA)"
+
     def prepare_app_data
       storage = File.join(app_data, "storage")
       FileUtils.mkdir_p(storage)

data/lib/everywhere/builders/android.rb

@@ -32,13 +32,34 @@ module Everywhere
     #   app/src/stamped/res/drawable*/                  native/android/assets/** as drawables
     #   app/src/main/java/com/rubyeverywhere/shell/extensions/   native/android/*.kt + registry
     #
-    # MVP scope is a debug/unsigned-release APK. Keystore signing, AAB and Play
-    # upload hang off the same seam later — see docs/android-plan.md §9.
+    # Signing and the format Play accepts are driven from the environment, not
+    # from everywhere.yml — see SIGNING_ENV.
     class Android
       # Fixed by the template contract: one Gradle module, always :app, so
       # build paths and task names never depend on per-app values.
       GRADLE_MODULE = ":app"
 
+      # What each package format is called in the three places it has a name:
+      # the Gradle verb, the outputs/ subdirectory and the file extension.
+      FORMATS = {
+        apk: { task: "assemble", dir: "apk", extension: "apk" },
+        aab: { task: "bundle", dir: "bundle", extension: "aab" }
+      }.freeze
+
+      # Release signing is read from the environment and handed to Gradle as
+      # environment, never stamped into everywhere.properties: that file lives
+      # in the work dir for the life of the app, and a keystore password written
+      # there outlives the build that needed it. The keystore itself stays where
+      # the machine put it — nothing is copied into the project.
+      SIGNING_ENV = %w[EVERY_ANDROID_KEYSTORE EVERY_ANDROID_KEYSTORE_PASSWORD
+                       EVERY_ANDROID_KEY_ALIAS EVERY_ANDROID_KEY_PASSWORD].freeze
+
+      # The two the keystore can't be used without. EVERY_ANDROID_KEY_PASSWORD
+      # is not among them: a key generated without -keypass shares the store's.
+      REQUIRED_SIGNING_ENV = %w[EVERY_ANDROID_KEYSTORE_PASSWORD EVERY_ANDROID_KEY_ALIAS].freeze
+
+      VERSION_CODE_ENV = "EVERY_ANDROID_VERSION_CODE"
+
       # The Kotlin package the shell's sources live in. NOT the applicationId:
       # the app id is stamped per app, the code's package is frozen, and mixing
       # them up is the classic Android manifest mistake — so anything we
@@ -103,24 +124,25 @@ module Everywhere
         @template_dir = template_dir
       end
 
-      # Build the APK and copy it into dist_dir. `dev` builds the debug variant
+      # Build the app and copy it into dist_dir. `dev` builds the debug variant
       # and relaxes the remote-mode requirement (the dev URL is stamped into a
       # debug asset each run — Android has no SIMCTL_CHILD_* equivalent).
-      # Returns the path of the collected APK.
-      def build!(dist_dir:, dev: false, dev_url: nil)
+      # `format` is :apk (installable) or :aab (what Play accepts). Returns the
+      # path of the collected artifact.
+      def build!(dist_dir:, dev: false, dev_url: nil, format: :apk)
         # The template is resolved before preflight, not after it like iOS:
         # preflight has to settle the icon font, and the bundled font lives in
         # the template. Everything that can fail slowly (a font download) or
         # cheaply (a typo'd icon name) is therefore decided before Gradle — the
         # difference between a 5-second error and one that lands 90 seconds in.
         template = @template_dir ? File.expand_path(@template_dir) : Paths.android_dir!
-        preflight!(dev: dev, template: template)
+        preflight!(dev: dev, format: format, template: template)
         work = stage(template)
         stamp!(work)
         stamp_dev_url!(work, dev_url)
         variant = dev ? "debug" : "release"
-        gradle!(work, variant, dist_dir)
-        collect(work, variant, dist_dir)
+        gradle!(work, variant, format, dist_dir)
+        collect(work, variant, format, dist_dir)
       end
 
       private
@@ -149,13 +171,17 @@ module Everywhere
         UI.step("pointing the shell at #{UI.cyan(dev_url)}")
       end
 
-      def preflight!(dev:, template:)
+      def preflight!(dev:, format:, template:)
         # Config shape first, machine state second: a typo in everywhere.yml is
         # the app author's to fix wherever they are, while "no Android SDK"
         # depends on the machine they happen to be sitting at.
         errors = @config.native_android_errors
         UI.die!("native.android in config/everywhere.yml:\n#{errors.join("\n")}") unless errors.empty?
 
+        check_format!(dev: dev, format: format)
+        @signing = dev ? nil : signing_env!
+        @version_code = version_code
+
         unless dev || @config.remote?
           UI.die!("Android apps are remote mode only for now — set remote.url in config/everywhere.yml " \
                   "(the shell wraps your deployed app; nothing is packaged locally)")
@@ -179,7 +205,10 @@ module Everywhere
         # fix — the analogue of the iOS xcode-select message.
         @sdk_root = AndroidSdk.sdk_root!
         @java_home = AndroidSdk.java_home!
-        AndroidSdk.adb!
+        # adb only matters when something is going to be installed on a device,
+        # so it is a `dev` requirement and not a build one — a headless runner
+        # that builds a release AAB has no reason to carry platform-tools.
+        AndroidSdk.adb! if dev
         # A missing compile SDK surfaces from Gradle as "Failed to find target
         # with hash string android-35", minutes in and after the AGP download.
         AndroidSdk.platform!
@@ -187,6 +216,56 @@ module Everywhere
         resolve_icon_font!(template)
       end
 
+      def check_format!(dev:, format:)
+        unless FORMATS.key?(format)
+          UI.die!("#{format.inspect} isn't an Android package format — :apk (installable) or :aab " \
+                  "(what Google Play accepts)")
+        end
+        return unless format == :aab && dev
+
+        UI.die!("an .aab can't be installed on a device or an emulator — it's an upload format Play " \
+                "re-signs into per-device APKs. `every dev` builds an APK; ask for the bundle when " \
+                "you're publishing")
+      end
+
+      # --- signing ---------------------------------------------------------------
+
+      # The signing environment Gradle is handed, or nil for the unsigned
+      # release the default build still produces. Resolved here rather than left
+      # to the build script so a half-configured keystore fails in seconds with
+      # the missing variable named, instead of as an AGP error two minutes in —
+      # or, worse, as an unsigned APK nobody notices until Play rejects it.
+      def signing_env!
+        keystore = env_value("EVERY_ANDROID_KEYSTORE") or return nil
+
+        missing = REQUIRED_SIGNING_ENV.reject { |name| env_value(name) }
+        unless missing.empty?
+          UI.die!("EVERY_ANDROID_KEYSTORE is set but #{missing.join(" and ")} " \
+                  "#{missing.one? ? "is" : "are"} not — signing needs the keystore, its password " \
+                  "and the alias of the key inside it (EVERY_ANDROID_KEY_PASSWORD falls back to " \
+                  "the keystore password)")
+        end
+
+        path = File.expand_path(keystore)
+        UI.die!("EVERY_ANDROID_KEYSTORE points at #{path}, which isn't a file") unless File.file?(path)
+
+        UI.step("signing the release #{UI.dim("(#{env_value("EVERY_ANDROID_KEY_ALIAS")} in " \
+                                             "#{UI.short_path(path)})")}")
+        { "EVERY_ANDROID_KEYSTORE" => path,
+          "EVERY_ANDROID_KEYSTORE_PASSWORD" => env_value("EVERY_ANDROID_KEYSTORE_PASSWORD"),
+          "EVERY_ANDROID_KEY_ALIAS" => env_value("EVERY_ANDROID_KEY_ALIAS"),
+          "EVERY_ANDROID_KEY_PASSWORD" => env_value("EVERY_ANDROID_KEY_PASSWORD") ||
+            env_value("EVERY_ANDROID_KEYSTORE_PASSWORD") }
+      end
+
+      # An env var that was set to nothing is the same as unset here: CI writes
+      # `EVERY_ANDROID_KEYSTORE: ${{ secrets.KEYSTORE }}` whether or not the
+      # secret exists, and an empty keystore path must not look configured.
+      def env_value(name)
+        value = ENV[name].to_s.strip
+        value.empty? ? nil : value
+      end
+
       # Copy the template into the app's persistent work dir. Merged over
       # whatever is already there, NOT wiped like the iOS stage: Gradle's
       # incremental state (app/build/, .gradle/) lives *inside* this directory,
@@ -248,7 +327,7 @@ module Everywhere
           # belong in config/everywhere.yml.
           everywhere.applicationId=#{properties_value(application_id)}
           everywhere.versionName=#{properties_value(@config.version(target: @target))}
-          everywhere.versionCode=#{version_code}
+          everywhere.versionCode=#{@version_code}
           everywhere.label=#{properties_value(name)}
         PROPERTIES
       end
@@ -257,7 +336,20 @@ module Everywhere
       # deriving it from the version the app already maintains beats asking for
       # a second number nobody remembers to bump. 1.2.3 → 10203, which stays
       # monotonic as long as minor/patch stay under 100.
+      #
+      # EVERY_ANDROID_VERSION_CODE overrides it outright, for the pipeline that
+      # numbers builds rather than versions them (a run number, a commit count).
       def version_code
+        override = env_value(VERSION_CODE_ENV) or return derived_version_code
+
+        unless override.match?(/\A[1-9]\d*\z/)
+          UI.die!("#{VERSION_CODE_ENV}=#{override.inspect} — a versionCode is a positive integer, " \
+                  "and Play only accepts an upload whose code is higher than the last one's")
+        end
+        override.to_i
+      end
+
+      def derived_version_code
         major, minor, patch = @config.version(target: @target).to_s.split(".").map(&:to_i)
         code = ((major || 0) * 10_000) + ((minor || 0) * 100) + (patch || 0)
         [code, 1].max
@@ -796,45 +888,67 @@ module Everywhere
 
       # --- gradle ---------------------------------------------------------------
 
-      def gradle!(work, variant, dist_dir)
-        UI.step("building Android shell #{UI.dim("(Gradle, #{variant}, first run downloads " \
-                                                "Gradle and the Android Gradle Plugin)")}")
+      def gradle!(work, variant, format, dist_dir)
+        UI.step("building Android shell #{UI.dim("(Gradle, #{variant} #{format.to_s.upcase}, first " \
+                                                "run downloads Gradle and the Android Gradle Plugin)")}")
         FileUtils.mkdir_p(dist_dir)
         log = File.join(dist_dir, "android-build.log")
-        task = "#{GRADLE_MODULE}:assemble#{variant.capitalize}"
+        task = "#{GRADLE_MODULE}:#{FORMATS.fetch(format)[:task]}#{variant.capitalize}"
         # -p instead of a chdir: the wrapper finds its own jar from $0, so an
         # absolute gradlew with an explicit project dir works from anywhere
         # (Shellout.run_logged! has no chdir). --console=plain keeps the stream
         # line-oriented for LogFilter whether or not a TTY is attached.
         Shellout.run_logged!(gradle_env,
-                             [File.join(work, "gradlew"), "-p", work, "--console=plain", task],
+                             [gradle_wrapper(work), "-p", work, "--console=plain", task],
                              log: log, filter: LogFilter.for(:gradle))
       end
 
+      # The wrapper Windows can actually execute — the POSIX gradlew is a shell
+      # script there, and cmd.exe won't run it.
+      def gradle_wrapper(work)
+        File.join(work, AndroidSdk.windows? ? "gradlew.bat" : "gradlew")
+      end
+
       # The whole toolchain is handed to Gradle explicitly. ANDROID_HOME is what
       # AGP reads when there's no local.properties — and we never write one, so
       # the stamped project stays clean and Android Studio can resolve its own
       # SDK. GRADLE_USER_HOME redirects the 1.4 GB of Gradle distribution, AGP
       # and Hotwire artifacts out of the gem and into a cache shared by every app.
+      #
+      # The signing variables travel the same way rather than through a file the
+      # build script reads: env is the one channel that reaches the Gradle child
+      # without leaving a password on disk. The resolved values (absolute
+      # keystore path, key password defaulted to the store's) are what's passed,
+      # so the build script never has to repeat the fallback.
       def gradle_env
         { "JAVA_HOME" => @java_home,
           "ANDROID_HOME" => @sdk_root,
           "ANDROID_SDK_ROOT" => @sdk_root,
-          "GRADLE_USER_HOME" => Paths.android_gradle_home }
-      end
-
-      # Copy the APK out of the module's build dir. Release is unsigned until
-      # keystore signing lands (docs/android-plan.md §9), and AGP spells that
-      # variant app-release-unsigned.apk — accept either name so the collect
-      # step doesn't have to be revisited when signing arrives.
-      def collect(work, variant, dist_dir)
-        dir = File.join(work, "app", "build", "outputs", "apk", variant)
-        built = ["app-#{variant}.apk", "app-#{variant}-unsigned.apk"]
-                .map { |file| File.join(dir, file) }
-                .find { |path| File.file?(path) }
-        UI.die!("Gradle reported success but no APK in #{UI.short_path(dir)}") unless built
+          "GRADLE_USER_HOME" => Paths.android_gradle_home,
+          VERSION_CODE_ENV => @version_code.to_s }.merge(@signing || {})
+      end
+
+      # Copy the built artifact out of the module's build dir. An unsigned
+      # release APK is spelled app-release-unsigned.apk by AGP, so both names
+      # are accepted — but only when no keystore was configured: with one set,
+      # the unsigned name means the signingConfig didn't take, and shipping that
+      # silently is how an unsignable APK reaches Play. Bundles have no such
+      # spelling; bundleRelease writes app-release.aab either way.
+      def collect(work, variant, format, dist_dir)
+        spec = FORMATS.fetch(format)
+        kind = spec[:extension].upcase
+        dir = File.join(work, "app", "build", "outputs", spec[:dir], variant)
+        signed = File.join(dir, "app-#{variant}.#{spec[:extension]}")
+        unsigned = File.join(dir, "app-#{variant}-unsigned.#{spec[:extension]}")
+        built = [signed, unsigned].find { |path| File.file?(path) }
+        UI.die!("Gradle reported success but no #{kind} in #{UI.short_path(dir)}") unless built
+
+        if @signing && built == unsigned
+          UI.die!("Gradle wrote #{File.basename(built)} — EVERY_ANDROID_KEYSTORE is set, so the " \
+                  "#{kind} should have been signed. Check the keystore's alias and passwords")
+        end
 
-        dest = File.join(dist_dir, "#{name}.apk")
+        dest = File.join(dist_dir, "#{name}.#{spec[:extension]}")
         FileUtils.rm_f(dest)
         FileUtils.cp(built, dest)
         dest

data/lib/everywhere/builders/desktop.rb

@@ -10,19 +10,24 @@ module Everywhere
     # Resolves where cargo should run for the desktop shell, and stamps a
     # per-app copy of it when the app declares `native.desktop`.
     #
-    # Two paths, deliberately:
+    # EVERY app gets its own staged copy of the shell under
+    # ~/.rubyeverywhere/desktop/<id>; cargo never runs in the template. Cargo
+    # writes Cargo.lock into the package dir and `every build` swaps the app's
+    # icon into icons/icon.png, so compiling the template in place means writing
+    # into the installed gem — Errno::EACCES on a system-wide install, and one
+    # app's branding in the next app's build when two builds share it.
     #
-    #   no native.desktop   the gem's own support/desktop/src-tauri, compiled
-    #                       against the SHARED ~/.rubyeverywhere/shell-target.
-    #                       Identical source for every app, so one warm target
-    #                       dir serves all of them. This is what every app did
-    #                       before extensions existed, and it stays free.
+    # What the two paths differ in is the stamp and the target dir:
     #
-    #   native.desktop      a stamped copy under ~/.rubyeverywhere/desktop/<id>
-    #                       with its own target dir, exactly like the iOS and
-    #                       Android work dirs. Costs one cold Tauri compile
-    #                       (minutes) and a couple of GB, which is why it is not
-    #                       the default.
+    #   no native.desktop   the template verbatim, compiled against the SHARED
+    #                       ~/.rubyeverywhere/shell-target. The source really is
+    #                       identical for every such app, so one warm target dir
+    #                       serves all of them.
+    #
+    #   native.desktop      the app's Rust stamped in, and its own target dir,
+    #                       exactly like the iOS and Android work dirs. Costs one
+    #                       cold Tauri compile (minutes) and a couple of GB,
+    #                       which is why it is not the default.
     #
     # The stamped list, and nothing else:
     #
@@ -59,14 +64,14 @@ module Everywhere
       # (`every dev`, `every build`) don't need to care which path they got.
       def prepare!
         template = @template_dir || Paths.shell_dir!
-        unless @config.native_desktop?
-          return Prepared.new(dir: template, target_dir: Paths.cargo_target_dir, stamped: false)
-        end
+        stamped = @config.native_desktop?
+        preflight! if stamped
 
-        preflight!
         src_tauri = stage(template)
-        stamp!(src_tauri)
-        Prepared.new(dir: src_tauri, target_dir: Paths.desktop_target_dir(bundle_id), stamped: true)
+        stamp!(src_tauri) if stamped
+        Prepared.new(dir: src_tauri,
+                     target_dir: stamped ? Paths.desktop_target_dir(bundle_id) : Paths.cargo_target_dir,
+                     stamped: stamped)
       end
 
       private
@@ -91,6 +96,9 @@ module Everywhere
       #
       # A gem upgrade wipes it: the template's own sources changed, and merging
       # new files over old ones would leave whatever the new template deleted.
+      # Re-copying the template every time is also what un-brands the shell: the
+      # build swaps the app's icon into the staged icons/icon.png, and the
+      # placeholder has to come back on its own when app.icon goes away.
       # `template` points at src-tauri (that's what --shell-dir means), but the
       # whole shell root has to come along: tauri.conf.json's frontendDist is
       # "../splash", a sibling of src-tauri, and generate_context! panics at