@agoric/xsnap 0.14.3-dev-49dfe9b.0.49dfe9b → 0.14.3-dev-4cac2f2.0.4cac2f2

package/README.md

@@ -45,10 +45,11 @@ instead of compiling native sources locally.
 
 Optional environment overrides:
 
-- `XSNAP_BINARY_VERSION` (default: package version)
 - `XSNAP_BINARY_REPO` (default: `Agoric/xsnap-worker-binaries`)
 - `XSNAP_BINARY_BASE_URL` (advanced override)
-- `XSNAP_BINARY_MANIFEST_SHA256` (required trust anchor for unpinned versions)
+- `XSNAP_BINARY_VERSION` (default: package `build.env`, then package version)
+- `XSNAP_BINARY_MANIFEST_SHA256` (default: package `build.env` manifest hash;
+  required trust anchor when overriding `XSNAP_BINARY_VERSION`)
 - `XSNAP_CACHE_DIR` (advanced override for cached downloads)
 
 Some time later, possibly on a different computer…

package/build.env

@@ -0,0 +1,8 @@
+# Bump this as needed for a different prebuilt binary release.
+XSNAP_BINARY_VERSION=0.14.2
+XSNAP_BINARY_MANIFEST_HASH=377030e37b10554e73d0aff655639051d33281c9e17e7da98275fb9efcaae6f2
+XSNAP_PACKAGE=@agoric/xsnap
+MODDABLE_URL=https://github.com/agoric-labs/moddable.git
+MODDABLE_COMMIT_HASH=f6c5951fc055e4ca592b9166b9ae3cbb9cca6bf0
+XSNAP_NATIVE_URL=https://github.com/agoric-labs/xsnap-pub
+XSNAP_NATIVE_COMMIT_HASH=105bc6862050695b1723fa76df91564fe8111a37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/xsnap",
-  "version": "0.14.3-dev-49dfe9b.0.49dfe9b",
+  "version": "0.14.3-dev-4cac2f2.0.4cac2f2",
   "description": "Snapshotting VM worker based on Moddable's XS Javascript engine",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     "repl": "node src/xsrepl.js",
     "install:prebuilt": "node src/install-prebuilt.js",
     "build": "yarn install:prebuilt",
-    "check-version": "/bin/sh -c 'if test \"${npm_package_version}\" != \"$(./scripts/get_xsnap_version.sh)\"; then echo \"xsnap version mismatch; expected '${npm_package_version}'\"; exit 1; fi'",
+    "check-version": "/bin/sh -c 'expected=\"$(./scripts/get_expected_xsnap_binary_version.sh)\"; actual=\"$(./scripts/get_xsnap_version.sh)\"; if test \"$expected\" != \"$actual\"; then echo \"xsnap version mismatch; expected $expected\"; exit 1; fi'",
     "postinstall": "npm run install:prebuilt",
     "clean": "rm -rf xsnap-native/xsnap/build",
     "lint": "yarn run -T run-s --continue-on-error 'lint:*'",
@@ -30,7 +30,7 @@
     "test:xs": "exit 0"
   },
   "dependencies": {
-    "@agoric/xsnap-lockdown": "0.14.1-dev-49dfe9b.0.49dfe9b",
+    "@agoric/xsnap-lockdown": "0.14.1-dev-4cac2f2.0.4cac2f2",
     "@endo/bundle-source": "^4.3.2",
     "@endo/errors": "^1.3.1",
     "@endo/eventual-send": "^1.5.0",
@@ -42,7 +42,7 @@
     "tmp": "^0.2.1"
   },
   "devDependencies": {
-    "@agoric/internal": "0.3.3-dev-49dfe9b.0.49dfe9b",
+    "@agoric/internal": "0.3.3-dev-4cac2f2.0.4cac2f2",
     "@endo/base64": "^1.1.1",
     "@endo/nat": "^5.2.0",
     "ava": "^8.0.1",
@@ -53,6 +53,7 @@
   "files": [
     "LICENSE*",
     "api.js",
+    "build.env",
     "scripts/**",
     "src/**"
   ],
@@ -65,5 +66,5 @@
   "engines": {
     "node": "^22.11 || ^24.14"
   },
-  "gitHead": "49dfe9b1a1241d639c7afb2a7e429dab374bf73e"
+  "gitHead": "4cac2f2827c82d40fbf65afaaa987face9be50c6"
 }

package/scripts/get_expected_xsnap_binary_version.sh

@@ -0,0 +1,7 @@
+#! /bin/bash
+set -ueo pipefail
+
+# shellcheck source=/dev/null
+source "$(dirname -- "${BASH_SOURCE[0]}")/../build.env"
+
+echo "$XSNAP_BINARY_VERSION"

package/src/build.js

@@ -7,7 +7,6 @@ import osTop from 'node:os';
 
 /**
  * @import {ChildProcess} from 'node:child_process';
- * @import {promises} from 'node:fs';
  */
 
 const { freeze } = Object;
@@ -40,7 +39,7 @@ const ModdableSDK = {
  *
  * @param {string} command
  * @param {{
- *   spawn: typeof import('node:child_process').spawn,
+ *   spawn: typeof childProcessTop.spawn,
  * }} io
  */
 function makeCLI(command, { spawn }) {
@@ -114,21 +113,35 @@ const SOURCE_STAMP_FILE = '.agoric-source-stamp.json';
 
 /**
  * @param {string} text
- * @returns {Record<string, string>}
+ * @returns {{ record: Record<string, string>, entries: ([string, string] | string)[] }}
  */
-const parseEnvText = text => {
+const parseEnvTextEntries = text => {
+  /** @type {([string, string] | string)[]} */
+  const entries = [];
   /** @type {Record<string, string>} */
-  const envMap = {};
+  const record = {};
   for (const line of text.split('\n')) {
     const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
+    if (!trimmed || trimmed.startsWith('#')) {
+      entries.push(line);
+      continue;
+    }
     const index = trimmed.indexOf('=');
-    if (index <= 0) continue;
+    if (index <= 0) {
+      entries.push(line);
+      continue;
+    }
+
     const key = trimmed.slice(0, index);
     const value = trimmed.slice(index + 1);
-    envMap[key] = value;
+    entries.push([key, value]);
+    record[key] = value;
+  }
+  if (entries.at(-1) === '') {
+    // Avoid empty trailing line in showEnv.
+    entries.pop();
   }
-  return envMap;
+  return { record, entries };
 };
 
 /**
@@ -142,28 +155,61 @@ const parseEnvText = text => {
  */
 
 /**
+ * @param {{ name: string; version: string; }} pkg
+ * @param {Record<string, string>} oldBuildEnv
+ * @param {Readonly<([string, string] | string)[]>} buildEnvEntries
  * @param {SourceDescriptor[]} sources
  * @param {{
  *   stdout: typeof process.stdout,
  * }} io
  */
-const showEnv = async (sources, { stdout }) => {
+const showEnv = async (
+  pkg,
+  oldBuildEnv,
+  buildEnvEntries,
+  sources,
+  { stdout },
+) => {
   await null;
+  const buildEnv = { ...oldBuildEnv };
+  if (buildEnv.XSNAP_PACKAGE == null) {
+    buildEnv.XSNAP_PACKAGE = pkg.name;
+  }
+  if (buildEnv.XSNAP_BINARY_VERSION == null) {
+    buildEnv.XSNAP_BINARY_VERSION = pkg.version;
+  }
+
   for (const { envPrefix, url, commitHash, archiveUrl } of sources) {
-    stdout.write(`${envPrefix}URL=${url}\n`);
-    stdout.write(`${envPrefix}COMMIT_HASH=${commitHash}\n`);
+    buildEnv[`${envPrefix}URL`] = url;
+    buildEnv[`${envPrefix}COMMIT_HASH`] = commitHash;
     const defaultUrl = defaultArchiveUrl(url, commitHash);
     if (archiveUrl && archiveUrl !== defaultUrl) {
-      stdout.write(`${envPrefix}ARCHIVE_URL=${archiveUrl}\n`);
+      buildEnv[`${envPrefix}ARCHIVE_URL`] = archiveUrl;
     }
   }
+
+  // Gathered all the replacements, so iterate on the entries.
+  for (const line of buildEnvEntries) {
+    if (typeof line === 'string') {
+      stdout.write(`${line}\n`);
+      continue;
+    }
+    const [key, value] = line;
+    stdout.write(`${key}=${buildEnv[key] ?? value}\n`);
+    delete buildEnv[key];
+  }
+
+  // Append any new key-values.
+  for (const [key, value] of Object.entries(buildEnv)) {
+    stdout.write(`${key}=${value}\n`);
+  }
 };
 
 /**
  * @param {SourceDescriptor[]} sources
  * @param {{
- *   fs: Pick<typeof import('fs'), 'existsSync'> &
- *     Pick<typeof promises, 'mkdir' | 'rm' | 'readFile' | 'writeFile' | 'rename'>,
+ *   fs: Pick<typeof fsTop, 'existsSync'> &
+ *     Pick<typeof fsTop.promises, 'mkdir' | 'rm' | 'readFile' | 'writeFile' | 'rename'>,
  *   curl: ReturnType<typeof makeCLI>,
  *   tar: ReturnType<typeof makeCLI>,
  * }} io
@@ -217,17 +263,19 @@ const updateSources = async (sources, { fs, curl, tar }) => {
 };
 
 /**
+ * @param {{ name: string; version: string; }} pkg
  * @param {ModdablePlatform} platform
  * @param {boolean} force
  * @param {{
- *   fs: Pick<typeof import('fs'), 'existsSync'> &
- *     Pick<typeof promises, 'readFile' | 'writeFile'>,
+ *   fs: Pick<typeof fsTop, 'existsSync'> &
+ *     Pick<typeof fsTop.promises, 'readFile' | 'writeFile'>,
  *   make: ReturnType<typeof makeCLI>,
  * }} io
  */
-const buildXsnap = async (platform, force, { fs, make }) => {
-  const pjson = await fs.readFile(asset('../package.json'), 'utf-8');
-  const pkg = JSON.parse(pjson);
+const buildXsnap = async (pkg, platform, force, { fs, make }) => {
+  // I solemnly swear I will do no synchronous work followed by a variable
+  // number turns of the event loop.
+  await null;
 
   const configEnvs = [
     `XSNAP_VERSION=${pkg.version}`,
@@ -268,16 +316,15 @@ const buildXsnap = async (platform, force, { fs, make }) => {
  * @param {{
  *   env: Record<string, string | undefined>,
  *   stdout: typeof process.stdout,
- *   spawn: typeof import('node:child_process').spawn,
+ *   spawn: typeof childProcessTop.spawn,
  *   fs: Pick<typeof import('fs'), 'existsSync'> &
- *     Pick<typeof promises, 'readFile' | 'writeFile' | 'mkdir' | 'rm' | 'rename'>,
+ *     Pick<typeof fsTop.promises, 'readFile' | 'writeFile' | 'mkdir' | 'rm' | 'rename'>,
  *   os: Pick<typeof import('os'), 'type'>,
  * }} io
  */
 async function main(args, { env, stdout, spawn, fs, os }) {
-  // I solemnly swear I will do no synchronous work followed by a variable
-  // number turns of the event loop.
-  await null;
+  const pjson = await fs.readFile(asset('../package.json'), 'utf-8');
+  const pkg = JSON.parse(pjson);
 
   const osType = os.type();
   const platform = ModdableSDK.platforms[osType];
@@ -291,10 +338,13 @@ async function main(args, { env, stdout, spawn, fs, os }) {
 
   /** @type {Record<string, string>} */
   let pinnedEnvFromFile = {};
+  /** @type {(string | [string, string])[]} */
+  let pinnedEnvTextEntries = [];
   let hasPinnedEnvFile = false;
   try {
     const text = await fs.readFile(asset('../build.env'), 'utf-8');
-    pinnedEnvFromFile = parseEnvText(text);
+    ({ record: pinnedEnvFromFile, entries: pinnedEnvTextEntries } =
+      parseEnvTextEntries(text));
     hasPinnedEnvFile = true;
   } catch (_err) {
     // Allow explicit environment overrides to run without a checked-in build.env.
@@ -363,7 +413,7 @@ async function main(args, { env, stdout, spawn, fs, os }) {
    * @returns {Promise<boolean>} whether the source needs to be refreshed from
    *   its archive URL based on whether the existing source stamp matches the
    *   expected URL and commit hash
-   * @throws if the source stamp exists but cannot be read or parsed
+   * @throws {Error} if the source stamp exists but cannot be read or parsed
    */
   const needsSourceRefresh = async source => {
     await null;
@@ -423,7 +473,9 @@ async function main(args, { env, stdout, spawn, fs, os }) {
 
   // --show-env reports effective URL/hash pins without making changes.
   if (args.includes('--show-env')) {
-    await showEnv(sources, { stdout });
+    await showEnv(pkg, pinnedEnvFromFile, pinnedEnvTextEntries, sources, {
+      stdout,
+    });
     return;
   }
 
@@ -442,7 +494,7 @@ async function main(args, { env, stdout, spawn, fs, os }) {
       isRejected(
         npm.run(['run', '-s', 'check-version'], { cwd: asset('..') }),
       ));
-    await buildXsnap(platform, force, { fs, make });
+    await buildXsnap(pkg, platform, force, { fs, make });
   } else if (!hasBin) {
     throw Error(
       'XSnap has neither sources nor a pre-built binary. Docker? .dockerignore? npm files?',

package/src/install-prebuilt.js

@@ -6,7 +6,6 @@ import osTop from 'node:os';
 import pathTop from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as childProcess from 'node:child_process';
-import { manifestHashes } from './prebuilt-manifest-sha256.js';
 
 /**
  * @import {promises as fsPromises} from 'fs';
@@ -202,17 +201,22 @@ const validateTarball = async (tarballPath, expectedFiles) => {
 };
 
 /**
- * @param {string} version
- * @param {NodeJS.ProcessEnv} env
+ * @param {string} text
+ * @returns {Record<string, string>}
  */
-const getExpectedManifestHash = (version, env) => {
-  const expected = env.XSNAP_BINARY_MANIFEST_SHA256 || manifestHashes[version];
-  if (!expected) {
-    throw Error(
-      `Missing trusted manifest hash for xsnap binary version ${version}; set XSNAP_BINARY_MANIFEST_SHA256 for explicit overrides`,
-    );
+const parseEnvText = text => {
+  /** @type {Record<string, string>} */
+  const envMap = {};
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const index = trimmed.indexOf('=');
+    if (index <= 0) continue;
+    const key = trimmed.slice(0, index);
+    const value = trimmed.slice(index + 1);
+    envMap[key] = value;
   }
-  return expected;
+  return envMap;
 };
 
 const main = async () => {
@@ -222,10 +226,44 @@ const main = async () => {
     return;
   }
 
-  const version = env.XSNAP_BINARY_VERSION || env.npm_package_version;
+  await null;
+
+  const packageJsonPath = env.npm_package_json || asset('../package.json');
+  const buildEnvPath = pathTop.join(
+    pathTop.dirname(packageJsonPath),
+    'build.env',
+  );
+
+  let buildEnv = {};
+  try {
+    const buildEnvContents = await fsTop.promises.readFile(buildEnvPath, {
+      encoding: 'utf8',
+    });
+    buildEnv = parseEnvText(buildEnvContents);
+  } catch (e) {
+    if (e?.code !== 'ENOENT') {
+      throw Error(`Cannot parse ${buildEnvPath}: ${e}`);
+    }
+  }
+
+  const version =
+    env.XSNAP_BINARY_VERSION ||
+    buildEnv.XSNAP_BINARY_VERSION ||
+    env.npm_package_version;
+  const expectedManifestHash =
+    env.XSNAP_BINARY_MANIFEST_SHA256 ||
+    env.XSNAP_BINARY_MANIFEST_HASH ||
+    buildEnv.XSNAP_BINARY_MANIFEST_HASH;
+
   if (!version) {
     throw Error(
-      'Missing XSNAP_BINARY_VERSION and npm_package_version; cannot resolve prebuilt release',
+      'Missing $XSNAP_BINARY_VERSION, build.env $XSNAP_BINARY_VERSION, or npm package version; cannot resolve prebuilt release',
+    );
+  }
+
+  if (!expectedManifestHash) {
+    throw Error(
+      `Missing $XSNAP_BINARY_MANIFEST_SHA256 or build.env $XSNAP_BINARY_MANIFEST_HASH; cannot resolve prebuilt manifest hash`,
     );
   }
 
@@ -249,7 +287,6 @@ const main = async () => {
   const tarballPath = pathTop.join(cacheRoot, tarballName);
   const manifestPath = pathTop.join(cacheRoot, manifestName);
   const extractRoot = pathTop.join(cacheRoot, 'bundle');
-  const expectedManifestHash = getExpectedManifestHash(version, env);
 
   const releaseSrc = pathTop.join(
     extractRoot,

package/src/prebuilt-manifest-sha256.js

@@ -1,6 +0,0 @@
-export const manifestHashes = {
-  '0.14.2': '377030e37b10554e73d0aff655639051d33281c9e17e7da98275fb9efcaae6f2',
-  '0.15.0': 'b481d7d5e66ed17a00624c9fea2f666b097e3bbef0d244201dd26a09e34064f1',
-  '0.16.0-u23.0':
-    '97400cbffc970b7e9172882d8f6c5b861f0c714b929822195b5818ca4f447197',
-};