@beplus/be 0.8.0 → 0.10.0

package/bin/be

@@ -64,7 +64,7 @@ function n_grep() {
 # Setup and state
 #
 
-VERSION="v0.8.0"
+VERSION="v0.10.0"
 
 BE_PREFIX="${BE_PREFIX-/usr/local}"
 BE_PREFIX=${BE_PREFIX%/}
@@ -83,18 +83,6 @@ BE_DOWNLOAD_MIRROR=${BE_DOWNLOAD_MIRROR:-https://github.com/beplus/cli/releases/
 BE_DOWNLOAD_MIRROR=${BE_DOWNLOAD_MIRROR%/}
 readonly BE_DOWNLOAD_MIRROR
 
-# Using xz instead of gzip is enabled by default, if xz compatibility checks pass.
-# User may set BE_USE_XZ to 0 to disable, or set to anything else to enable.
-# May also be overridden by command line flags.
-
-# Normalise external values to true/false
-if [[ "${BE_USE_XZ}" = "0" ]]; then
-  BE_USE_XZ="false"
-elif [[ -n "${BE_USE_XZ+defined}" ]]; then
-  BE_USE_XZ="true"
-fi
-# Not setting to readonly. Overriden by CLI flags, and update_xz_settings_for_version.
-
 BE_MAX_REMOTE_MATCHES=${BE_MAX_REMOTE_MATCHES:-20}
 
 g_mirror_url=${BE_MIRROR}
@@ -188,22 +176,6 @@ display_major_version() {
   echo "${version}"
 }
 
-#
-# Synopsis: update_xz_settings_for_version numeric-version
-# Globals modified:
-# - BE_USE_XZ
-#
-
-function update_xz_settings_for_version() {
-  # tarballs in xz format were available in later version of iojs, but KISS and only use xz from v4.
-  if [[ "${BE_USE_XZ}" = "true" ]]; then
-    local major_version="$(display_major_version "$1")"
-    if [[ "${major_version}" -lt 4 ]]; then
-      BE_USE_XZ="false"
-    fi
-  fi
-}
-
 #
 # Synopsis: update_arch_settings_for_version numeric-version
 # Globals modified:
@@ -306,6 +278,7 @@ Commands:
 
   be                              Display downloaded beplus CLI versions and install selection
   be latest                       Install the latest beplus CLI release (downloading if necessary)
+  be auto                         Install the beplus CLI version the nearest beplus.estate.json pins
   be <version>                    Install beplus CLI <version> (downloading if necessary)
   be install <version>            Install beplus CLI <version> (downloading if necessary)
   be run <version> [args ...]     Execute downloaded beplus CLI <version> with [args ...]
@@ -327,7 +300,6 @@ Options:
   -a, --arch            Override system architecture
   --all                 ls-remote displays all matches instead of last 20
   --insecure            Turn off certificate checking for https requests (may be needed from behind a proxy server)
-  --use-xz/--no-use-xz  Override automatic detection of xz support and enable/disable use of xz compressed beplus CLI downloads.
 
 Aliases:
 
@@ -345,7 +317,8 @@ Versions:
 
     0.17.0, 1, v1.2   Numeric versions
     latest, current   Newest official release
-    auto              Read version from file: .bepluscloud, .beplus-version, or package.json
+    auto              The exact version pinned as "cli": { "version": "x.y.z" } in the nearest
+                      beplus.estate.json (in the current directory or above it); fails without one
 
 EOF
 }
@@ -383,28 +356,23 @@ display_be_version() {
 
 #
 # Synopsis: set_active_beplus
-# Checks cached downloads for a binary matching the active beplus CLI.
+# Checks cached downloads for the one the installed beplus CLI was copied from: activate copies
+# <cache>/beplus/<version>/beplus to $BE_PREFIX/bin/beplus, so the two files are identical.
 # Globals modified:
 # - g_active_beplus
 #
 
 function set_active_beplus() {
   g_active_beplus=
-  local beplus_path="$(command -v beplus)"
-  if [[ -x "${beplus_path}" ]]; then
-    local installed_version=$(beplus --version)
-    installed_version=${installed_version#v}
-    for dir in "${CACHE_DIR}"/*/ ; do
-      local folder_name="${dir%/}"
-      folder_name="${folder_name##*/}"
-      if diff &> /dev/null \
-        "${CACHE_DIR}/${folder_name}/${installed_version}/bin/beplus" \
-        "${beplus_path}" ; then
-        g_active_beplus="${folder_name}/${installed_version}"
-        break
-      fi
-    done
-  fi
+  local cached
+  for cached in "${CACHE_DIR}"/*/*/beplus; do
+    # cmp stops at the first difference; diff may read both binaries (~110 MB each) whole.
+    if cmp -s "${cached}" "${BE_PREFIX}/bin/beplus"; then
+      cached="${cached#"${CACHE_DIR}/"}"
+      g_active_beplus="${cached%/beplus}"
+      break
+    fi
+  done
 }
 
 #
@@ -638,18 +606,10 @@ install() {
   get_latest_resolved_version "$1" || return 2
   version="${g_target_beplus}"
   [[ -n "${version}" ]] || abort "no version found for '$1'"
-  update_xz_settings_for_version "${version}"
   update_arch_settings_for_version "${version}"
 
   local dir="${CACHE_DIR}/${g_mirror_folder_name}/${version}"
 
-  # Note: decompression flags ignored with default Darwin tar which autodetects.
-  if test "$BE_USE_XZ" = "true"; then
-    local tarflag="-Jx"
-  else
-    local tarflag="-zx"
-  fi
-
   if test -d "$dir"; then
     if [[ ! -e "$dir/be.lock" ]] ; then
       if [[ "$DOWNLOAD" == "false" ]] ; then
@@ -664,6 +624,15 @@ install() {
   local url="$(tarball_url "$version")"
   is_ok "${url}" || abort "download preflight failed for '$version' (${url})"
 
+  # The release publishes SHA256SUMS beside its tarballs. Read this tarball's line before
+  # downloading it, and extract only a download that matches it. 2.x lists `<hash>  <name>`, as
+  # sha256sum writes it; v1.0.5 lists `<name>: <hash>`.
+  local sums_url="${url%/*}/SHA256SUMS"
+  local sums
+  sums="$(do_get_index "${sums_url}")" || abort "failed to download SHA256SUMS for $version (${sums_url})"
+  local checksum="$(echo "${sums}" | awk -v name="${url##*/}" '$2 == name { print $1; exit } $1 == name ":" { print $2; exit }')"
+  [[ -n "${checksum}" ]] || abort "no checksum for ${url##*/} in ${sums_url}"
+
   log mkdir "$dir"
   mkdir -p "$dir" || abort "sudo required (or change ownership, or define BE_PREFIX)"
   touch "$dir/be.lock"
@@ -671,15 +640,21 @@ install() {
   cd "${dir}" || abort "Failed to cd to ${dir}"
 
   log fetch "$url"
-  do_get "${url}" | tar "$tarflag" --no-same-owner -f - # --strip-components=1
-  pipe_results=( "${PIPESTATUS[@]}" )
-  if [[ "${pipe_results[0]}" -ne 0 ]]; then
+  local archive="${dir}/${url##*/}"
+  if ! do_get "${url}" > "${archive}"; then
+    rm -f "${archive}"
     abort "failed to download archive for $version"
   fi
-  if [[ "${pipe_results[1]}" -ne 0 ]]; then
-    abort "failed to extract archive for $version"
-  fi
   [ "$GET_SHOWS_PROGRESS" = "true" ] && erase_line
+  local download_checksum="$(display_sha256 "${archive}")"
+  if [[ "${download_checksum}" != "${checksum}" ]]; then
+    rm -f "${archive}"
+    abort "checksum mismatch for ${url}: ${sums_url} lists ${checksum}, the download is ${download_checksum}"
+  fi
+  tar -zx --no-same-owner -f "${archive}" # --strip-components=1
+  local tar_status=$?
+  rm -f "${archive}"
+  [[ "${tar_status}" -eq 0 ]] || abort "failed to extract archive for $version"
   rm -f "$dir/be.lock"
 
   disable_pax_mprotect bin/beplus
@@ -713,6 +688,23 @@ function do_get() {
   fi
 }
 
+#
+# Synopsis: display_sha256 file
+# sha256sum where it exists, otherwise shasum, which macOS has. Both hash stdin rather than a
+# named file: given a name with a backslash in it, they escape it and put a backslash before the
+# hash.
+#
+
+function display_sha256() {
+  local line
+  if command -v sha256sum &> /dev/null; then
+    line="$(sha256sum < "$1")"
+  else
+    line="$(shasum -a 256 < "$1")"
+  fi
+  echo "${line%% *}"
+}
+
 #
 # Synopsis: do_get_index [option...] url
 # Call curl or wget with combination of global and passed options,
@@ -836,30 +828,6 @@ function is_ok() {
   fi
 }
 
-#
-# Synopsis: can_use_xz
-# Test system to see if xz decompression is supported by tar.
-#
-
-function can_use_xz() {
-  # Be conservative and only enable if xz is likely to work. Unfortunately we can't directly query tar itself.
-  # For research, see https://github.com/shadowspawn/nvh/issues/8
-  local uname_s="$(uname -s)"
-  if [[ "${uname_s}" = "Linux" ]] && command -v xz &> /dev/null ; then
-    # tar on linux is likely to support xz if it is available as a command
-    return 0
-  elif [[ "${uname_s}" = "Darwin" ]]; then
-    local macos_version="$(sw_vers -productVersion)"
-    local macos_major_version="$(echo "${macos_version}" | cut -d '.' -f 1)"
-    local macos_minor_version="$(echo "${macos_version}" | cut -d '.' -f 2)"
-    if [[ "${macos_major_version}" -gt 10 || "${macos_minor_version}" -gt 8 ]]; then
-      # tar on recent Darwin has xz support built-in
-      return 0
-    fi
-  fi
-  return 2 # not supported
-}
-
 #
 # Synopsis: display_tarball_platform
 #
@@ -926,145 +894,114 @@ function tarball_url() {
   # Artifact version (filename MUST NOT contain +suffix)
   local artifact_version="${version%%+*}"
 
-  local ext="gz"
-  [ "$BE_USE_XZ" = "true" ] && ext="xz"
-
-  echo "${g_mirror_url}/v${url_version}/beplus-cli-v${artifact_version}-$(display_tarball_platform).tar.${ext}"
+  # The beplus CLI release publishes .tar.gz only.
+  echo "${g_mirror_url}/v${url_version}/beplus-cli-v${artifact_version}-$(display_tarball_platform).tar.gz"
 }
 
 #
-# Synopsis: get_file_node_version filename
-# Sets g_target_beplus
+# Synopsis: display_estate_manifest_path
+# Output the path of the nearest beplus.estate.json: in PWD, or else in the closest directory above
+# it. Fails when there is none.
 #
 
-function get_file_node_version() {
-  g_target_beplus=
-  local filepath="$1"
-  verbose_log "found" "${filepath}"
-  # read returns a non-zero status but does still work if there is no line ending
-  local version
-  <"${filepath}" read -r version
-  # trim possible trailing \d from a Windows created file
-  version="${version%%[[:space:]]}"
-  verbose_log "read" "${version}"
-  g_target_beplus="${version}"
+function display_estate_manifest_path() {
+  local dir="${PWD}"
+  while true; do
+    if [[ -f "${dir%/}/beplus.estate.json" ]]; then
+      echo "${dir%/}/beplus.estate.json"
+      return 0
+    fi
+    [[ -z "${dir}" || "${dir}" == "/" ]] && return 1
+    dir="${dir%/*}"
+  done
 }
 
 #
-# Synopsis: get_package_engine_version\
-# Sets g_target_beplus
-#
-
-function get_package_engine_version() {
-  g_target_beplus=
-  local filepath="$1"
-  verbose_log "found" "${filepath}"
-  command -v node &> /dev/null || abort "an active version of node is required to read 'engines' from package.json"
-  local range
-  range="$(node -e "package = require('${filepath}'); if (package && package.engines && package.engines.node) console.log(package.engines.node)")"
-  verbose_log "read" "${range}"
-  [[ -n "${range}" ]] || return 2
-  if [[ "*" == "${range}" ]]; then
-    verbose_log "target" "current"
-    g_target_beplus="current"
-    return
-  fi
-
-  local version
-  if [[ "${range}" =~ ^([>~^=]|\>\=)?v?([0-9]+(\.[0-9]+){0,2})(.[xX*])?$ ]]; then
-    local operator="${BASH_REMATCH[1]}"
-    version="${BASH_REMATCH[2]}"
-    case "${operator}" in
-      '' | =) ;;
-      \> | \>=) version="current" ;;
-      \~) [[ "${version}" =~ ^([0-9]+\.[0-9]+)\.[0-9]+$ ]] && version="${BASH_REMATCH[1]}" ;;
-      ^) [[ "${version}" =~ ^([0-9]+) ]] && version="${BASH_REMATCH[1]}" ;;
-    esac
-    verbose_log "target" "${version}"
+# Synopsis: display_estate_cli_version node|jq manifest
+# Output the manifest's "cli": { "version" } as JSON, on one line: a string when the pin is one,
+# null when the manifest has none. Fails, with the reason on stderr, when the file is not exactly
+# one JSON value.
+#
+
+function display_estate_cli_version() {
+  if [[ "$1" == "node" ]]; then
+    node -e '
+      const has = (value, key) =>
+        value !== null && typeof value === "object" && !Array.isArray(value)
+        && Object.prototype.hasOwnProperty.call(value, key);
+      let manifest;
+      try {
+        manifest = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"));
+      } catch (error) {
+        console.error(error.message);
+        process.exit(1);
+      }
+      const version = has(manifest, "cli") && has(manifest.cli, "version") ? manifest.cli.version : null;
+      console.log(JSON.stringify(version));
+    ' "$2"
   else
-    command -v npx &> /dev/null || abort "an active version of npx is required to use complex 'engine' ranges from package.json"
-    verbose_log "resolving" "${range}"
-    local version_per_line="$(be lsr --all)"
-    local versions_one_line=$(echo "${version_per_line}" | tr '\n' ' ')
-    # Using semver@7 so works with older versions of node.
-    # shellcheck disable=SC2086
-    version=$(npm_config_yes=true npx --quiet semver@7 -r "${range}" ${versions_one_line} | tail -n 1)
+    # --slurp so that an empty file, or one holding several values, fails as JSON.parse does.
+    jq -r --slurp '
+      if length != 1 then error("expected one JSON value, found \(length)")
+      else .[0]
+        | if type == "object" and (.cli | type) == "object" and (.cli | has("version"))
+          then .cli.version
+          else null
+          end
+        | tojson
+      end
+    ' "$2"
   fi
-  g_target_beplus="${version}"
 }
 
 #
-# Synopsis: get_nvmrc_version
+# Synopsis: get_auto_version
+# Resolve auto to the beplus CLI version the nearest beplus.estate.json pins as
+# "cli": { "version": "x.y.z" }. The pin must be one exact version (a leading v and a pre-release
+# are allowed, as everywhere in be); a missing, floating or unreadable pin aborts, naming the file,
+# rather than falling back to another version. The nearest manifest decides, even when it pins
+# nothing: one further up is never consulted.
 # Sets g_target_beplus
 #
 
-function get_nvmrc_version() {
+function get_auto_version() {
   g_target_beplus=
-  local filepath="$1"
-  verbose_log "found" "${filepath}"
-  local version
-  <"${filepath}" read -r version
-  verbose_log "read" "${version}"
-  # Translate from nvm aliases
-  case "${version}" in
-    lts/\*) version="lts" ;;
-    lts/*) version="${version:4}" ;;
-    node) version="current" ;;
-    *) ;;
-  esac
-  g_target_beplus="${version}"
-}
+  local manifest
+  manifest="$(display_estate_manifest_path)" \
+    || abort "auto found no beplus.estate.json in ${PWD} or above it, so no beplus CLI version is pinned"
+  verbose_log "found" "${manifest}"
 
-#
-# Synopsis: get_engine_version [error-message]
-# Sets g_target_beplus
-#
+  # node is on every deploy path; jq is what be's remote lookups use.
+  local reader
+  if command -v node &> /dev/null; then
+    reader="node"
+  elif command -v jq &> /dev/null; then
+    reader="jq"
+  else
+    abort "reading the beplus CLI pin from ${manifest} needs node or jq, and neither is on PATH"
+  fi
 
-function get_engine_version() {
-  g_target_beplus=
-  local error_message="${1-package.json not found}"
-  local parent
-  parent="${PWD}"
-  while [[ -n "${parent}" ]]; do
-    if [[ -e "${parent}/package.json" ]]; then
-      get_package_engine_version "${parent}/package.json"
-    else
-      parent=${parent%/*}
-      continue
-    fi
-    break
-  done
-  [[ -n "${parent}" ]] || abort "${error_message}"
-  [[ -n "${g_target_beplus}" ]] || abort "did not find supported version of node in 'engines' field of package.json"
-}
+  local value
+  if ! value="$(display_estate_cli_version "${reader}" "${manifest}" 2> /dev/null)"; then
+    abort "${manifest} could not be read as JSON by ${reader}: $(display_estate_cli_version "${reader}" "${manifest}" 2>&1 > /dev/null)"
+  fi
 
-#
-# Synopsis: get_auto_version
-# Sets g_target_beplus
-#
+  local version
+  case "${value}" in
+    null)
+      abort "${manifest} pins no beplus CLI version; add \"cli\": { \"version\": \"x.y.z\" }" ;;
+    \"*\")
+      version="${value#\"}"
+      version="${version%\"}"
+      ;;
+    *)
+      abort "\"cli\": { \"version\" } in ${manifest} is ${value}, not a version string like \"2.11.0\"" ;;
+  esac
+  verbose_log "read" "${version}"
 
-# @todo
-function get_auto_version() {
-  g_target_beplus=
-  # Search for a version control file first
-  local parent
-  parent="${PWD}"
-  while [[ -n "${parent}" ]]; do
-    if [[ -e "${parent}/.n-node-version" ]]; then
-      get_file_node_version "${parent}/.n-node-version"
-    elif [[ -e "${parent}/.node-version" ]]; then
-      get_file_node_version "${parent}/.node-version"
-    elif [[ -e "${parent}/.nvmrc" ]]; then
-      get_nvmrc_version "${parent}/.nvmrc"
-    else
-      parent=${parent%/*}
-      continue
-    fi
-    break
-  done
-  # Fallback to package.json
-  [[ -n "${parent}" ]] || get_engine_version "no file found for auto version (.n-node-version, .node-version, .nvmrc, or package.json)"
-  [[ -n "${g_target_beplus}" ]] || abort "file found for auto did not contain target version of node"
+  is_exact_numeric_version "${version}" \
+    || abort "\"cli\": { \"version\" } in ${manifest} is \"${version}\", not one exact version like \"2.11.0\""
+  g_target_beplus="${version#v}"
 }
 
 #
@@ -1075,6 +1012,12 @@ function get_auto_version() {
 function get_latest_resolved_version() {
   g_target_beplus=
   local version=${1}
+  if [[ "${version}" == "auto" ]]; then
+    # The pin is one exact version, so there is nothing to look up: auto installs exactly that
+    # version or fails, and never reads the release index (where "newest" lives).
+    get_auto_version
+    return
+  fi
   simple_version=${version}
   if is_exact_numeric_version "${simple_version}"; then
     # Just numbers, already resolved, no need to lookup first.
@@ -1217,7 +1160,8 @@ function delete_with_echo() {
 
 uninstall_installed() {
   while true; do
-      read -r -p "Do you wish to delete beplus CLI from ${BE_PREFIX}? " yn
+      # End of input answers no.
+      read -r -p "Do you wish to delete beplus CLI from ${BE_PREFIX}? " yn || yn="n"
       case $yn in
           [Yy]* ) break ;;
           [Nn]* ) exit ;;
@@ -1432,8 +1376,6 @@ while [[ $# -ne 0 ]]; do
     -q|--quiet) set_quiet ;;
     -d|--download) DOWNLOAD="true" ;;
     --insecure) set_insecure ;;
-    --use-xz) BE_USE_XZ="true" ;;
-    --no-use-xz) BE_USE_XZ="false" ;;
     --latest) display_remote_versions latest; exit ;;
     --stable) display_remote_versions latest; exit ;;
     -a|--arch) shift; set_arch "$1";; # set arch and continue
@@ -1452,11 +1394,6 @@ while [[ $# -ne 0 ]]; do
   shift
 done
 
-if [[ -z "${BE_USE_XZ+defined}" ]]; then
-  BE_USE_XZ="true" # Default to using xz
-  can_use_xz || BE_USE_XZ="false"
-fi
-
 set -- "${unprocessed_args[@]}"
 
 if test $# -eq 0; then

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@beplus/be",
   "description": "Interactively Manage beplus CLI Versions",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "author": "Igor Lamos <igor@be.plus>",
   "homepage": "https://github.com/beplus/be",
   "bugs": "https://github.com/beplus/be",