@gjermundgaraba/upup 0.5.0 → 0.5.1

package/README.md

@@ -130,6 +130,6 @@ vp pack
 
 `vp run sparkle` builds upup-sparkle (`native/sparkle`) on macOS, with Xcode's command line tools, into `native/dist`, signed ad hoc unless `UPUP_SIGNING_IDENTITY` names a signing identity, and notarized when `UPUP_NOTARY_KEY` (an App Store Connect API key's .p8 file), `UPUP_NOTARY_KEY_ID` and `UPUP_NOTARY_ISSUER` are set; and then starts it as upup would; the release workflow signs and notarizes it with a Developer ID, and starts it only once its signing identity and notary key are gone. `vp run sparkle:e2e` builds it and installs updates of a fixture app through it, from an appcast served on this Mac.
 
-`vp run sea` builds a standalone `dist-sea/upup` for this machine (macOS or Linux), with Node, OpenTUI's native library and the Audit's grep worker inside, and on macOS upup-sparkle from `native/dist`, built again first if its source changed since, so it runs without Node installed. It extracts those assets to a per-user directory under the system temp directory on first run. `vp run sea:install` builds it and copies it to `~/.local/bin/upup` as a new file, since macOS kills a running copy whose file is overwritten in place.
+`vp run install:local` installs this checkout as a global package, as the release publishes it: on macOS it builds upup-sparkle signed with the `Apple Development` identity in your keychain, or the one `UPUP_SIGNING_IDENTITY` names, notarized only when the notary variables above are set, and starts it as upup would; then it builds the package, packs it and installs the tarball with `vp install -g`. A helper signed by any team updates Sparkle apps that ship installer packages, which one signed ad hoc can't.
 
 The Go implementation lives in history at `d2a5ed7`.

package/dist/main.mjs

@@ -37,12 +37,11 @@ import { constVoid } from "effect/Function";
 import { applyEdits, modify, parse as parse$1 } from "jsonc-parser";
 import { getStaticTOMLValue, parseTOML, traverseNodes } from "toml-eslint-parser";
 import { XMLParser } from "fast-xml-parser";
-import { isSea } from "node:sea";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import { setup, types } from "xstate/fsm";
 // package.json
-var version$1 = "0.5.0";
+var version$1 = "0.5.1";
 // src/ai/Setup.ts
 const Thinking = Schema.Literals([
 	"off",
@@ -1005,7 +1004,7 @@ const list = async (workspace, args, signal) => await respond(signal, async () =
 	return result === "" ? "no entries" : result;
 });
 const decodeAnswer = Schema.decodeUnknownOption(Schema.Union([Schema.Struct({ text: Schema.String }), Schema.Struct({ error: Schema.String })]));
-const grepWorker = process.env["UPUP_GREP_WORKER"] ?? new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
+const grepWorker = new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
 const search = async (job, timeoutMs, signal) => {
 	const { promise, resolve, reject } = Promise.withResolvers();
 	const worker = new Worker(grepWorker);
@@ -8757,19 +8756,11 @@ const Manifest$2 = Schema.fromJsonString(Schema.Struct({
 }));
 const zipName = "upup-sparkle.zip";
 const manifestName = "upup-sparkle.json";
-const seaKeys = {
-	zip: `sparkle/${zipName}`,
-	manifest: `sparkle/${manifestName}`
-};
 const decode = (text, zip) => Schema.decodeEffect(Manifest$2)(text).pipe(Effect.map((manifest) => ({
 	zip,
 	...manifest
 })), Effect.option);
 const folder = () => {
-	if (isSea()) {
-		const assets = process.env["OTUI_ASSET_ROOT"];
-		return assets === void 0 ? void 0 : path.join(assets, path.dirname(seaKeys.zip));
-	}
 	const packageJson = findPackageJSON(import.meta.url);
 	return packageJson === void 0 ? void 0 : path.join(path.dirname(packageJson), "native", "dist");
 };
@@ -8851,9 +8842,16 @@ ready() {
     return 1
   fi
 }
-# A copy of what upup handed over, where only this user can write; a failure is step $1's.
+# A copy of what upup handed over, where only this user can write; a failure is step $1's. Others
+# may also read a shared one ($2): as root, Sparkle starts its progress agent from upup-sparkle's
+# framework as the user, so it goes in /var/tmp, whose sticky bit keeps others from moving it. An
+# app's copy stays private, since its owner gets it after it is checked.
 secure() {
-  private=$(mktemp -d 2>"$log") || { private=; fail "$1"; return 1; }
+  if [ "$mode" = root ] && [ "$2" = shared ]; then
+    private=$(mktemp -d /var/tmp/upup.XXXXXX 2>"$log") && chmod 755 "$private" 2>"$log" || { fail "$1"; return 1; }
+  else
+    private=$(mktemp -d 2>"$log") || { fail "$1"; return 1; }
+  fi
   payload="$private/$(basename "$source")"
   "$ditto" "$source" "$payload" 2>"$log" || { fail "$1"; return 1; }
 }
@@ -8867,7 +8865,7 @@ app() {
   if [ -e "$old" ] && [ ! -e "$dest" ]; then recover; return; fi
   rm -rf "$old" "$new" 2>"$log" || { fail cleanup; return; }
   if [ "$mode" = root ]; then
-    secure copy || return
+    secure copy private || return
     "$codesign" --verify --deep --strict -R "$check" "$payload" 2>"$log" || { fail recheck; return; }
     owner=$("$stat" -f %u:%g "$dest" 2>"$log") && "$chown" -R "$owner" "$payload" 2>"$log" || { fail copy; return; }
     staged=$payload
@@ -8897,7 +8895,7 @@ app() {
 # upup-sparkle's exit status: 0 installed, 2 nothing to install, 3 Sparkle would install another
 # build, 4 the app is open; its last line on standard error says why.
 sparkle() {
-  secure helper || return
+  secure helper shared || return
   sum=$("$shasum" -a 256 "$payload" 2>"$log") || { fail helper; return; }
   [ "\${sum%% *}" = "$check" ] || { echo "its sha256 is \${sum%% *}, not $check" >"$log"; fail helper; return; }
   "$ditto" -x -k "$payload" "$private" 2>"$log" || { fail helper; return; }

package/native/dist/upup-sparkle.json

@@ -1,5 +1,5 @@
 {
   "sparkle": "2.10.1",
-  "sha256": "64e9a29d4608bab349b1365f77fe2f04e97a6724aee7215d52ae9f250a079317",
+  "sha256": "0917b2a572ac00d6172824023253f51288e94b39d1c3722c2835452cc3f10f34",
   "team": "GTS5SR7S89"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/upup",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Understand, audit, and update system tools and project dependencies from one TUI.",
   "homepage": "https://github.com/gjermundgaraba/upup#readme",
   "bugs": {
@@ -78,8 +78,7 @@
   },
   "scripts": {
     "build": "vp pack",
-    "sea": "node scripts/sea.ts",
-    "sea:install": "node scripts/sea.ts --install",
+    "install:local": "node scripts/install-local.ts",
     "sparkle": "node scripts/sparkle.ts && node scripts/sparkle-smoke.ts",
     "sparkle:e2e": "node scripts/sparkle.ts && node scripts/sparkle-e2e.ts",
     "ready": "vp check && vp test && vp run build"