@gtkx/cli 1.6.0 → 2.0.0-beta.10

package/src/deploy/freedesktop/metainfo.ts

@@ -14,6 +14,54 @@ import { element, renderDocument, text, type XmlNode } from "./xml.js";
 
 const COMPONENT_TYPE = "desktop-application";
 const DESKTOP_SUFFIX = ".desktop";
+const COMPONENT_CLOSE = "</component>\n";
+const PROVIDES_CLOSE = "    </provides>\n";
+const PROVIDES_FRAGMENT = /^<provides\s*>([\s\S]*)<\/provides>$/;
+
+const normalizeExtraFragment = (fragment: string, index: number): string => {
+    const normalized = fragment.trim();
+
+    if (normalized.length === 0) {
+        throw new Error(`Cannot render deploy.metainfoExtra entry ${String(index + 1)}: it is empty`);
+    }
+
+    return normalized;
+};
+
+const indentFragment = (fragment: string, depth: number): string => {
+    const indentation = " ".repeat(depth * 4);
+
+    return fragment.split(/\r?\n/).map((line) => `${indentation}${line}`).join("\n");
+};
+
+const appendExtraFragments = (document: string, fragments: string[]): string => {
+    if (fragments.length === 0) {
+        return document;
+    }
+
+    let merged = document;
+    const componentFragments: string[] = [];
+
+    for (const [index, rawFragment] of fragments.entries()) {
+        const fragment = normalizeExtraFragment(rawFragment, index);
+        const provides = PROVIDES_FRAGMENT.exec(fragment)?.[1]?.trim();
+
+        if (provides === undefined) {
+            componentFragments.push(fragment);
+            continue;
+        }
+
+        merged = merged.replace(PROVIDES_CLOSE, () => `${indentFragment(provides, 2)}\n${PROVIDES_CLOSE}`);
+    }
+
+    if (componentFragments.length === 0) {
+        return merged;
+    }
+
+    const extra = componentFragments.map((fragment) => indentFragment(fragment, 1)).join("\n");
+
+    return merged.replace(COMPONENT_CLOSE, () => `${extra}\n${COMPONENT_CLOSE}`);
+};
 
 const launchable = (applicationId: string): XmlNode => ({
     tag: "launchable",
@@ -21,26 +69,30 @@ const launchable = (applicationId: string): XmlNode => ({
     text: `${applicationId}${DESKTOP_SUFFIX}`,
 });
 
-const renderMetainfo = (settings: DeploySettings): string =>
-    renderDocument(
-        element("component", { type: COMPONENT_TYPE }, [
-            text("id", settings.applicationId),
-            text("name", settings.name),
-            text("summary", settings.summary),
-            text("metadata_license", settings.metadataLicense),
-            text("project_license", settings.license),
-            ...developerSection(settings),
-            ...descriptionSection(settings),
-            launchable(settings.applicationId),
-            ...providesSection(settings),
-            ...listSection("categories", "category", settings.categories),
-            ...listSection("keywords", "keyword", settings.keywords),
-            ...urlsSection(settings),
-            ...screenshotsSection(settings),
-            ...releasesSection(settings),
-            ...contentRatingSection(settings),
-            ...brandingSection(settings),
-        ]),
-    );
+const metainfoRoot = (settings: DeploySettings): XmlNode =>
+    element("component", { type: COMPONENT_TYPE }, [
+        text("id", settings.applicationId),
+        text("name", settings.name),
+        text("summary", settings.summary),
+        text("metadata_license", settings.metadataLicense),
+        text("project_license", settings.license),
+        ...developerSection(settings),
+        ...descriptionSection(settings),
+        launchable(settings.applicationId),
+        ...providesSection(settings),
+        ...listSection("categories", "category", settings.categories),
+        ...listSection("keywords", "keyword", settings.keywords),
+        ...urlsSection(settings),
+        ...screenshotsSection(settings),
+        ...releasesSection(settings),
+        ...contentRatingSection(settings),
+        ...brandingSection(settings),
+    ]);
+
+const renderMetainfo = (settings: DeploySettings): string => {
+    const document = renderDocument(metainfoRoot(settings));
+
+    return appendExtraFragments(document, settings.deploy.metainfoExtra ?? []);
+};
 
 export { renderMetainfo };

package/src/deploy/freedesktop/validate.ts

@@ -6,12 +6,20 @@ type ToolResult = {
     status: number;
 };
 
+type Diagnostic = {
+    severity: string;
+    rule: string;
+    detail: string;
+};
+
 type MetainfoResult = {
     subject: string;
     output: string;
     status: number;
     errors: string[];
     warnings: string[];
+    rules: string[];
+    notes: string[];
     areWarningsFatal: boolean;
 };
 
@@ -21,10 +29,19 @@ type ToolRequest = {
     subject: string;
 };
 
-const DIAGNOSTIC = /^(?<severity>[EIPW]): \S+ (?<rule>[\w-]+)/;
+const DIAGNOSTIC = /^(?<severity>[EIPW]): \S+ (?<rule>[\w-]+)(?: (?<detail>.*))?$/;
+const SUCCESS_SUMMARY = /^\W*Validation was successful/u;
 const ERROR_SEVERITY = "E";
 const WARNING_SEVERITY = "W";
 const INFO_SEVERITY = "I";
+const FATAL_WARNING_RULES: Set<string> = new Set(["unknown-tag"]);
+const DESKTOP_ERROR = /(?:^|:\s)error:/iu;
+
+const FATAL_RULE_NOTES: Record<string, (detail: string) => string> = {
+    "unknown-tag": (element) =>
+        "GTKX treats unknown-tag as fatal for every target, whatever severity appstreamcli assigns it; " +
+        `the unsupported element is <${element}>`,
+};
 
 const REMEDY_FOR_RULE: Record<string, string> = {
     "component-summary-missing": "set `deploy.summary`",
@@ -33,6 +50,7 @@ const REMEDY_FOR_RULE: Record<string, string> = {
     "metainfo-legacy-path": "this file is generated; report it as a gtkx bug",
     "summary-has-dot-suffix": "drop the trailing period from `deploy.summary`",
     "summary-too-long": "shorten `deploy.summary`",
+    "unknown-tag": "remove the unsupported `deploy.metainfoExtra` element or use a `<custom>` value",
     "url-homepage-missing": "set `deploy.homepage`, or `homepage` in package.json",
 };
 
@@ -46,12 +64,31 @@ const runTool = ({ tool, args, subject }: ToolRequest): ToolResult => {
     return { output: [result.stdout, result.stderr].join("\n").trim(), status: result.status ?? 0 };
 };
 
-const rulesIn = (output: string, severities: string[]): string[] =>
+const parseDiagnostics = (output: string): Diagnostic[] =>
+    output.split("\n").flatMap((line) => {
+        const groups = DIAGNOSTIC.exec(line)?.groups;
+
+        return groups === undefined
+            ? []
+            : [{ severity: groups.severity ?? "", rule: groups.rule ?? "", detail: (groups.detail ?? "").trim() }];
+    });
+
+const rulesIn = (diagnostics: Diagnostic[], severities: string[]): string[] =>
+    diagnostics.filter((diagnostic) => severities.includes(diagnostic.severity)).map((diagnostic) => diagnostic.rule);
+
+const fatalNotes = (diagnostics: Diagnostic[]): string[] =>
+    diagnostics
+        .filter((diagnostic) => diagnostic.severity !== ERROR_SEVERITY && FATAL_WARNING_RULES.has(diagnostic.rule))
+        .map((diagnostic) =>
+            FATAL_RULE_NOTES[diagnostic.rule]?.(diagnostic.detail) ??
+            `GTKX treats ${diagnostic.rule} as fatal for every target`);
+
+const withoutSuccessSummary = (output: string): string =>
     output
         .split("\n")
-        .map((line) => DIAGNOSTIC.exec(line)?.groups)
-        .filter((groups) => groups !== undefined && severities.includes(groups.severity ?? ""))
-        .map((groups) => groups?.rule ?? "");
+        .filter((line) => !SUCCESS_SUMMARY.test(line))
+        .join("\n")
+        .trimEnd();
 
 const remedyLines = (rules: string[]): string[] => {
     const remedies = sortStrings([...new Set(rules)])
@@ -61,14 +98,23 @@ const remedyLines = (rules: string[]): string[] => {
     return remedies.length === 0 ? [] : ["", "Fix it in gtkx.config.ts:", ...remedies];
 };
 
-const invalid = (subject: string, output: string, rules: string[]): Error =>
-    new Error([`${subject} is not valid:`, output.length > 0 ? output : "no output", ...remedyLines(rules)].join("\n"));
+const invalid = (subject: string, output: string, rules: string[], notes: string[]): Error =>
+    new Error([
+        `${subject} is not valid:`,
+        output.length > 0 ? output : "no output",
+        ...notes,
+        ...remedyLines(rules),
+    ].join("\n"));
 
-const isFatalResult = ({ status, errors, warnings, areWarningsFatal }: MetainfoResult): boolean => {
+const isFatalResult = ({ status, errors, warnings, rules, areWarningsFatal }: MetainfoResult): boolean => {
     if (errors.length > 0) {
         return true;
     }
 
+    if (rules.some((rule) => FATAL_WARNING_RULES.has(rule))) {
+        return true;
+    }
+
     if (areWarningsFatal && warnings.length > 0) {
         return true;
     }
@@ -78,7 +124,7 @@ const isFatalResult = ({ status, errors, warnings, areWarningsFatal }: MetainfoR
 
 const assertNotFatal = (result: MetainfoResult): void => {
     if (isFatalResult(result)) {
-        throw invalid(result.subject, result.output, [...result.errors, ...result.warnings]);
+        throw invalid(result.subject, result.output, result.rules, result.notes);
     }
 };
 
@@ -101,8 +147,14 @@ const validateDesktopEntry = (path: string): void => {
         subject: "The desktop entry",
     });
 
-    if (status !== 0 || output.length > 0) {
-        throw invalid("The desktop entry", output, []);
+    const diagnostics = output.split("\n").filter((line) => line.length > 0);
+
+    if (status !== 0 || diagnostics.some((line) => DESKTOP_ERROR.test(line))) {
+        throw invalid("The desktop entry", output, [], []);
+    }
+
+    for (const diagnostic of diagnostics) {
+        warn(diagnostic);
     }
 };
 
@@ -115,10 +167,23 @@ const validateMetainfo = (path: string, areWarningsFatal: boolean): void => {
         subject,
     });
 
-    const errors = rulesIn(output, [ERROR_SEVERITY]);
-    const warnings = rulesIn(output, [WARNING_SEVERITY]);
-    assertNotFatal({ subject, output, status, errors, warnings, areWarningsFatal });
-    reportDiagnostics(subject, [...warnings, ...rulesIn(output, [INFO_SEVERITY])]);
+    const diagnostics = parseDiagnostics(output);
+    const errors = rulesIn(diagnostics, [ERROR_SEVERITY]);
+    const warnings = rulesIn(diagnostics, [WARNING_SEVERITY]);
+    const infos = rulesIn(diagnostics, [INFO_SEVERITY]);
+    const rules = [...errors, ...warnings, ...infos];
+    const notes = fatalNotes(diagnostics);
+    assertNotFatal({
+        subject,
+        output: withoutSuccessSummary(output),
+        status,
+        errors,
+        warnings,
+        rules,
+        notes,
+        areWarningsFatal,
+    });
+    reportDiagnostics(subject, [...warnings, ...infos]);
 };
 
 export { validateDesktopEntry, validateMetainfo };

package/src/deploy/freedesktop/xml.ts

@@ -1,3 +1,5 @@
+import XMLBuilder from "fast-xml-builder";
+
 type XmlNode = {
     tag: string;
     attributes?: Record<string, string>;
@@ -5,23 +7,26 @@ type XmlNode = {
     text?: string;
 };
 
-const XML_DECLARATION = '<?xml version="1.0" encoding="UTF-8"?>';
-const INDENT = " ".repeat(4);
+type OrderedNode = Record<string, unknown>;
 
-const ESCAPES: Record<string, string> = {
-    '"': "&quot;",
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-};
+const XML_ENCODING = ["UTF", "8"].join("-");
 
-const escapeXml = (value: string): string =>
-    value.replaceAll(/["&<>]/g, (character) => ESCAPES[character] ?? character);
+const builder = new XMLBuilder({
+    format: true,
+    ignoreAttributes: false,
+    indentBy: " ".repeat(4),
+    preserveOrder: true,
+    suppressEmptyNode: true,
+});
 
-const renderAttributes = (attributes: Record<string, string> | undefined): string =>
-    Object.entries(attributes ?? {})
-        .map(([key, value]) => ` ${key}="${escapeXml(value)}"`)
-        .join("");
+const orderedNode = (node: XmlNode): OrderedNode => ({
+    [node.tag]: node.text === undefined
+        ? (node.children ?? []).map((child) => orderedNode(child))
+        : [{ "#text": node.text }],
+    ...(node.attributes && {
+        ":@": Object.fromEntries(Object.entries(node.attributes).map(([key, value]) => [`@_${key}`, value])),
+    }),
+});
 
 const element = (tag: string, attributes: Record<string, string>, children: XmlNode[]): XmlNode => ({
     tag,
@@ -31,23 +36,10 @@ const element = (tag: string, attributes: Record<string, string>, children: XmlN
 
 const text = (tag: string, value: string): XmlNode => ({ tag, text: value });
 
-const renderNode = (node: XmlNode, depth: number): string[] => {
-    const padding = INDENT.repeat(depth);
-    const open = `${padding}<${node.tag}${renderAttributes(node.attributes)}`;
-
-    if (node.text !== undefined) {
-        return [`${open}>${escapeXml(node.text)}</${node.tag}>`];
-    }
-
-    const children = node.children ?? [];
-
-    if (children.length === 0) {
-        return [`${open}/>`];
-    }
-
-    return [`${open}>`, ...children.flatMap((child) => renderNode(child, depth + 1)), `${padding}</${node.tag}>`];
-};
-
-const renderDocument = (root: XmlNode): string => [XML_DECLARATION, ...renderNode(root, 0), ""].join("\n");
+const renderDocument = (root: XmlNode): string =>
+    `${builder.build([
+        { "?xml": [{ "#text": "" }], ":@": { "@_version": "1.0", "@_encoding": XML_ENCODING } },
+        orderedNode(root),
+    ])}\n`;
 
 export { element, renderDocument, text, type XmlNode };

package/src/deploy/native-addon.ts

@@ -0,0 +1,183 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import type { DeployArchName, DeploySettings } from "./types.js";
+import { runCliTool } from "../internal/run-cli-tool.js";
+import { cacheDir, downloadFile, readCachedDigest, writeAtomically } from "./download.js";
+import { isHostArch } from "./settings/arch.js";
+
+type ProjectRequire = ReturnType<typeof createRequire>;
+type Tarball = { url: string; digest: string };
+
+const BINDING_FILENAME = "gtkx.node";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const NATIVE_MANIFEST = "@gtkx/native/package.json";
+const PACKAGE_ROOT = "package";
+const REQUEST_TIMEOUT = 30_000;
+const SRI_PREFIX = "sha512-";
+const STRIP_COMPONENTS = "1";
+const VERSION_PATTERN = /^[\w.+-]+$/;
+
+const binaryFilename = (arch: DeployArchName): string => `native.linux-${arch}-gnu.node`;
+const platformStem = (arch: DeployArchName): string => `native-linux-${arch}-gnu`;
+const platformPackage = (arch: DeployArchName): string => `@gtkx/${platformStem(arch)}`;
+
+const withoutTrailingSlash = (value: string): string => {
+    let end = value.length;
+
+    while (end > 0 && value[end - 1] === "/") {
+        end -= 1;
+    }
+
+    return value.slice(0, end);
+};
+
+const registryUrl = (): string => {
+    const configured = process.env.npm_config_registry;
+
+    return withoutTrailingSlash(configured !== undefined && configured.length > 0 ? configured : DEFAULT_REGISTRY);
+};
+
+const projectRequireFor = (root: string): ProjectRequire => createRequire(join(root, "package.json"));
+
+const localBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    const nativeRoot = dirname(projectRequire.resolve(NATIVE_MANIFEST));
+    const candidate = join(nativeRoot, binaryFilename(arch));
+
+    return existsSync(candidate) ? candidate : null;
+};
+
+const installedBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    try {
+        return projectRequire.resolve(platformPackage(arch));
+    } catch {
+        return null;
+    }
+};
+
+const manifestVersion = (manifest: unknown): string | null => {
+    if (typeof manifest !== "object" || manifest === null || !("version" in manifest)) {
+        return null;
+    }
+
+    const version = manifest.version;
+
+    return typeof version === "string" && VERSION_PATTERN.test(version) ? version : null;
+};
+
+const nativeVersion = (projectRequire: ProjectRequire): string => {
+    const parsed: unknown = JSON.parse(readFileSync(projectRequire.resolve(NATIVE_MANIFEST), "utf8"));
+    const version = manifestVersion(parsed);
+
+    if (version === null) {
+        throw new Error("Cannot read a usable version from @gtkx/native; is it installed?");
+    }
+
+    return version;
+};
+
+const hexFromIntegrity = (integrity: unknown, subject: string): string => {
+    if (typeof integrity !== "string" || !integrity.startsWith(SRI_PREFIX)) {
+        throw new Error(`The npm registry publishes no sha512 integrity for ${subject}`);
+    }
+
+    return Buffer.from(integrity.slice(SRI_PREFIX.length), "base64").toString("hex");
+};
+
+const fetchVersionDocument = async (url: string, subject: string): Promise<Record<string, unknown>> => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT) });
+
+    if (!response.ok) {
+        throw new Error(
+            `Cannot fetch ${subject}: HTTP ${String(response.status)} ${response.statusText}. ` +
+            `Install ${subject} directly, or drop that architecture from --arch.`,
+        );
+    }
+
+    const document: unknown = await response.json();
+
+    if (typeof document !== "object" || document === null) {
+        throw new Error(`The npm registry returned no metadata for ${subject}`);
+    }
+
+    return document as Record<string, unknown>;
+};
+
+const publishedTarball = async (arch: DeployArchName, version: string): Promise<Tarball> => {
+    const registry = registryUrl();
+    const subject = `${platformPackage(arch)}@${version}`;
+    const url = `${registry}/${encodeURIComponent(platformPackage(arch))}/${version}`;
+    const document = await fetchVersionDocument(url, subject);
+    const dist: unknown = document.dist;
+
+    if (typeof dist !== "object" || dist === null) {
+        throw new Error(`The npm registry returned no tarball for ${subject}`);
+    }
+
+    const entry = dist as Record<string, unknown>;
+    const tarball = entry.tarball;
+
+    if (typeof tarball !== "string" || new URL(tarball).origin !== new URL(registry).origin) {
+        throw new Error(`The npm registry returned an unusable tarball URL for ${subject}`);
+    }
+
+    return { url: tarball, digest: hexFromIntegrity(entry.integrity, subject) };
+};
+
+const extractAddon = (archive: string, dir: string, arch: DeployArchName): void => {
+    runCliTool({
+        tool: "tar",
+        args: ["-xzf", archive, "-C", dir, "--strip-components", STRIP_COMPONENTS,
+            `${PACKAGE_ROOT}/${binaryFilename(arch)}`],
+        target: platformPackage(arch),
+    });
+};
+
+const cachedTarballUrl = (arch: DeployArchName, version: string): string =>
+    `${registryUrl()}/${platformPackage(arch)}/-/${platformStem(arch)}-${version}.tgz`;
+
+const tarballFor = async (arch: DeployArchName, version: string, sidecar: string): Promise<Tarball> => {
+    const cached = readCachedDigest(sidecar, "sha512");
+
+    if (cached !== undefined) {
+        return { url: cachedTarballUrl(arch, version), digest: cached };
+    }
+
+    const published = await publishedTarball(arch, version);
+    writeAtomically(sidecar, published.digest);
+
+    return published;
+};
+
+const downloadedBinary = async (arch: DeployArchName, version: string): Promise<string> => {
+    const dir = cacheDir(["native", `${version}-linux-${arch}`]);
+    const archive = join(dir, `${platformStem(arch)}-${version}.tgz`);
+    const tarball = await tarballFor(arch, version, `${archive}.sha512`);
+
+    await downloadFile({
+        url: tarball.url,
+        dest: archive,
+        label: `${platformPackage(arch)} ${version}`,
+        digest: tarball.digest,
+        algorithm: "sha512",
+    });
+
+    extractAddon(archive, dir, arch);
+
+    return join(dir, binaryFilename(arch));
+};
+
+const resolveStagedAddon = async (settings: DeploySettings): Promise<string | null> => {
+    const arch = settings.arch.node;
+
+    if (isHostArch(arch)) {
+        return null;
+    }
+
+    const projectRequire = projectRequireFor(settings.paths.root);
+    const resolved = localBinary(projectRequire, arch) ?? installedBinary(projectRequire, arch);
+
+    return resolved ?? await downloadedBinary(arch, nativeVersion(projectRequire));
+};
+
+export { BINDING_FILENAME, resolveStagedAddon };

package/src/deploy/nfpm/config.ts

@@ -1,5 +1,6 @@
 import type { DeployPayload, DeploySettings, StagedFile } from "../types.js";
 import { resolveDepends } from "../depends.js";
+import { glibcMinimumForFiles } from "../node-runtime/elf.js";
 import { groupForCategories, sectionForCategories } from "../settings/categories.js";
 import { nfpmContents } from "./contents.js";
 import { debDescription, rpmDescription } from "./description.js";
@@ -113,6 +114,9 @@ const stagedFilesFor = (payload: DeployPayload, packager: NfpmPackager): StagedF
     ...payload.overlays[packager],
 ];
 
+const glibcMinimumForPackage = (payload: DeployPayload, packager: NfpmPackager): string | null =>
+    glibcMinimumForFiles(stagedFilesFor(payload, packager).map((file) => file.abs));
+
 const packagerSettings = (settings: DeploySettings, packager: NfpmPackager): NfpmConfig =>
     packager === "rpm" ? rpmSettings(settings) : debSettings(settings);
 
@@ -122,10 +126,15 @@ const releaseFor = (settings: DeploySettings, packager: NfpmPackager): string =>
 const descriptionFor = (settings: DeploySettings, packager: NfpmPackager): string =>
     packager === "rpm" ? rpmDescription(settings) : debDescription(settings);
 
-const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmConfig => {
+const renderNfpmConfig = (
+    payload: DeployPayload,
+    packager: NfpmPackager,
+    glibcMinimum: string | null,
+): NfpmConfig => {
     const settings = payload.settings;
     const isRpm = packager === "rpm";
-    const depends = resolveDepends(settings, payload.node?.glibcMinimum ?? null);
+    const staged = stagedFilesFor(payload, packager);
+    const depends = resolveDepends(settings, glibcMinimum);
 
     return {
         name: packageNameFor(settings, packager),
@@ -146,8 +155,8 @@ const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmC
         ...relationsFor(settings, packager),
         ...optional("scripts", scriptsFor(settings)),
         [packager]: packagerSettings(settings, packager),
-        contents: nfpmContents(PREFIX, stagedFilesFor(payload, packager), isRpm),
+        contents: nfpmContents(PREFIX, staged, isRpm),
     };
 };
 
-export { type NfpmPackager, packageNameFor, renderNfpmConfig };
+export { glibcMinimumForPackage, type NfpmPackager, packageNameFor, renderNfpmConfig };

package/src/deploy/nfpm/contents.ts

@@ -13,10 +13,16 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr",
     "/usr/bin",
     "/usr/lib",
+    "/usr/lib/systemd",
+    "/usr/lib/systemd/system",
+    "/usr/lib/systemd/user",
+    "/usr/libexec",
     "/usr/share",
     "/usr/share/applications",
     "/usr/share/dbus-1",
     "/usr/share/dbus-1/services",
+    "/usr/share/dbus-1/system-services",
+    "/usr/share/dbus-1/system.d",
     "/usr/share/doc",
     "/usr/share/glib-2.0",
     "/usr/share/glib-2.0/schemas",
@@ -25,6 +31,8 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr/share/metainfo",
     "/usr/share/mime",
     "/usr/share/mime/packages",
+    "/usr/share/polkit-1",
+    "/usr/share/polkit-1/actions",
 ]);
 
 const ICON_THEME_PREFIX = "/usr/share/icons/";

package/src/deploy/node-runtime/download.ts

@@ -44,8 +44,8 @@ const downloadNode = async (version: string, arch: string, destDir: string): Pro
         url: `${DIST_BASE_URL}/v${version}/${assetName}`,
         dest: join(dir, assetName),
         label: `Node.js ${version} for linux-${arch}`,
-        sha256: await cachedDigest(request),
-        freshSha256: () => publishedDigest(request),
+        digest: await cachedDigest(request),
+        freshDigest: () => publishedDigest(request),
     });
 
     mkdirSync(destDir, { recursive: true });