@gtkx/cli 2.0.0-beta.1 → 2.0.0-beta.10

package/src/deploy/freedesktop/metainfo.ts

@@ -14,6 +14,54 @@ import { element, renderDocument, text, type XmlNode } from "./xml.js";
 
 const COMPONENT_TYPE = "desktop-application";
 const DESKTOP_SUFFIX = ".desktop";
+const COMPONENT_CLOSE = "</component>\n";
+const PROVIDES_CLOSE = "    </provides>\n";
+const PROVIDES_FRAGMENT = /^<provides\s*>([\s\S]*)<\/provides>$/;
+
+const normalizeExtraFragment = (fragment: string, index: number): string => {
+    const normalized = fragment.trim();
+
+    if (normalized.length === 0) {
+        throw new Error(`Cannot render deploy.metainfoExtra entry ${String(index + 1)}: it is empty`);
+    }
+
+    return normalized;
+};
+
+const indentFragment = (fragment: string, depth: number): string => {
+    const indentation = " ".repeat(depth * 4);
+
+    return fragment.split(/\r?\n/).map((line) => `${indentation}${line}`).join("\n");
+};
+
+const appendExtraFragments = (document: string, fragments: string[]): string => {
+    if (fragments.length === 0) {
+        return document;
+    }
+
+    let merged = document;
+    const componentFragments: string[] = [];
+
+    for (const [index, rawFragment] of fragments.entries()) {
+        const fragment = normalizeExtraFragment(rawFragment, index);
+        const provides = PROVIDES_FRAGMENT.exec(fragment)?.[1]?.trim();
+
+        if (provides === undefined) {
+            componentFragments.push(fragment);
+            continue;
+        }
+
+        merged = merged.replace(PROVIDES_CLOSE, () => `${indentFragment(provides, 2)}\n${PROVIDES_CLOSE}`);
+    }
+
+    if (componentFragments.length === 0) {
+        return merged;
+    }
+
+    const extra = componentFragments.map((fragment) => indentFragment(fragment, 1)).join("\n");
+
+    return merged.replace(COMPONENT_CLOSE, () => `${extra}\n${COMPONENT_CLOSE}`);
+};
 
 const launchable = (applicationId: string): XmlNode => ({
     tag: "launchable",
@@ -21,26 +69,30 @@ const launchable = (applicationId: string): XmlNode => ({
     text: `${applicationId}${DESKTOP_SUFFIX}`,
 });
 
-const renderMetainfo = (settings: DeploySettings): string =>
-    renderDocument(
-        element("component", { type: COMPONENT_TYPE }, [
-            text("id", settings.applicationId),
-            text("name", settings.name),
-            text("summary", settings.summary),
-            text("metadata_license", settings.metadataLicense),
-            text("project_license", settings.license),
-            ...developerSection(settings),
-            ...descriptionSection(settings),
-            launchable(settings.applicationId),
-            ...providesSection(settings),
-            ...listSection("categories", "category", settings.categories),
-            ...listSection("keywords", "keyword", settings.keywords),
-            ...urlsSection(settings),
-            ...screenshotsSection(settings),
-            ...releasesSection(settings),
-            ...contentRatingSection(settings),
-            ...brandingSection(settings),
-        ]),
-    );
+const metainfoRoot = (settings: DeploySettings): XmlNode =>
+    element("component", { type: COMPONENT_TYPE }, [
+        text("id", settings.applicationId),
+        text("name", settings.name),
+        text("summary", settings.summary),
+        text("metadata_license", settings.metadataLicense),
+        text("project_license", settings.license),
+        ...developerSection(settings),
+        ...descriptionSection(settings),
+        launchable(settings.applicationId),
+        ...providesSection(settings),
+        ...listSection("categories", "category", settings.categories),
+        ...listSection("keywords", "keyword", settings.keywords),
+        ...urlsSection(settings),
+        ...screenshotsSection(settings),
+        ...releasesSection(settings),
+        ...contentRatingSection(settings),
+        ...brandingSection(settings),
+    ]);
+
+const renderMetainfo = (settings: DeploySettings): string => {
+    const document = renderDocument(metainfoRoot(settings));
+
+    return appendExtraFragments(document, settings.deploy.metainfoExtra ?? []);
+};
 
 export { renderMetainfo };

package/src/deploy/freedesktop/validate.ts

@@ -6,12 +6,20 @@ type ToolResult = {
     status: number;
 };
 
+type Diagnostic = {
+    severity: string;
+    rule: string;
+    detail: string;
+};
+
 type MetainfoResult = {
     subject: string;
     output: string;
     status: number;
     errors: string[];
     warnings: string[];
+    rules: string[];
+    notes: string[];
     areWarningsFatal: boolean;
 };
 
@@ -21,10 +29,19 @@ type ToolRequest = {
     subject: string;
 };
 
-const DIAGNOSTIC = /^(?<severity>[EIPW]): \S+ (?<rule>[\w-]+)/;
+const DIAGNOSTIC = /^(?<severity>[EIPW]): \S+ (?<rule>[\w-]+)(?: (?<detail>.*))?$/;
+const SUCCESS_SUMMARY = /^\W*Validation was successful/u;
 const ERROR_SEVERITY = "E";
 const WARNING_SEVERITY = "W";
 const INFO_SEVERITY = "I";
+const FATAL_WARNING_RULES: Set<string> = new Set(["unknown-tag"]);
+const DESKTOP_ERROR = /(?:^|:\s)error:/iu;
+
+const FATAL_RULE_NOTES: Record<string, (detail: string) => string> = {
+    "unknown-tag": (element) =>
+        "GTKX treats unknown-tag as fatal for every target, whatever severity appstreamcli assigns it; " +
+        `the unsupported element is <${element}>`,
+};
 
 const REMEDY_FOR_RULE: Record<string, string> = {
     "component-summary-missing": "set `deploy.summary`",
@@ -33,6 +50,7 @@ const REMEDY_FOR_RULE: Record<string, string> = {
     "metainfo-legacy-path": "this file is generated; report it as a gtkx bug",
     "summary-has-dot-suffix": "drop the trailing period from `deploy.summary`",
     "summary-too-long": "shorten `deploy.summary`",
+    "unknown-tag": "remove the unsupported `deploy.metainfoExtra` element or use a `<custom>` value",
     "url-homepage-missing": "set `deploy.homepage`, or `homepage` in package.json",
 };
 
@@ -46,12 +64,31 @@ const runTool = ({ tool, args, subject }: ToolRequest): ToolResult => {
     return { output: [result.stdout, result.stderr].join("\n").trim(), status: result.status ?? 0 };
 };
 
-const rulesIn = (output: string, severities: string[]): string[] =>
+const parseDiagnostics = (output: string): Diagnostic[] =>
+    output.split("\n").flatMap((line) => {
+        const groups = DIAGNOSTIC.exec(line)?.groups;
+
+        return groups === undefined
+            ? []
+            : [{ severity: groups.severity ?? "", rule: groups.rule ?? "", detail: (groups.detail ?? "").trim() }];
+    });
+
+const rulesIn = (diagnostics: Diagnostic[], severities: string[]): string[] =>
+    diagnostics.filter((diagnostic) => severities.includes(diagnostic.severity)).map((diagnostic) => diagnostic.rule);
+
+const fatalNotes = (diagnostics: Diagnostic[]): string[] =>
+    diagnostics
+        .filter((diagnostic) => diagnostic.severity !== ERROR_SEVERITY && FATAL_WARNING_RULES.has(diagnostic.rule))
+        .map((diagnostic) =>
+            FATAL_RULE_NOTES[diagnostic.rule]?.(diagnostic.detail) ??
+            `GTKX treats ${diagnostic.rule} as fatal for every target`);
+
+const withoutSuccessSummary = (output: string): string =>
     output
         .split("\n")
-        .map((line) => DIAGNOSTIC.exec(line)?.groups)
-        .filter((groups) => groups !== undefined && severities.includes(groups.severity ?? ""))
-        .map((groups) => groups?.rule ?? "");
+        .filter((line) => !SUCCESS_SUMMARY.test(line))
+        .join("\n")
+        .trimEnd();
 
 const remedyLines = (rules: string[]): string[] => {
     const remedies = sortStrings([...new Set(rules)])
@@ -61,14 +98,23 @@ const remedyLines = (rules: string[]): string[] => {
     return remedies.length === 0 ? [] : ["", "Fix it in gtkx.config.ts:", ...remedies];
 };
 
-const invalid = (subject: string, output: string, rules: string[]): Error =>
-    new Error([`${subject} is not valid:`, output.length > 0 ? output : "no output", ...remedyLines(rules)].join("\n"));
+const invalid = (subject: string, output: string, rules: string[], notes: string[]): Error =>
+    new Error([
+        `${subject} is not valid:`,
+        output.length > 0 ? output : "no output",
+        ...notes,
+        ...remedyLines(rules),
+    ].join("\n"));
 
-const isFatalResult = ({ status, errors, warnings, areWarningsFatal }: MetainfoResult): boolean => {
+const isFatalResult = ({ status, errors, warnings, rules, areWarningsFatal }: MetainfoResult): boolean => {
     if (errors.length > 0) {
         return true;
     }
 
+    if (rules.some((rule) => FATAL_WARNING_RULES.has(rule))) {
+        return true;
+    }
+
     if (areWarningsFatal && warnings.length > 0) {
         return true;
     }
@@ -78,7 +124,7 @@ const isFatalResult = ({ status, errors, warnings, areWarningsFatal }: MetainfoR
 
 const assertNotFatal = (result: MetainfoResult): void => {
     if (isFatalResult(result)) {
-        throw invalid(result.subject, result.output, [...result.errors, ...result.warnings]);
+        throw invalid(result.subject, result.output, result.rules, result.notes);
     }
 };
 
@@ -101,8 +147,14 @@ const validateDesktopEntry = (path: string): void => {
         subject: "The desktop entry",
     });
 
-    if (status !== 0 || output.length > 0) {
-        throw invalid("The desktop entry", output, []);
+    const diagnostics = output.split("\n").filter((line) => line.length > 0);
+
+    if (status !== 0 || diagnostics.some((line) => DESKTOP_ERROR.test(line))) {
+        throw invalid("The desktop entry", output, [], []);
+    }
+
+    for (const diagnostic of diagnostics) {
+        warn(diagnostic);
     }
 };
 
@@ -115,10 +167,23 @@ const validateMetainfo = (path: string, areWarningsFatal: boolean): void => {
         subject,
     });
 
-    const errors = rulesIn(output, [ERROR_SEVERITY]);
-    const warnings = rulesIn(output, [WARNING_SEVERITY]);
-    assertNotFatal({ subject, output, status, errors, warnings, areWarningsFatal });
-    reportDiagnostics(subject, [...warnings, ...rulesIn(output, [INFO_SEVERITY])]);
+    const diagnostics = parseDiagnostics(output);
+    const errors = rulesIn(diagnostics, [ERROR_SEVERITY]);
+    const warnings = rulesIn(diagnostics, [WARNING_SEVERITY]);
+    const infos = rulesIn(diagnostics, [INFO_SEVERITY]);
+    const rules = [...errors, ...warnings, ...infos];
+    const notes = fatalNotes(diagnostics);
+    assertNotFatal({
+        subject,
+        output: withoutSuccessSummary(output),
+        status,
+        errors,
+        warnings,
+        rules,
+        notes,
+        areWarningsFatal,
+    });
+    reportDiagnostics(subject, [...warnings, ...infos]);
 };
 
 export { validateDesktopEntry, validateMetainfo };

package/src/deploy/native-addon.ts

@@ -0,0 +1,183 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import type { DeployArchName, DeploySettings } from "./types.js";
+import { runCliTool } from "../internal/run-cli-tool.js";
+import { cacheDir, downloadFile, readCachedDigest, writeAtomically } from "./download.js";
+import { isHostArch } from "./settings/arch.js";
+
+type ProjectRequire = ReturnType<typeof createRequire>;
+type Tarball = { url: string; digest: string };
+
+const BINDING_FILENAME = "gtkx.node";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const NATIVE_MANIFEST = "@gtkx/native/package.json";
+const PACKAGE_ROOT = "package";
+const REQUEST_TIMEOUT = 30_000;
+const SRI_PREFIX = "sha512-";
+const STRIP_COMPONENTS = "1";
+const VERSION_PATTERN = /^[\w.+-]+$/;
+
+const binaryFilename = (arch: DeployArchName): string => `native.linux-${arch}-gnu.node`;
+const platformStem = (arch: DeployArchName): string => `native-linux-${arch}-gnu`;
+const platformPackage = (arch: DeployArchName): string => `@gtkx/${platformStem(arch)}`;
+
+const withoutTrailingSlash = (value: string): string => {
+    let end = value.length;
+
+    while (end > 0 && value[end - 1] === "/") {
+        end -= 1;
+    }
+
+    return value.slice(0, end);
+};
+
+const registryUrl = (): string => {
+    const configured = process.env.npm_config_registry;
+
+    return withoutTrailingSlash(configured !== undefined && configured.length > 0 ? configured : DEFAULT_REGISTRY);
+};
+
+const projectRequireFor = (root: string): ProjectRequire => createRequire(join(root, "package.json"));
+
+const localBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    const nativeRoot = dirname(projectRequire.resolve(NATIVE_MANIFEST));
+    const candidate = join(nativeRoot, binaryFilename(arch));
+
+    return existsSync(candidate) ? candidate : null;
+};
+
+const installedBinary = (projectRequire: ProjectRequire, arch: DeployArchName): string | null => {
+    try {
+        return projectRequire.resolve(platformPackage(arch));
+    } catch {
+        return null;
+    }
+};
+
+const manifestVersion = (manifest: unknown): string | null => {
+    if (typeof manifest !== "object" || manifest === null || !("version" in manifest)) {
+        return null;
+    }
+
+    const version = manifest.version;
+
+    return typeof version === "string" && VERSION_PATTERN.test(version) ? version : null;
+};
+
+const nativeVersion = (projectRequire: ProjectRequire): string => {
+    const parsed: unknown = JSON.parse(readFileSync(projectRequire.resolve(NATIVE_MANIFEST), "utf8"));
+    const version = manifestVersion(parsed);
+
+    if (version === null) {
+        throw new Error("Cannot read a usable version from @gtkx/native; is it installed?");
+    }
+
+    return version;
+};
+
+const hexFromIntegrity = (integrity: unknown, subject: string): string => {
+    if (typeof integrity !== "string" || !integrity.startsWith(SRI_PREFIX)) {
+        throw new Error(`The npm registry publishes no sha512 integrity for ${subject}`);
+    }
+
+    return Buffer.from(integrity.slice(SRI_PREFIX.length), "base64").toString("hex");
+};
+
+const fetchVersionDocument = async (url: string, subject: string): Promise<Record<string, unknown>> => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT) });
+
+    if (!response.ok) {
+        throw new Error(
+            `Cannot fetch ${subject}: HTTP ${String(response.status)} ${response.statusText}. ` +
+            `Install ${subject} directly, or drop that architecture from --arch.`,
+        );
+    }
+
+    const document: unknown = await response.json();
+
+    if (typeof document !== "object" || document === null) {
+        throw new Error(`The npm registry returned no metadata for ${subject}`);
+    }
+
+    return document as Record<string, unknown>;
+};
+
+const publishedTarball = async (arch: DeployArchName, version: string): Promise<Tarball> => {
+    const registry = registryUrl();
+    const subject = `${platformPackage(arch)}@${version}`;
+    const url = `${registry}/${encodeURIComponent(platformPackage(arch))}/${version}`;
+    const document = await fetchVersionDocument(url, subject);
+    const dist: unknown = document.dist;
+
+    if (typeof dist !== "object" || dist === null) {
+        throw new Error(`The npm registry returned no tarball for ${subject}`);
+    }
+
+    const entry = dist as Record<string, unknown>;
+    const tarball = entry.tarball;
+
+    if (typeof tarball !== "string" || new URL(tarball).origin !== new URL(registry).origin) {
+        throw new Error(`The npm registry returned an unusable tarball URL for ${subject}`);
+    }
+
+    return { url: tarball, digest: hexFromIntegrity(entry.integrity, subject) };
+};
+
+const extractAddon = (archive: string, dir: string, arch: DeployArchName): void => {
+    runCliTool({
+        tool: "tar",
+        args: ["-xzf", archive, "-C", dir, "--strip-components", STRIP_COMPONENTS,
+            `${PACKAGE_ROOT}/${binaryFilename(arch)}`],
+        target: platformPackage(arch),
+    });
+};
+
+const cachedTarballUrl = (arch: DeployArchName, version: string): string =>
+    `${registryUrl()}/${platformPackage(arch)}/-/${platformStem(arch)}-${version}.tgz`;
+
+const tarballFor = async (arch: DeployArchName, version: string, sidecar: string): Promise<Tarball> => {
+    const cached = readCachedDigest(sidecar, "sha512");
+
+    if (cached !== undefined) {
+        return { url: cachedTarballUrl(arch, version), digest: cached };
+    }
+
+    const published = await publishedTarball(arch, version);
+    writeAtomically(sidecar, published.digest);
+
+    return published;
+};
+
+const downloadedBinary = async (arch: DeployArchName, version: string): Promise<string> => {
+    const dir = cacheDir(["native", `${version}-linux-${arch}`]);
+    const archive = join(dir, `${platformStem(arch)}-${version}.tgz`);
+    const tarball = await tarballFor(arch, version, `${archive}.sha512`);
+
+    await downloadFile({
+        url: tarball.url,
+        dest: archive,
+        label: `${platformPackage(arch)} ${version}`,
+        digest: tarball.digest,
+        algorithm: "sha512",
+    });
+
+    extractAddon(archive, dir, arch);
+
+    return join(dir, binaryFilename(arch));
+};
+
+const resolveStagedAddon = async (settings: DeploySettings): Promise<string | null> => {
+    const arch = settings.arch.node;
+
+    if (isHostArch(arch)) {
+        return null;
+    }
+
+    const projectRequire = projectRequireFor(settings.paths.root);
+    const resolved = localBinary(projectRequire, arch) ?? installedBinary(projectRequire, arch);
+
+    return resolved ?? await downloadedBinary(arch, nativeVersion(projectRequire));
+};
+
+export { BINDING_FILENAME, resolveStagedAddon };

package/src/deploy/nfpm/config.ts

@@ -1,5 +1,6 @@
 import type { DeployPayload, DeploySettings, StagedFile } from "../types.js";
 import { resolveDepends } from "../depends.js";
+import { glibcMinimumForFiles } from "../node-runtime/elf.js";
 import { groupForCategories, sectionForCategories } from "../settings/categories.js";
 import { nfpmContents } from "./contents.js";
 import { debDescription, rpmDescription } from "./description.js";
@@ -113,6 +114,9 @@ const stagedFilesFor = (payload: DeployPayload, packager: NfpmPackager): StagedF
     ...payload.overlays[packager],
 ];
 
+const glibcMinimumForPackage = (payload: DeployPayload, packager: NfpmPackager): string | null =>
+    glibcMinimumForFiles(stagedFilesFor(payload, packager).map((file) => file.abs));
+
 const packagerSettings = (settings: DeploySettings, packager: NfpmPackager): NfpmConfig =>
     packager === "rpm" ? rpmSettings(settings) : debSettings(settings);
 
@@ -122,10 +126,15 @@ const releaseFor = (settings: DeploySettings, packager: NfpmPackager): string =>
 const descriptionFor = (settings: DeploySettings, packager: NfpmPackager): string =>
     packager === "rpm" ? rpmDescription(settings) : debDescription(settings);
 
-const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmConfig => {
+const renderNfpmConfig = (
+    payload: DeployPayload,
+    packager: NfpmPackager,
+    glibcMinimum: string | null,
+): NfpmConfig => {
     const settings = payload.settings;
     const isRpm = packager === "rpm";
-    const depends = resolveDepends(settings, payload.node?.glibcMinimum ?? null);
+    const staged = stagedFilesFor(payload, packager);
+    const depends = resolveDepends(settings, glibcMinimum);
 
     return {
         name: packageNameFor(settings, packager),
@@ -146,8 +155,8 @@ const renderNfpmConfig = (payload: DeployPayload, packager: NfpmPackager): NfpmC
         ...relationsFor(settings, packager),
         ...optional("scripts", scriptsFor(settings)),
         [packager]: packagerSettings(settings, packager),
-        contents: nfpmContents(PREFIX, stagedFilesFor(payload, packager), isRpm),
+        contents: nfpmContents(PREFIX, staged, isRpm),
     };
 };
 
-export { type NfpmPackager, packageNameFor, renderNfpmConfig };
+export { glibcMinimumForPackage, type NfpmPackager, packageNameFor, renderNfpmConfig };

package/src/deploy/nfpm/contents.ts

@@ -13,10 +13,16 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr",
     "/usr/bin",
     "/usr/lib",
+    "/usr/lib/systemd",
+    "/usr/lib/systemd/system",
+    "/usr/lib/systemd/user",
+    "/usr/libexec",
     "/usr/share",
     "/usr/share/applications",
     "/usr/share/dbus-1",
     "/usr/share/dbus-1/services",
+    "/usr/share/dbus-1/system-services",
+    "/usr/share/dbus-1/system.d",
     "/usr/share/doc",
     "/usr/share/glib-2.0",
     "/usr/share/glib-2.0/schemas",
@@ -25,6 +31,8 @@ const FILESYSTEM_OWNED_PREFIXES = new Set([
     "/usr/share/metainfo",
     "/usr/share/mime",
     "/usr/share/mime/packages",
+    "/usr/share/polkit-1",
+    "/usr/share/polkit-1/actions",
 ]);
 
 const ICON_THEME_PREFIX = "/usr/share/icons/";

package/src/deploy/node-runtime/download.ts

@@ -44,8 +44,8 @@ const downloadNode = async (version: string, arch: string, destDir: string): Pro
         url: `${DIST_BASE_URL}/v${version}/${assetName}`,
         dest: join(dir, assetName),
         label: `Node.js ${version} for linux-${arch}`,
-        sha256: await cachedDigest(request),
-        freshSha256: () => publishedDigest(request),
+        digest: await cachedDigest(request),
+        freshDigest: () => publishedDigest(request),
     });
 
     mkdirSync(destDir, { recursive: true });

package/src/deploy/node-runtime/elf.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { closeSync, openSync, readFileSync, readSync } from "node:fs";
 
 type ElfSection = {
     name: string;
@@ -7,6 +7,7 @@ type ElfSection = {
 };
 
 type ElfInfo = {
+    machine: number;
     needed: string[];
     glibcMinimum: string | null;
 };
@@ -17,10 +18,12 @@ type DynamicEntry = {
 };
 
 const ELF_MAGIC = "ELF";
+const ELF_MAGIC_SIZE = 4;
 const CLASS_64 = 2;
 const LITTLE_ENDIAN = 1;
 const OFFSET_CLASS = 4;
 const OFFSET_DATA = 5;
+const OFFSET_MACHINE = 0x12;
 const OFFSET_SECTION_HEADERS = 0x28;
 const OFFSET_SECTION_ENTRY_SIZE = 0x3A;
 const OFFSET_SECTION_COUNT = 0x3C;
@@ -35,8 +38,11 @@ const DYNAMIC_VALUE_OFFSET = 8;
 const GLIBC_VERSION = /GLIBC_(\d+)\.(\d+)/g;
 const VERSION_RADIX = 1000;
 
+const hasElfMagic = (buffer: Buffer): boolean =>
+    buffer.length >= OFFSET_CLASS && buffer.subarray(0, 4).toString("latin1") === ELF_MAGIC;
+
 const assertElf64 = (buffer: Buffer, path: string): void => {
-    if (buffer.length < OFFSET_SECTION_NAME_INDEX || buffer.subarray(0, 4).toString("latin1") !== ELF_MAGIC) {
+    if (buffer.length < OFFSET_SECTION_NAME_INDEX || !hasElfMagic(buffer)) {
         throw new Error(`Cannot read ${path}: it is not an ELF binary`);
     }
 
@@ -130,16 +136,51 @@ const readGlibcMinimum = (strings: Buffer): string | null => {
 const stringTable = (buffer: Buffer, dynstr: ElfSection | undefined): Buffer =>
     dynstr === undefined ? Buffer.alloc(0) : buffer.subarray(dynstr.offset, dynstr.offset + dynstr.size);
 
-const readElfInfo = (path: string): ElfInfo => {
-    const buffer = readFileSync(path);
+const readElfBuffer = (buffer: Buffer, path: string): ElfInfo => {
     assertElf64(buffer, path);
     const sections = readSections(buffer);
     const strings = stringTable(buffer, sectionFor(sections, ".dynstr"));
 
     return {
+        machine: buffer.readUInt16LE(OFFSET_MACHINE),
         needed: readNeeded(buffer, sectionFor(sections, ".dynamic"), strings),
         glibcMinimum: readGlibcMinimum(strings),
     };
 };
 
-export { type ElfInfo, readElfInfo };
+const readElfInfo = (path: string): ElfInfo => readElfBuffer(readFileSync(path), path);
+
+const readFilePrefix = (descriptor: number, size: number): Buffer => {
+    const buffer = Buffer.alloc(size);
+    const bytesRead = readSync(descriptor, buffer, 0, size, 0);
+
+    return buffer.subarray(0, bytesRead);
+};
+
+const readOptionalElfInfo = (path: string): ElfInfo | null => {
+    const descriptor = openSync(path, "r");
+
+    try {
+        const prefix = readFilePrefix(descriptor, ELF_MAGIC_SIZE);
+
+        return hasElfMagic(prefix) ? readElfBuffer(readFileSync(descriptor), path) : null;
+    } finally {
+        closeSync(descriptor);
+    }
+};
+
+const glibcMinimumForFiles = (paths: Iterable<string>): string | null => {
+    const versions: number[][] = [];
+
+    for (const path of paths) {
+        const minimum = readOptionalElfInfo(path)?.glibcMinimum;
+
+        if (minimum !== undefined && minimum !== null) {
+            versions.push(minimum.split(".").map(Number));
+        }
+    }
+
+    return formatVersion(highestVersion(versions));
+};
+
+export { type ElfInfo, glibcMinimumForFiles, readElfInfo, readOptionalElfInfo };

package/src/deploy/node-runtime/guard.ts

@@ -1,19 +1,16 @@
 import type { ElfInfo } from "./elf.js";
+import { RUNTIME_SONAMES } from "./sonames.js";
 
-const PORTABLE_LIBRARIES = new Set([
-    "ld-linux-aarch64.so.1",
-    "ld-linux-x86-64.so.2",
-    "libc.so.6",
-    "libdl.so.2",
-    "libgcc_s.so.1",
-    "libm.so.6",
-    "libpthread.so.0",
-    "librt.so.1",
-    "libstdc++.so.6",
-]);
+const DOWNLOAD_REMEDY =
+    "The packages GTKX generates declare the libraries an official release links against, and this release " +
+    "links against more. Report it to GTKX, and pin `deploy.node.version` to a release it already packages.";
+
+const SOURCE_REMEDY = 'Use `deploy.node.source: "download"` to fetch an official self-contained build instead.';
+
+const remedyFor = (source: string): string => (source === "download" ? DOWNLOAD_REMEDY : SOURCE_REMEDY);
 
 const assertPortableNode = (info: ElfInfo, source: string): void => {
-    const foreign = info.needed.filter((library) => !PORTABLE_LIBRARIES.has(library));
+    const foreign = info.needed.filter((library) => !RUNTIME_SONAMES.has(library));
 
     if (foreign.length === 0) {
         return;
@@ -21,8 +18,7 @@ const assertPortableNode = (info: ElfInfo, source: string): void => {
 
     throw new Error(
         `Cannot bundle this Node.js binary: \`deploy.node.source: "${source}"\` picked one linked against ` +
-        `${foreign.join(", ")}, which the target machine will not have. ` +
-        'Use `deploy.node.source: "download"` to fetch an official self-contained build instead.',
+        `${foreign.join(", ")}, which the packages GTKX generates do not require. ${remedyFor(source)}`,
     );
 };