@intincrab/updiff 0.0.0-stage → 0.2.0

package/dist/cask-history.js

@@ -0,0 +1,216 @@
+import { fetchCask } from "./cask.js";
+import { mapLimit } from "./util.js";
+import { TOOL_VERSION } from "./version.js";
+const OLDER_ONLY = /:or_older/;
+/**
+ * Keeps the lines of a cask that apply to a current Apple silicon Mac: `on_arm` and
+ * `on_<macOS> :or_newer` blocks and top-level stanzas. Drops `on_intel`, blocks for
+ * older macOS versions, and blocks such as `livecheck`, `zap` and `uninstall`.
+ */
+function linesForThisMac(source) {
+    const kept = [];
+    const stack = [];
+    for (const line of source.split('\n')) {
+        const opens = /^\s*(\S+)(.*?)\bdo(\s*\|[^|]*\|)?\s*$/.exec(line);
+        if (opens) {
+            const name = opens[1];
+            const args = opens[2] ?? '';
+            let keep;
+            if (name === 'cask')
+                keep = true;
+            else if (name === 'on_arm')
+                keep = true;
+            else if (name === 'on_intel')
+                keep = false;
+            else if (/^on_[a-z_]+$/.test(name) && name !== 'on_arm')
+                keep = /:or_newer/.test(args) && !OLDER_ONLY.test(args);
+            else
+                keep = false;
+            stack.push(keep);
+            continue;
+        }
+        if (/^\s*end\s*$/.test(line)) {
+            stack.pop();
+            continue;
+        }
+        if (stack.every(Boolean))
+            kept.push(line);
+    }
+    return kept;
+}
+/** The last `version` stanza outside livecheck, for casks that only set it inside OS blocks. */
+function lastVersionAnywhere(source) {
+    const withoutLivecheck = source.replace(/\n\s*livecheck do[\s\S]*?\n\s*end\b/g, '\n');
+    const all = [...withoutLivecheck.matchAll(/^\s*version\s+"([^"]+)"/gm)];
+    return all.at(-1)?.[1];
+}
+/** Reads version, URL template, checksum and arch from a cask's Ruby source. */
+export function parseCaskSource(source) {
+    const text = linesForThisMac(source).join('\n');
+    const version = /^\s*version\s+"([^"]+)"/m.exec(text)?.[1] ?? lastVersionAnywhere(source);
+    const url = /^\s*url\s+"([^"]+)"/m.exec(text)?.[1];
+    const shaArm = /sha256\s+arm:\s*"([0-9a-f]{64})"/i.exec(text)?.[1];
+    const shaOne = /^\s*sha256\s+"([0-9a-f]{64})"/im.exec(text)?.[1];
+    const arch = /^\s*arch\s+arm:\s*"([^"]*)"/m.exec(source)?.[1];
+    return { version, url, sha256: (shaArm ?? shaOne)?.toLowerCase() ?? null, arch };
+}
+/** Applies a chain of Homebrew version methods: `version.csv.first.no_dots`. */
+export function applyVersionMethods(version, chain) {
+    let value = version;
+    for (const method of chain) {
+        const s = Array.isArray(value) ? undefined : value;
+        switch (method) {
+            case 'csv':
+                if (s === undefined)
+                    return undefined;
+                value = s.split(',');
+                break;
+            case 'first':
+            case 'second':
+            case 'third': {
+                if (!Array.isArray(value))
+                    return undefined;
+                const item = value[['first', 'second', 'third'].indexOf(method)];
+                if (item === undefined)
+                    return undefined;
+                value = item;
+                break;
+            }
+            case 'before_comma':
+                if (s === undefined)
+                    return undefined;
+                value = s.split(',')[0];
+                break;
+            case 'after_comma': {
+                const after = s?.split(',')[1];
+                if (after === undefined)
+                    return undefined;
+                value = after;
+                break;
+            }
+            case 'major':
+            case 'minor':
+            case 'patch': {
+                const part = s?.split(/[.,-]/)[['major', 'minor', 'patch'].indexOf(method)];
+                if (part === undefined)
+                    return undefined;
+                value = part;
+                break;
+            }
+            case 'major_minor':
+            case 'major_minor_patch': {
+                if (s === undefined)
+                    return undefined;
+                value = s.split('.').slice(0, method === 'major_minor' ? 2 : 3).join('.');
+                break;
+            }
+            case 'no_dots':
+                if (s === undefined)
+                    return undefined;
+                value = s.replace(/\./g, '');
+                break;
+            case 'dots_to_underscores':
+                if (s === undefined)
+                    return undefined;
+                value = s.replace(/\./g, '_');
+                break;
+            case 'dots_to_hyphens':
+                if (s === undefined)
+                    return undefined;
+                value = s.replace(/\./g, '-');
+                break;
+            case 'no_hyphens':
+                if (s === undefined)
+                    return undefined;
+                value = s.replace(/-/g, '');
+                break;
+            default:
+                return undefined;
+        }
+    }
+    return Array.isArray(value) ? undefined : value;
+}
+/** Fills `#{version…}` and `#{arch}` in a cask URL. Undefined if anything is left unresolved. */
+export function resolveCaskUrl(template, version, arch) {
+    let unresolved = false;
+    const url = template.replace(/#\{([^}]+)\}/g, (_, expr) => {
+        const e = expr.trim();
+        if (e === 'arch') {
+            if (arch === undefined)
+                unresolved = true;
+            return arch ?? '';
+        }
+        const parts = e.split('.');
+        if (parts[0] !== 'version') {
+            unresolved = true;
+            return '';
+        }
+        const value = applyVersionMethods(version, parts.slice(1));
+        if (value === undefined)
+            unresolved = true;
+        return value ?? '';
+    });
+    return unresolved ? undefined : url;
+}
+export function githubApiBase() {
+    return (process.env.UPDIFF_GITHUB_API ?? 'https://api.github.com').replace(/\/$/, '');
+}
+export function githubRawBase() {
+    return (process.env.UPDIFF_GITHUB_RAW ?? 'https://raw.githubusercontent.com').replace(/\/$/, '');
+}
+function githubHeaders() {
+    const headers = { 'user-agent': `updiff/${TOOL_VERSION}`, accept: 'application/vnd.github+json' };
+    const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    return headers;
+}
+/**
+ * Past releases of a cask, newest first: walks the commits that touched the cask
+ * file in Homebrew/homebrew-cask and reads the cask at each one.
+ */
+export async function caskHistory(token, options = {}) {
+    const info = options.info ?? (await fetchCask(token));
+    if (!info.sourcePath)
+        throw new Error(`The Homebrew API did not say where the ${token} cask lives.`);
+    const perPage = Math.min(Math.max(options.commits ?? 60, 1), 100);
+    const res = await fetch(`${githubApiBase()}/repos/Homebrew/homebrew-cask/commits?path=${encodeURIComponent(info.sourcePath)}&per_page=${perPage}`, { headers: githubHeaders(), signal: AbortSignal.timeout(30_000) });
+    if (res.status === 403 || res.status === 429) {
+        throw new Error('GitHub is rate-limiting history lookups (60 an hour without a token). Set GITHUB_TOKEN to raise the limit, or try again later.');
+    }
+    if (!res.ok)
+        throw new Error(`GitHub answered HTTP ${res.status} for the ${token} cask's history.`);
+    const commits = (await res.json());
+    const parsed = await mapLimit(commits, 6, async (c) => {
+        const raw = await fetch(`${githubRawBase()}/Homebrew/homebrew-cask/${c.sha}/${info.sourcePath}`, {
+            headers: { 'user-agent': `updiff/${TOOL_VERSION}` },
+            signal: AbortSignal.timeout(30_000),
+        });
+        // A commit can delete or move the file; skip it.
+        if (!raw.ok)
+            return undefined;
+        const cask = parseCaskSource(await raw.text());
+        if (!cask.version || cask.version === 'latest')
+            return undefined;
+        const release = {
+            version: cask.version,
+            sha256: cask.sha256,
+            commit: c.sha,
+            date: c.commit.committer?.date ?? c.commit.author?.date ?? '',
+        };
+        const url = cask.url ? resolveCaskUrl(cask.url, cask.version, cask.arch) : undefined;
+        if (url)
+            release.url = url;
+        return release;
+    });
+    // Commits come newest first; keep the newest commit for each version.
+    const releases = [];
+    const seen = new Set();
+    for (const r of parsed) {
+        if (!r || seen.has(r.version))
+            continue;
+        seen.add(r.version);
+        releases.push(r);
+    }
+    return { info, releases };
+}

package/dist/cask.js

@@ -0,0 +1,79 @@
+export function caskApiBase() {
+    return (process.env.UPDIFF_CASK_API ?? process.env.LEDGER_CASK_API ?? 'https://formulae.brew.sh/api/cask').replace(/\/$/, '');
+}
+function firstStrings(artifacts, key) {
+    const out = [];
+    for (const a of artifacts) {
+        const v = a[key];
+        if (!Array.isArray(v))
+            continue;
+        // Each entry is ["Name.app"] or ["Name.app", { target: "..." }].
+        for (const item of v) {
+            if (typeof item === 'string')
+                out.push(item);
+            else if (Array.isArray(item) && typeof item[0] === 'string')
+                out.push(item[0]);
+        }
+    }
+    return out;
+}
+/** Turns a cask API document into the fields the ledger needs. */
+export function parseCask(json) {
+    const j = json;
+    if (typeof j?.token !== 'string' || typeof j.version !== 'string' || typeof j.url !== 'string') {
+        throw new Error('Not a Homebrew cask document');
+    }
+    const artifacts = Array.isArray(j.artifacts) ? j.artifacts : [];
+    const names = Array.isArray(j.name) ? j.name : [];
+    const sha = typeof j.sha256 === 'string' && /^[0-9a-f]{64}$/i.test(j.sha256) ? j.sha256.toLowerCase() : null;
+    return {
+        token: j.token,
+        name: typeof names[0] === 'string' ? names[0] : j.token,
+        desc: typeof j.desc === 'string' ? j.desc : undefined,
+        homepage: typeof j.homepage === 'string' ? j.homepage : undefined,
+        version: j.version,
+        url: j.url,
+        sha256: sha,
+        appNames: firstStrings(artifacts, 'app'),
+        pkgNames: firstStrings(artifacts, 'pkg'),
+        sourcePath: typeof j.ruby_source_path === 'string' ? j.ruby_source_path : undefined,
+    };
+}
+export async function fetchCask(token) {
+    if (!/^[a-z0-9@._+-]+$/.test(token))
+        throw new Error(`Invalid cask token "${token}"`);
+    const res = await fetch(`${caskApiBase()}/${token}.json`, { signal: AbortSignal.timeout(30_000) });
+    if (!res.ok)
+        throw new Error(`Cask "${token}": HTTP ${res.status} from the Homebrew API`);
+    return parseCask(await res.json());
+}
+/** The forms a version can take inside a download URL. */
+function versionForms(version) {
+    const forms = [version, version.replace(/\./g, '_'), version.replace(/\./g, '-')];
+    return [...new Set(forms)];
+}
+/**
+ * Best-effort URL of another release: substitutes `version` for the cask's current
+ * version (and each part of comma-separated versions such as "1.2.3,456") in the
+ * current download URL. Returns undefined when the URL does not contain the version.
+ */
+export function urlForVersion(info, version) {
+    const currentParts = info.version.split(',');
+    const nextParts = version.split(',');
+    if (currentParts.length !== nextParts.length)
+        return undefined;
+    let url = info.url;
+    let replaced = false;
+    for (let i = 0; i < currentParts.length; i++) {
+        const from = versionForms(currentParts[i]);
+        const to = versionForms(nextParts[i]);
+        for (let f = 0; f < from.length; f++) {
+            if (from[f] && url.includes(from[f])) {
+                url = url.split(from[f]).join(to[f]);
+                replaced = true;
+                break;
+            }
+        }
+    }
+    return replaced ? url : undefined;
+}

package/dist/cli.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { main } from "./commands.js";
+const code = await main(process.argv.slice(2), {
+    out: (s) => process.stdout.write(s),
+    err: (s) => process.stderr.write(s),
+    color: process.stdout.isTTY === true && !process.env.NO_COLOR,
+});
+process.exitCode = code;

package/dist/codesign.js

@@ -0,0 +1,103 @@
+import { run } from "./exec.js";
+import { isDict, parsePlistXml } from "./plist.js";
+/** Parses the stderr of `codesign -dvvv`. Exported for tests. */
+export function parseCodesignDetails(stderr, code) {
+    if (/not signed at all/i.test(stderr)) {
+        return { status: 'unsigned', authorities: [], hardenedRuntime: false, flags: [] };
+    }
+    if (code !== 0 && !/^Identifier=/m.test(stderr)) {
+        return { status: 'error', authorities: [], hardenedRuntime: false, flags: [], error: stderr.trim().split('\n').pop() };
+    }
+    const authorities = [];
+    let teamId;
+    let identifier;
+    let flags = [];
+    let adhoc = false;
+    for (const line of stderr.split('\n')) {
+        const eq = line.indexOf('=');
+        if (eq < 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        if (key === 'Authority')
+            authorities.push(value);
+        else if (key === 'TeamIdentifier')
+            teamId = value === 'not set' ? undefined : value;
+        else if (key === 'Identifier')
+            identifier = value;
+        else if (key === 'Signature' && value === 'adhoc')
+            adhoc = true;
+        else if (key === 'CodeDirectory v') {
+            // CodeDirectory v=20500 size=1234 flags=0x10000(runtime) hashes=...
+            const m = /flags=0x[0-9a-f]+\(([^)]*)\)/i.exec(line);
+            if (m?.[1])
+                flags = m[1].split(',').map((s) => s.trim()).filter((s) => s && s !== 'none');
+        }
+    }
+    return {
+        status: adhoc ? 'adhoc' : 'signed',
+        teamId,
+        identifier,
+        authorities,
+        hardenedRuntime: flags.includes('runtime'),
+        flags,
+    };
+}
+export async function readSigning(path) {
+    const res = await run('/usr/bin/codesign', ['-dvvv', path]);
+    return parseCodesignDetails(res.stderr, res.code);
+}
+export async function readEntitlements(path) {
+    const res = await run('/usr/bin/codesign', ['-d', '--entitlements', '-', '--xml', path]);
+    const xml = res.stdout.trim();
+    if (res.code !== 0 || !xml.startsWith('<'))
+        return {};
+    try {
+        const value = parsePlistXml(xml);
+        return isDict(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Parses `spctl -a -vvv -t exec` output:
+ *   /Applications/X.app: accepted
+ *   source=Notarized Developer ID
+ *   origin=Developer ID Application: Example Inc (TEAMID)
+ */
+export function parseSpctl(output) {
+    const verdict = /:\s*(accepted|rejected)\s*$/m.exec(output)?.[1];
+    const source = /^source=(.+)$/m.exec(output)?.[1]?.trim();
+    const origin = /^origin=(.+)$/m.exec(output)?.[1]?.trim();
+    const assessment = verdict === 'accepted' || verdict === 'rejected' ? verdict : 'unknown';
+    // Without a verdict spctl prints "<path>: <reason>", e.g. a broken seal.
+    const error = assessment === 'unknown' ? /^.*?:\s*(.+)$/m.exec(output.trim())?.[1]?.trim() : undefined;
+    return {
+        assessment,
+        ...(source ? { source } : {}),
+        ...(origin ? { origin } : {}),
+        ...(error ? { error } : {}),
+    };
+}
+/**
+ * Reads `stapler validate` by its message: its exit status is 0 whether or not a
+ * ticket is stapled. Undefined when stapler isn't available (no Xcode tools).
+ */
+export function parseStapler(res) {
+    const text = `${res.stdout}\n${res.stderr}`;
+    if (/The validate action worked/i.test(text))
+        return true;
+    if (/does not have a ticket stapled/i.test(text))
+        return false;
+    return undefined;
+}
+/** Asks Gatekeeper about a bundle and checks for a stapled notarization ticket. */
+export async function readNotarization(path) {
+    const spctl = await run('/usr/sbin/spctl', ['-a', '-vvv', '-t', 'exec', path], 120_000);
+    const info = parseSpctl(`${spctl.stdout}\n${spctl.stderr}`);
+    const stapled = parseStapler((await run('/usr/bin/xcrun', ['stapler', 'validate', path], 60_000)));
+    if (stapled !== undefined)
+        info.stapled = stapled;
+    return info;
+}