@spunto/build 0.5.0 → 0.5.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spunto/build",
-  "version": "0.5.0",
-  "description": "Spunto's shared Build engine \u2014 the devcontainer image protocol and VS Code extension registry clients, with no database, no HTTP framework and no UI.",
+  "version": "0.5.1",
+  "description": "Spunto's shared Build engine — the devcontainer image protocol and VS Code extension registry clients, with no database, no HTTP framework and no UI.",
   "type": "module",
   "license": "MIT",
   "homepage": "https://spunto.net",

package/src/script/setup-script.ts

@@ -35,6 +35,37 @@ function shQuote(v: string): string {
   return `'${v.replace(/'/g, `'\\''`)}'`
 }
 
+/**
+ * Runs a command as the workspace user instead of root.
+ *
+ * The setup script itself is the container's CMD, so it runs as root — it has to, to chown
+ * /workspace and write under /etc. Everything it *clones*, though, belongs to the user, and
+ * cloning as root has cost us twice: once as `npm install` failing with EACCES on a root-owned
+ * node_modules (hence the re-chown after the repo clones), and once as a private dotfiles repo
+ * that authenticated with no key at all, because root has no `~/.ssh` and the identity was only
+ * named on the repo clones.
+ *
+ * `su` gives the command `HOME=/home/vscode`, which is what makes ssh pick up the `~/.ssh/config`
+ * written in the credentials step — so a clone over SSH needs nothing else to find the user's key.
+ */
+function asUser(username: string, cmd: string): string {
+  return `su ${username} -c ${shQuote(cmd)}`
+}
+
+/**
+ * A dotfiles setting, as a clonable URL.
+ *
+ * Anything already naming a transport is left alone; only a bare `owner/repo` shorthand is
+ * expanded against GitHub. The previous test — `startsWith("http") || startsWith("git@")` — turned
+ * `ssh://git@host/me/dotfiles.git` into `https://github.com/ssh://git@host/me/dotfiles.git`.
+ */
+function normalizeDotfilesUrl(raw: string): string {
+  const v = raw.trim()
+  return /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/|[^/\s]+@[^/\s]+:)/.test(v)
+    ? v
+    : `https://github.com/${v.replace(/^\/+|\/+$/g, "")}`
+}
+
 /**
  * `export EXTENSIONS_GALLERY=…`, or nothing when the org is on the default (Open VSX) registry.
  *
@@ -105,11 +136,13 @@ function cloneRepoBlock(params: {
   index: number
   total: number
   homeDir: string
+  /** Who the checkout belongs to — the clone runs as them. */
+  username: string
   branch?: string
   githubInstallationTokens?: Record<string, string>
   userSshPrivateKey?: string
 }): { header: string; lines: string[] } {
-  const { repo: r, index, total, homeDir, branch, githubInstallationTokens, userSshPrivateKey } = params
+  const { repo: r, index, total, homeDir, username, branch, githubInstallationTokens, userSshPrivateKey } = params
   // Pick the installation token for this repo's owner. A GitHub App installation only grants
   // access to repos owned by its account, so the owner login (== installation accountLogin)
   // uniquely selects the right token among the org's connected installations. Covers legacy
@@ -117,13 +150,16 @@ function cloneRepoBlock(params: {
   const owner = (r.project.split("/")[0] ?? "").toLowerCase()
   const repoToken = githubInstallationTokens?.[owner]
   const b = branch ? ` --branch ${shQuote(branch)}` : ""
-  const cloneCmd = r.provider === "git" && r.cloneUrl
+  const rawCloneCmd = r.provider === "git" && r.cloneUrl
     ? `GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ${homeDir}/.ssh/mp_deploy_key" git clone${b} ${shQuote(r.cloneUrl)} /workspace/${r.workspacePath}`
     : r.provider === "github" && repoToken
     ? `git clone${b} https://x-access-token:${repoToken}@github.com/${r.project}.git /workspace/${r.workspacePath} && git -C /workspace/${r.workspacePath} remote set-url origin git@github.com:${r.project}.git`
     : r.provider === "github" && userSshPrivateKey
     ? `GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ${homeDir}/.ssh/mp_user_key" git clone${b} git@github.com:${r.project}.git /workspace/${r.workspacePath}`
     : `git clone${b} https://github.com/${r.project} /workspace/${r.workspacePath}`
+  // Cloned as the user, not as root: /workspace is already theirs (the ownership step runs
+  // first), so the checkout lands with the right owner and needs no chown afterwards.
+  const cloneCmd = asUser(username, rawCloneCmd)
 
   // Single-quoted only when a (user-provided) branch is interpolated; the plain form is kept
   // verbatim for the no-branch case so the generated script is unchanged there.
@@ -851,23 +887,23 @@ export function buildSetupScript(params: SetupScriptParams): { script: string }
 
   // ── 4. Dotfiles ───────────────────────────────────────────────────────────
   if (dotfilesRepo) {
-    const dotfilesUrl = dotfilesRepo.startsWith("http") || dotfilesRepo.startsWith("git@")
-      ? dotfilesRepo
-      : `https://github.com/${dotfilesRepo}`
+    const dotfilesUrl = normalizeDotfilesUrl(dotfilesRepo)
     push(...banner("SETUP: DOTFILES"))
     mpAt(mkStatus("dotfiles", allReposPending, pc0, null), "dotfiles")
     push(
       `echo "Cloning dotfiles from ${dotfilesUrl}..."`,
       `set +e`,
-      `git clone ${JSON.stringify(dotfilesUrl)} ${homeDir}/dotfiles 2>&1`,
+      // As the user, like every other clone: root has no `~/.ssh`, so a private dotfiles repo
+      // over SSH would authenticate with no key at all.
+      `${asUser(username, `git clone ${shQuote(dotfilesUrl)} ${homeDir}/dotfiles`)} 2>&1`,
       `_DOTS_EXIT=$?`,
       `set -e`,
       `if [ $_DOTS_EXIT -ne 0 ]; then`,
       `  echo "Dotfiles clone failed (exit $_DOTS_EXIT) — continuing without dotfiles"`,
       `else`,
       `  echo "Dotfiles cloned"`,
-      // Cloned as root, but the install script below runs as the user (and so does whoever edits
-      // these files later) — hand the clone over before touching it.
+      // The clone above already lands as the user. Kept for a worker whose ~/dotfiles was left
+      // root-owned by an earlier release, where the install script below would fail on it.
       `  chown -R ${username}:${username} ${homeDir}/dotfiles`,
       `  _INSTALL_SCRIPT=""`,
       `  for _candidate in install.sh bootstrap.sh setup.sh script/setup; do`,
@@ -911,6 +947,7 @@ export function buildSetupScript(params: SetupScriptParams): { script: string }
       index: i,
       total: project.repositories.length,
       homeDir,
+      username,
       branch: resolveRepoBranch(r, branch),
       githubInstallationTokens,
       userSshPrivateKey,
@@ -924,11 +961,10 @@ export function buildSetupScript(params: SetupScriptParams): { script: string }
   })
 
   // ── 5b. Re-own /workspace after cloning ───────────────────────────────────
-  // Repos are cloned as root (the setup script runs as root), so the cloned
-  // directories end up root-owned. The initial chown (step 1) ran *before* the
-  // clone, so it didn't cover them. postCreateCommand runs as vscode, so without
-  // this the user can't write into the repo (e.g. `npm install` → EACCES on
-  // node_modules). Must run before postCreate, not just in the final step.
+  // The clones above run as the user, so their checkouts already belong to them. This stays as a
+  // net: a repo left root-owned by an earlier release (when cloning *was* done as root) would
+  // otherwise keep failing postCreate with EACCES — `npm install` on a root-owned node_modules —
+  // and the final chown in step 8 comes too late for that.
   if (project.repositories.length > 0) {
     push("", `chown -R ${username}:${username} /workspace`)
   }
@@ -1774,21 +1810,21 @@ export function buildSetupPlan(params: SetupScriptParams): {
 
   // ── dotfiles ──────────────────────────────────────────────────────────────
   if (dotfilesRepo) {
-    const dotfilesUrl = dotfilesRepo.startsWith("http") || dotfilesRepo.startsWith("git@")
-      ? dotfilesRepo
-      : `https://github.com/${dotfilesRepo}`
+    const dotfilesUrl = normalizeDotfilesUrl(dotfilesRepo)
     const l: string[] = ["set -e", ...banner("SETUP: DOTFILES"),
       `echo "Cloning dotfiles from ${dotfilesUrl}..."`,
       `set +e`,
-      `git clone ${JSON.stringify(dotfilesUrl)} ${homeDir}/dotfiles 2>&1`,
+      // As the user, like every other clone: root has no `~/.ssh`, so a private dotfiles repo
+      // over SSH would authenticate with no key at all.
+      `${asUser(username, `git clone ${shQuote(dotfilesUrl)} ${homeDir}/dotfiles`)} 2>&1`,
       `_DOTS_EXIT=$?`,
       `set -e`,
       `if [ $_DOTS_EXIT -ne 0 ]; then`,
       `  echo "Dotfiles clone failed (exit $_DOTS_EXIT) — continuing without dotfiles"`,
       `else`,
       `  echo "Dotfiles cloned"`,
-      // Cloned as root, but the install script below runs as the user (and so does whoever edits
-      // these files later) — hand the clone over before touching it.
+      // The clone above already lands as the user. Kept for a worker whose ~/dotfiles was left
+      // root-owned by an earlier release, where the install script below would fail on it.
       `  chown -R ${username}:${username} ${homeDir}/dotfiles`,
       `  _INSTALL_SCRIPT=""`,
       `  for _candidate in install.sh bootstrap.sh setup.sh script/setup; do`,
@@ -1833,6 +1869,7 @@ export function buildSetupPlan(params: SetupScriptParams): {
         index: i,
         total: project.repositories.length,
         homeDir,
+        username,
         branch: resolveRepoBranch(r, branch),
         githubInstallationTokens,
         userSshPrivateKey,