beam.com 0.1.0-rc.5 → 0.1.0-rc.7

package/NOTICE

@@ -33,7 +33,7 @@ Cosmopolitan Libc 4.0.2 (the C runtime of the APE file)
   shows them.
   https://github.com/jart/cosmopolitan
 
-OpenSSL 4.0.2 (libcrypto, for the crypto NIF)
+OpenSSL 4.0.3 (libcrypto, for the crypto NIF)
   Copyright The OpenSSL Project Authors.
   Apache License 2.0 (LICENSE).
   https://github.com/openssl/openssl
@@ -76,9 +76,20 @@ of lazy_html in lib/beam_com/priv/nifs; only a program with lazy_html
   lexbor: Copyright 2018-2020 Alexander Borisov. Apache License 2.0
   (LICENSE). https://github.com/lexbor/lexbor
 
+sha1collisiondetection (SHA-1 with collision detection, the library of
+git; in the helper program git_sha1dc of the git client)
+  Copyright 2017 Marc Stevens and Dan Shumow.
+  MIT License (licenses/sha1collisiondetection.txt).
+  https://github.com/cr-marcstevens/sha1collisiondetection
+
+The Public Suffix List (lib/beam_com/priv/public_suffix_list.dat, for
+the warning of --allow-net=*.DOMAIN; only beam.com contains it)
+  Mozilla Public License 2.0 (licenses/mpl-2.0.txt).
+  https://publicsuffix.org
+
 The WebAssembly runtime (beam.wasm and beam.mjs in the zip, for
 --target wasm32)
-  Erlang/OTP 29.1.1 and OpenSSL 4.0.2, as above, compiled with
+  Erlang/OTP 29.1.1 and OpenSSL 4.0.3, as above, compiled with
   Emscripten. The runtime contains the system libraries of Emscripten:
   - Emscripten: MIT License and University of Illinois/NCSA Open Source
     License (licenses/emscripten.txt). https://github.com/emscripten-core/emscripten
@@ -94,4 +105,25 @@ Custom builds (build.sh) can also contain:
   - picosat_elixir (EXTRA_NIFS): Apache License 2.0, with PicoSAT (MIT
     License, Copyright 2006-2015 Armin Biere, Johannes Kepler University;
     licenses/picosat.txt).
+  - vix (EXTRA_NIFS): MIT License, with libvips and glib (GNU LGPL 2.1 or
+    later), libheif (GNU LGPL 3.0), aom (BSD 2-Clause License, with the
+    Alliance for Open Media Patent License 1.0), Little CMS (MIT
+    License), cgif (MIT License), libimagequant (the BSD 2-Clause License
+    of its fork by sharp-libvips) and the other libraries of
+    scripts/libvips.sh, each with its own license (see their sources).
+  - rusty_csv (EXTRA_NIFS): MIT License. The Rust crates of its NIF
+    (rustler and others) have the MIT License or the Apache License 2.0;
+    see its Cargo.lock.
+  - ex_pdfium (EXTRA_NIFS): MIT License. Its NIF has PDFium (BSD 3-Clause
+    License, Copyright 2014 The PDFium Authors,
+    https://pdfium.googlesource.com/pdfium) and the third-party code of
+    PDFium: FreeType (the FreeType License: portions of this software are
+    copyright The FreeType Project, https://freetype.org, all rights
+    reserved), Abseil (Apache License 2.0), ICU (Unicode License v3),
+    zlib (zlib License), libjpeg-turbo (IJG License and BSD 3-Clause
+    License), OpenJPEG (BSD 2-Clause License), Little CMS (MIT License),
+    Anti-Grain Geometry 2.3, fast_float and BigInteger. Their license
+    texts are in licenses/pdfium of such a build. The Rust crates of the
+    NIF (pdfium-render, rustler and others) have the MIT License or the
+    Apache License 2.0; see the Cargo.lock of ex_pdfium.
   - More OTP applications (OTP_APPS): as Erlang/OTP above.

package/README.md

@@ -74,12 +74,18 @@ On NetBSD and OpenBSD, start the file with the APE loader
 
 ### A custom build
 
-Do you need more OTP applications (for example `ssh` or `mnesia`), Hex and
+Do you need more OTP applications (for example `mnesia` or `eldap`), Hex and
 rebar3 in the file, or a file without Elixir, SQLite or WebAssembly? Open
 an issue with the form
 [A custom build of beam.com](https://github.com/sntran/BEAM.com/issues/new?template=custom_build.yml).
 CI builds and tests the file with your choices, and puts it on the issue.
-You need no toolchain. See "A custom build" in
+Without a GitHub account, use the form of
+[mkfifo.com/beam.com](https://mkfifo.com/beam.com?form): it gives the
+file in the browser, or sends its link to your email address. A script
+gets the same file with one request, as
+`curl -fo beam.com 'https://mkfifo.com/beam.com?apps=mnesia&nifs+=vix'`,
+and `curl -fo beam.com https://mkfifo.com/beam.com` gives the default
+build. You need no toolchain. See "A custom build" and "A build URL" in
 [`docs/BUILDING.md`](docs/BUILDING.md).
 
 ## Quick start
@@ -219,7 +225,7 @@ jobs:
 
 Then turn on Pages one time: Settings, Pages, Source "GitHub Actions". The
 `GITHUB_TOKEN` cannot do this step. Until the release `v0.1.0`, use the
-release candidate `@v0.1.0-rc.5` in place of `@v0.1.0`. With `@main`, the
+release candidate `@v0.1.0-rc.7` in place of `@v0.1.0`. With `@main`, the
 workflow uses the `edge` build of `beam.com`.
 
 The workflow ([`pages-app.yml`](.github/workflows/pages-app.yml)) builds
@@ -240,9 +246,9 @@ run shows a warning. A pin to a commit SHA uses the release of that
 commit, and stops with an error when the commit has no release tag.
 Before the build, the workflow checks the SHA-256 of `beam.com` and its
 provenance (`gh attestation verify`). The check stops the build when
-`build.yml` of BEAM.com did not make the file, or when the check cannot
-reach GitHub or Sigstore. It needs no other
-permission.
+`build.yml` of BEAM.com did not make the file from the commit of the
+release tag (or from `main`, for `edge`), or when the check cannot reach
+GitHub or Sigstore. It needs no other permission.
 
 The app needs an HTTP listener on `PORT` (4000 by default), and only the
 NIFs of the WebAssembly runtime. The limits:
@@ -286,7 +292,7 @@ Each GitHub release from 0.1.0-rc.2 also holds the package, the same
 file as on npm. npm installs it with no registry:
 
 ```sh
-npm install https://github.com/sntran/BEAM.com/releases/download/v0.1.0-rc.5/beam.com-0.1.0-rc.5.tgz
+npm install https://github.com/sntran/BEAM.com/releases/download/v0.1.0-rc.7/beam.com-0.1.0-rc.7.tgz
 ```
 
 - `BEAM_COM`: the path of a `beam.com` to use. Then nothing is
@@ -346,7 +352,8 @@ the Erlang shell in your browser is at
 | File | What |
 |---|---|
 | [`docs/PROGRAMS.md`](docs/PROGRAMS.md) | Run and build programs: the inputs, Hex packages, command line programs, native files (`--target`), distributed Erlang, a release in the zip, debugging. |
-| [`docs/ELIXIR.md`](docs/ELIXIR.md) | Elixir programs, the tools (`mix`, `iex`, `elixir`), Phoenix from source, the file watcher. |
+| [`docs/ELIXIR.md`](docs/ELIXIR.md) | Elixir programs, the tools (`mix`, `iex`, `elixir`), Phoenix from source, Phoenix in one file, the file watcher. |
+| [`docs/DEPLOY.md`](docs/DEPLOY.md) | Deploy a Phoenix app to a Linux server: a build on the server or in CI, systemd, migrations, new code with no restart, and what needs a restart. |
 | [`docs/WORKERS.md`](docs/WORKERS.md) | Cloudflare Workers, Deno Deploy and web pages: `app.com` with the npm package, Durable Objects, Ecto SQLite, HTTP through `fetch()`, snapshots, tenants, static sites (`--page`), and limits. |
 | [`docs/NOTEBOOKS.md`](docs/NOTEBOOKS.md) | The documentation as notebooks that run in your browser: a tour of beam.com, the WebAssembly VM, the anatomy of the file, WebAssembly programs, hosts and storage, networking, and building programs. |
 | [`docs/LIBRARIES.md`](docs/LIBRARIES.md) | Crypto and TLS, SQLite, and WebAssembly in Erlang code. |
@@ -378,7 +385,7 @@ the Erlang shell in your browser is at
 |---|---|
 | Linux x86_64 and aarch64, WSL2 | ✅ |
 | macOS arm64 and x86_64 | ✅ |
-| Windows x86_64 | ✅ (no port programs) |
+| Windows x86_64 | ✅ |
 | FreeBSD, NetBSD, OpenBSD 7.3 | ✅ |
 | OpenBSD 7.4 and later | ❌ (not supported by Cosmopolitan) |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beam.com",
-  "version": "0.1.0-rc.5",
+  "version": "0.1.0-rc.7",
   "description": "Erlang/OTP and Elixir in one executable file: npx beam.com, and the WebAssembly runtime for a native app.com",
   "license": "Apache-2.0",
   "repository": {

package/runtime/app-com.js

@@ -31,6 +31,12 @@
 //   the host serves before the VM (worker.js). They are not in files,
 //   except cache_manifest.json, which Phoenix reads at its start.
 //
+// appStatics(read, size, { runtime }) gives only that Map, with no read and
+// no check of the other files: the front of a Worker (cloudflare/index.js)
+// serves the static files with no VM. The check of the CRC-32 of each file
+// of the release cost 80 to 180 ms of CPU time for a release of 16 MB, and
+// the front pays it in each new isolate.
+//
 // The zip of beam.com stores each .beam file as a gzip file (the loader of
 // ERTS reads it so, beam_com_zip), so it is a view too. A deflated .beam
 // entry (an older app.com) becomes a gzip file with the same data, with
@@ -139,32 +145,13 @@ export async function appRelease(read, size, options = {}) {
 // default uses DecompressionStream, which the global scope of a Worker
 // cannot use (cloudflare/release.js gives inflateRawSync of node:zlib).
 export async function appFiles(read, size, { runtime, statics: split = true, inflate: unzip = inflate } = {}) {
-  const { entries, cdAt } = await zipEntries(read, size);
-  const want = entries.filter((e) => inRelease(e.name) && !e.name.endsWith('/'));
-  const json = want.find((e) => e.name === `${EDGE}.release.json`);
-  if (!json) fail('no edge part (.wasm/.release.json): build it with a beam.com that has the WebAssembly runtime, and without --no-edge');
-  // One read: the entries of the release, up to the central directory.
-  const lo = Math.min(...want.map((e) => e.offset));
-  const span = await read(lo, cdAt - lo);
-  if (span.length !== cdAt - lo) fail('a short read of the release');
-  const meta = await entryData(span, lo, json, unzip);
-  const release = JSON.parse(text.decode(meta));
-  if (runtime && release.runtime !== runtime) {
-    fail(`it was built for the runtime ${String(release.runtime).slice(0, 12)}, and this runtime is ${runtime.slice(0, 12)}: `
-         + 'use the runtime of the beam.com that built it');
-  }
-  // The static files of a Phoenix app (PHX_SERVER in the environment of
-  // the release): lib/NAME-VSN/priv/static/, for the application with the
-  // name of the release. Plug.Static serves them at the root of the site.
-  const app = split && release.env?.PHX_SERVER === 'true' && typeof release.name === 'string'
-    && `lib/${release.name}-`;
-  const prefix = app && want.map((e) => /^lib\/[^/]+\/priv\/static\//.exec(e.name)?.[0])
-    .find((p) => p?.startsWith(app) && /^[0-9]/.test(p.slice(app.length)));
+  const { want, json, lo, span, meta, release } = await releaseHead(read, size, runtime, unzip);
+  const prefix = split && staticPrefix(release, want);
   const statics = new Map();
   const files = new Map();
   for (const e of want) {
     if (e.name.startsWith(EDGE)) continue;
-    if (prefix && e.name.startsWith(prefix) && e.name !== `${prefix}cache_manifest.json`) {
+    if (prefix && isStatic(e, prefix)) {
       statics.set(e.name.slice(prefix.length - 1), staticEntry(span, lo, e));
       continue;
     }
@@ -179,6 +166,46 @@ export async function appFiles(read, size, { runtime, statics: split = true, inf
   };
 }
 
+export async function appStatics(read, size, { runtime, inflate: unzip = inflate } = {}) {
+  const { want, lo, span, release } = await releaseHead(read, size, runtime, unzip);
+  const prefix = staticPrefix(release, want);
+  const statics = new Map();
+  if (prefix) for (const e of want) if (isStatic(e, prefix)) statics.set(e.name.slice(prefix.length - 1), staticEntry(span, lo, e));
+  return statics;
+}
+
+// The entries of the release, the span of their bytes (one read, up to the
+// central directory), and .release.json, which must be of the runtime.
+async function releaseHead(read, size, runtime, unzip) {
+  const { entries, cdAt } = await zipEntries(read, size);
+  const want = entries.filter((e) => inRelease(e.name) && !e.name.endsWith('/'));
+  const json = want.find((e) => e.name === `${EDGE}.release.json`);
+  if (!json) fail('no edge part (.wasm/.release.json): build it with a beam.com that has the WebAssembly runtime, and without --no-edge');
+  const lo = Math.min(...want.map((e) => e.offset));
+  const span = await read(lo, cdAt - lo);
+  if (span.length !== cdAt - lo) fail('a short read of the release');
+  const meta = await entryData(span, lo, json, unzip);
+  const release = JSON.parse(text.decode(meta));
+  if (runtime && release.runtime !== runtime) {
+    fail(`it was built for the runtime ${String(release.runtime).slice(0, 12)}, and this runtime is ${runtime.slice(0, 12)}: `
+         + 'use the runtime of the beam.com that built it');
+  }
+  return { want, json, lo, span, meta, release };
+}
+
+// The static files of a Phoenix app (PHX_SERVER in the environment of the
+// release): lib/NAME-VSN/priv/static/, for the application with the name
+// of the release, or null. Plug.Static serves them at the root of the site.
+function staticPrefix(release, want) {
+  const app = release.env?.PHX_SERVER === 'true' && typeof release.name === 'string' && `lib/${release.name}-`;
+  return (app && want.map((e) => /^lib\/[^/]+\/priv\/static\//.exec(e.name)?.[0])
+    .find((p) => p?.startsWith(app) && /^[0-9]/.test(p.slice(app.length)))) || null;
+}
+
+// A static file of the prefix. cache_manifest.json stays in the release:
+// Phoenix reads it at its start.
+const isStatic = (e, prefix) => e.name.startsWith(prefix) && e.name !== `${prefix}cache_manifest.json`;
+
 // A static file: its bytes in the zip (stored or deflated), not checked
 // here (the host checks the CRC-32 when it inflates them).
 function staticEntry(span, base, e) {