crossbind 2.0.0-beta.67 → 2.0.0-beta.69

package/src/actions/licenses.js

@@ -12,7 +12,11 @@ import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveApp
 import {
     HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
 } from '../utils/hermes.js';
+import { installersFor } from './appInstaller.js';
+import { DESKTOP_PLATFORMS } from './buildApp.js';
+import extensionsInApp from './extensionsInApp.js';
 import { ANDROIDX_WEBKIT } from './gradleProject.js';
+import { extensionPackage, extensionPart } from '../utils/appExtensions.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -208,13 +212,12 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
-// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// What an app's host carries beside crossbind's runtime, pinned as the READMEs beside them in @crossbind/core-app-host
 // record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
 // headers.
 const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
 const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
 const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
-const MONOCYPHER = { version: '4.0.3', sha256: '8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66' };
 // The fbjni the Hermes release for Android depends on.
 const FBJNI_VERSION = '0.7.0';
 
@@ -273,8 +276,8 @@ function androidAppRows() {
     ];
 }
 
-// The WebView2 SDK headers a Windows host compiles against, and the NSIS its setup program carries. webview/webview
-// loads the WebView2 Runtime itself, without the SDK's loader.
+// The WebView2 SDK headers a Windows host compiles against. webview/webview loads the WebView2 Runtime itself, without the
+// SDK's loader.
 function windowsAppRows(hostRoot) {
     const license = 'BSD-3-Clause';
     return [{
@@ -290,22 +293,73 @@ function windowsAppRows(hostRoot) {
         sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
         licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
         licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
-    }, {
-        npmName: '@crossbind/core-app-host',
-        name: 'nsis',
-        version: '3.11',
-        nativeVersion: '3.11',
-        sha256: null,
-        license: 'Zlib AND MIT',
-        licenseDeclared: 'Zlib AND MIT',
-        licenseSelected: null,
-        isCopyleft: false,
-        sourceUrl: 'https://sources.debian.org/src/nsis/3.11-1/',
-        licenseNotes: "the installer stub and plugins the app's setup program carries, from Debian's nsis in the windows toolchain image: zlib/libpng, but for the System plugin's Call.S, MIT",
-        licenseText: textOf(path.join(hostRoot, 'third_party', 'nsis', 'LICENSE')),
     }];
 }
 
+const APP_PLATFORMS = ['darwin', 'ios', 'android', 'linux', 'win32'];
+
+// The extensions an app of this platform has, of any platform's without one: crossbind's own that bring it code, and those
+// crossbind.config.js lists.
+function extensionsIn(platform) {
+    if (!platform) return [...new Map(APP_PLATFORMS.flatMap((one) => extensionsIn(one)).map((extension) => [extension.name, extension])).values()];
+    const listed = (state.config.extensions ?? []).map(({ name }) => name);
+    const hasCode = (extension) => {
+        const { native, java } = extensionPart([extension], platform);
+        return native.length > 0 || java.length > 0;
+    };
+    return extensionsInApp(platform).filter((extension) => listed.includes(extension.name) || hasCode(extension));
+}
+
+// A row of the code of others an extension carries, by what its licenses list says of it.
+const carriedRow = (entry, root, notes) => ({
+    npmName: null,
+    name: entry.name,
+    version: null,
+    nativeVersion: entry.version,
+    sha256: entry.sha256 ?? null,
+    license: entry.license,
+    licenseDeclared: entry.license,
+    licenseSelected: null,
+    isCopyleft: isCopyleft(entry.license),
+    sourceUrl: entry.source ?? null,
+    licenseNotes: entry.notes ?? notes,
+    licenseText: textOf(path.join(root, entry.file)),
+});
+
+// What the installers of a desktop app carry into what they make.
+const installerRows = (platform) => (DESKTOP_PLATFORMS[platform] ? installersFor({ platform }) : [])
+    .flatMap(({ name, root, installer }) => (installer.licenses ?? []).map((entry) => carriedRow(entry, root, `carried by what the installer ${name} makes`)));
+
+// What an app's extensions bring into it: each extension package's own code, and the code of others each carries, as its
+// app.licenses lists it. An extension in the project's own folders is the project's code, as the app is.
+function extensionRows(platform) {
+    return extensionsIn(platform).flatMap((extension) => {
+        const own = extensionPackage(extension.root, state.config.paths.base);
+        const owner = own?.manifest.name ?? null;
+        const license = own?.manifest.license ?? null;
+        const shipped = own && packageLicenseFile(own.dir);
+        const packageRows = own && !own.manifest.private ? [{
+            npmName: owner,
+            name: owner,
+            version: own.manifest.version ?? null,
+            nativeVersion: null,
+            license,
+            licenseDeclared: license,
+            licenseSelected: null,
+            isCopyleft: Boolean(license) && isCopyleft(license),
+            sourceUrl: own.manifest.homepage ?? null,
+            licenseNotes: `the app extension ${extension.name}, which the app's host compiles in`,
+            licenseText: shipped ? textOf(shipped) : null,
+        }] : [];
+        const carried = (extension.app.licenses ?? []).map((entry) => carriedRow(
+            entry,
+            extension.root,
+            `carried by the app extension ${extension.name}${owner ? ` of ${owner}` : ''}, which the app's host compiles in`,
+        ));
+        return [...packageRows, ...carried];
+    });
+}
+
 function appRuntimeRows(platform) {
     const hostRoot = resolveAppHostRoot();
     const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
@@ -347,24 +401,9 @@ function appRuntimeRows(platform) {
             nativeVersion: WEBVIEW.version,
             sha256: WEBVIEW.sha256,
             sourceUrl: 'https://github.com/webview/webview',
-            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseNotes: 'webview/webview, with the local patches @crossbind/core-app-host lists',
             licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
         }]),
-        // A desktop host checks its updates with Monocypher, which the linker leaves out of one without app.updater.
-        ...(['ios', 'android'].includes(platform) || state.config.app?.updater === undefined ? [] : [{
-            npmName: '@crossbind/core-app-host',
-            name: 'monocypher',
-            version: MONOCYPHER.version,
-            nativeVersion: MONOCYPHER.version,
-            sha256: MONOCYPHER.sha256,
-            license: 'BSD-2-Clause OR CC0-1.0',
-            licenseDeclared: 'BSD-2-Clause OR CC0-1.0',
-            licenseSelected: null,
-            isCopyleft: false,
-            sourceUrl: `https://monocypher.org/download/monocypher-${MONOCYPHER.version}.tar.gz`,
-            licenseNotes: "Monocypher's Ed25519 and SHA-512, compiled into the host, which check the app's updates",
-            licenseText: textOf(path.join(hostRoot, 'third_party', 'monocypher', 'LICENCE.md')),
-        }]),
     ];
 }
 
@@ -484,6 +523,16 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
-    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
+    if (runtimeEnv === 'app') {
+        rows.push(...appRuntimeRows(platform));
+        // A library two extensions carry, or one the app has already, is listed once for each version the app ships.
+        const versionOf = (row) => `${row.name}@${row.nativeVersion ?? row.version}`;
+        const listed = new Set(rows.map(versionOf));
+        for (const row of [...extensionRows(platform), ...installerRows(platform)]) {
+            if (listed.has(versionOf(row))) continue;
+            listed.add(versionOf(row));
+            rows.push(row);
+        }
+    }
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/linuxPackages.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { downloadFile, verifyIntegrity } from '../utils/downloadAndExtractFile.js';
+
+// The Ubuntu 22.04 packages a Linux extension lists beside crossbind's sysroot: each downloaded once into the build's
+// folder from Launchpad, as the sysroot's own are, checked against its SHA-256 and unpacked into a sysroot of the
+// extension's own for the target, whose headers its sources include and whose libraries the host links against. Its
+// users' systems load the libraries at run time, as the app's Debian package's Depends asks for them.
+
+const DEBIAN_ARCH = { x64: 'amd64', arm64: 'arm64' };
+const MULTIARCH = { x64: 'x86_64-linux-gnu', arm64: 'aarch64-linux-gnu' };
+
+export const packageUrl = (file) => `https://launchpad.net/ubuntu/+archive/primary/+files/${file}`;
+
+// The packages of the target's architecture among the lines an extension lists.
+export function packagesFor(target, lines) {
+    return lines.map((line) => line.split(' ')).filter(([arch]) => arch === DEBIAN_ARCH[target.arch]).map(([, file, sha256]) => ({ file, sha256 }));
+}
+
+// What a sysroot gives the target: the folders its sources include, usr/include and each folder in it, as a library's
+// headers sit in one of its own, and the folder the host links from.
+export function sysrootDirs(target, root) {
+    const include = path.join(root, 'usr', 'include');
+    const nested = fs.existsSync(include)
+        ? fs.readdirSync(include, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path.join(include, entry.name))
+        : [];
+    return { includes: [include, ...nested], libDir: path.join(root, 'usr', 'lib', MULTIARCH[target.arch]) };
+}
+
+// Unpacks each extension's packages for the target, with unpack(deb, folder), which crossbind's Linux image runs.
+export async function unpackPackages(target, compiled, { cache, workDir, unpack }) {
+    const sysroots = [];
+    for (const { name, packages } of compiled.filter((part) => part.packages.length > 0)) {
+        const own = packagesFor(target, packages);
+        if (own.length === 0) throw new Error(`crossbind: the extension ${name} lists Linux packages, but none of ${DEBIAN_ARCH[target.arch]}, which an ${target.arch} app takes.`);
+        const root = path.join(workDir, 'sysroot', name);
+        fs.rmSync(root, { recursive: true, force: true });
+        fs.mkdirSync(root, { recursive: true });
+        for (const { file, sha256 } of own) {
+            const url = packageUrl(file);
+            const deb = await downloadFile(url, cache);
+            verifyIntegrity(deb, url, sha256);
+            unpack(deb, root);
+        }
+        sysroots.push({ name, ...sysrootDirs(target, root) });
+    }
+    return sysroots;
+}

package/src/actions/mavenVerification.js

@@ -0,0 +1,37 @@
+// The verification metadata of an Android app whose extensions ask Maven for libraries: the android-app image's, which
+// lists all crossbind's own project resolves, with each extension's components, as Gradle's
+// --write-verification-metadata lists them. Gradle then checks every file it resolves, from the image's cache or online.
+
+const COMPONENT = /<component group="([^"]+)" name="([^"]+)" version="([^"]+)"[^>]*>([\s\S]*?)<\/component>/g;
+const ARTIFACT = /<artifact name="([^"]+)">[\s\S]*?<\/artifact>/g;
+// What would leave a file unchecked, which an extension's metadata may not add to the app's.
+const TRUST = /<(trusted-artifacts|trust|ignored-keys|trusted-keys)\b/;
+
+export function mergedVerification(base, fragments) {
+    const components = new Map();
+    const add = (xml, owner) => {
+        for (const [, group, name, version, body] of xml.matchAll(COMPONENT)) {
+            const key = `${group}:${name}:${version}`;
+            const artifacts = components.get(key) ?? new Map();
+            for (const [block, artifact] of body.matchAll(ARTIFACT)) {
+                const known = artifacts.get(artifact);
+                if (known && known.block !== block) throw new Error(`crossbind: ${owner} gives ${artifact} of ${key} other checksums than ${known.owner} does.`);
+                if (!known) artifacts.set(artifact, { block, owner });
+            }
+            components.set(key, artifacts);
+        }
+    };
+    add(base, "the android-app image's verification metadata");
+    for (const { name, xml } of fragments) {
+        const owner = `the extension ${name}`;
+        if (TRUST.test(xml)) throw new Error(`crossbind: ${owner}'s verification metadata trusts files Gradle would then leave unchecked, which no extension's may.`);
+        if ([...xml.matchAll(COMPONENT)].length === 0) throw new Error(`crossbind: ${owner}'s verification metadata lists no component, as Gradle's --write-verification-metadata sha256 writes them.`);
+        add(xml, owner);
+    }
+    const listed = [...components.entries()].sort(([one], [other]) => (one < other ? -1 : 1)).map(([key, artifacts]) => {
+        const [group, name, version] = key.split(':');
+        const blocks = [...artifacts.values()].map(({ block }) => `         ${block}\n`).join('');
+        return `      <component group="${group}" name="${name}" version="${version}">\n${blocks}      </component>\n`;
+    });
+    return `${base.slice(0, base.indexOf('<components>'))}<components>\n${listed.join('')}   </components>\n</verification-metadata>\n`;
+}

package/src/actions/publish.js

@@ -0,0 +1,220 @@
+import state from '../state/index.js';
+import loadConfig from '../state/loadConfig.js';
+import {
+    DESKTOP_PLATFORMS, MAX_VERSION_CODE, appOutputOf, clearAppOutputs,
+} from './buildApp.js';
+import extensionApi from './extensionApi.js';
+import {
+    PUBLISH_PLATFORMS, extensionStep, isJsonValue, ownExtensions, withListed, withoutNamed,
+} from '../utils/appExtensions.js';
+import { CONFIG_CHANGES } from '../utils/configChanges.js';
+import { hasTerminal } from '../utils/ask.js';
+import resolveAppHostRoot from '../utils/resolveAppHost.js';
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const possessive = (name) => (name.endsWith('s') ? `${name}'` : `${name}'s`);
+const listed = (names, word = 'or') => (names.length > 1 ? `${names.slice(0, -1).join(', ')} ${word} ${names.at(-1)}` : names[0]);
+const kebab = (name) => name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+const camel = (name) => name.replace(/-([a-z0-9])/g, (dash, letter) => letter.toUpperCase());
+const storeName = ({ name, publisher }) => publisher.store ?? name;
+// How many builds a publish makes at most, as its first publisher may ask for another.
+const MAX_BUILDS = 4;
+
+// A step of the publisher's, which its publisher may lack.
+const step = ({ name, publisher }, which, ...args) => extensionStep(name, which, () => publisher[which]?.(...args));
+
+// crossbind's own publishers, which the host brings as it brings its other extensions.
+export const builtInPublishers = () => withoutNamed(ownExtensions(resolveAppHostRoot()), state.config?.app).filter(({ publisher }) => publisher);
+
+// The publishers an app has: crossbind's own, each in the place of the app's extension of its name that has a
+// publisher, then those of the app's other extensions.
+export const publishersOf = (extensions) => withListed(builtInPublishers(), extensions.filter((extension) => extension.publisher));
+
+// The store the command names first, before the options, else the last publisher that says it is the one of the platform
+// -p, or CROSSBIND_APP_PLATFORM, names, and the arguments after it. A store named after the options, of those crossbind
+// knows, is refused, as Vite would take it.
+export function storeOf(args, platform, envPlatform, publishers = []) {
+    const [first, ...rest] = args;
+    const named = first !== undefined && !first.startsWith('-') ? first : null;
+    const late = named ? null : args.find((arg) => publishers.some(({ name }) => name === arg));
+    if (late) throw new Error(`crossbind: crossbind app publish takes the store first, before the options: crossbind app publish ${late} ${args.filter((arg) => arg !== late).join(' ')}.`);
+    const where = platform ?? envPlatform;
+    const usual = publishers.findLast(({ publisher }) => publisher.isDefault && publisher.platforms.includes(where));
+    return { store: named ?? usual?.name ?? null, rest: named ? rest : args };
+}
+
+// The publisher of a store, after those it comes after, first to last.
+export function publishChain(publishers, store) {
+    if (!publishers.some(({ name }) => name === store)) {
+        throw new Error(`crossbind: crossbind app publish takes the store it sends the app to first: ${listed(publishers.map(({ name }) => name))}${store ? `, not ${store}` : ''}.`);
+    }
+    const chain = [];
+    for (let current = store; current;) {
+        const extension = publishers.find(({ name }) => name === current);
+        if (!extension) throw new Error(`crossbind: ${chain[0].name} comes after ${current}, which no publisher is named.`);
+        if (chain.includes(extension)) throw new Error(`crossbind: ${listed([extension, ...chain].map(({ name }) => name), 'and')} come after one another in a circle.`);
+        chain.unshift(extension);
+        current = extension.publisher.after;
+    }
+    return chain;
+}
+
+// The platform a publish builds for: the one -p names, which every publisher of it takes, else the only one they take,
+// else CROSSBIND_APP_PLATFORM's, else this machine's desktop one.
+export function publishPlatform(chain, platform, envPlatform, host = process.platform) {
+    const store = chain.at(-1).name;
+    const platforms = chain.reduce((taken, { publisher }) => taken.filter((one) => publisher.platforms.includes(one)), PUBLISH_PLATFORMS);
+    if (platforms.length === 0) throw new Error(`crossbind: ${store} comes after ${chain[0].name}, which takes apps of none of its platforms.`);
+    const takes = `${store} takes ${listed(platforms)} apps`;
+    if (platform) {
+        if (!platforms.includes(platform)) throw new Error(`crossbind: ${takes}, not ${possessive(platform)}, which -p names.`);
+        return platform;
+    }
+    if (platforms.length === 1) return platforms[0];
+    if (envPlatform) {
+        if (!platforms.includes(envPlatform)) throw new Error(`crossbind: ${takes}, not ${possessive(envPlatform)}, which CROSSBIND_APP_PLATFORM names.`);
+        return envPlatform;
+    }
+    if (platforms.includes(DESKTOP_PLATFORMS[host])) return DESKTOP_PLATFORMS[host];
+    throw new Error(`crossbind: ${takes}: name one with -p.`);
+}
+
+// The options of each publisher of a publish, as the command line gives them, and the arguments Vite takes. An option
+// that another publisher takes is refused, naming whose it is; any other goes on to Vite.
+export function publishOptions(chain, args, publishers) {
+    const kinds = new Map();
+    chain.forEach(({ name, publisher }) => Object.entries(publisher.options).forEach(([option, { value }]) => {
+        const first = kinds.get(option);
+        if (first && (first.value === null) !== (value === null)) {
+            throw new Error(`crossbind: ${first.name} and ${name} both take --${kebab(option)}, one as a flag and one with a value: one of them names it otherwise.`);
+        }
+        if (!first) kinds.set(option, { name, value });
+    }));
+    const given = new Map(chain.map(({ name }) => [name, new Map()]));
+    const foreign = new Map();
+    const viteArgs = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const match = /^--([a-z][a-z0-9-]*)(?:=(.*))?$/s.exec(args[index]);
+        const option = match && camel(match[1]);
+        const owners = match ? chain.filter(({ publisher }) => Object.hasOwn(publisher.options, option)) : [];
+        if (owners.length === 0) {
+            const other = match && publishers.find(({ publisher }) => Object.hasOwn(publisher.options, option));
+            if (other) foreign.set(other.name, [...(foreign.get(other.name) ?? []), `--${match[1]}`]);
+            else viteArgs.push(args[index]);
+            continue;
+        }
+        const { value: placeholder } = owners.at(-1).publisher.options[option];
+        let value = true;
+        if (placeholder !== null && match[2] === undefined) {
+            value = args[index + 1];
+            index += 1;
+            if (value === undefined || value.startsWith('-')) throw new Error(`crossbind: --${match[1]} takes a value, as ${placeholder}.`);
+        } else if (placeholder !== null) {
+            value = match[2];
+        } else if (match[2] !== undefined) {
+            throw new Error(`crossbind: --${match[1]} takes no value.`);
+        }
+        owners.forEach(({ name }) => given.get(name).set(option, value));
+    }
+    if (foreign.size > 0) {
+        const whose = [...foreign].map(([owner, names]) => `${listed(names, 'and')} ${names.length > 1 ? 'are' : 'is'} ${possessive(owner)}`);
+        throw new Error(`crossbind: ${listed(whose, 'and')}, which ${chain.at(-1).name} takes none of.`);
+    }
+    const options = Object.fromEntries(chain.map(({ name, publisher }) => [name, Object.fromEntries(Object.entries(publisher.options)
+        .map(([option, { value, default: fallback }]) => [option, given.get(name).get(option) ?? (value === null ? false : fallback)]))]));
+    return { options, viteArgs };
+}
+
+// The help of the stores crossbind publishes to itself, with the options each takes after its name.
+export function publishHelp(publishers = builtInPublishers()) {
+    const signature = (option, { value }) => `--${kebab(option)}${value ? ` ${value}` : ''}`;
+    const width = Math.max(...publishers.flatMap(({ publisher }) => Object.entries(publisher.options).map(([option, declared]) => signature(option, declared).length)));
+    return [
+        '',
+        'Stores, each with the options it takes after its name:',
+        ...publishers.flatMap(({ name, publisher }) => [
+            `  ${name}: ${storeName({ name, publisher })}, for ${listed(publisher.platforms)} apps${publisher.isDefault ? ', which goes first for them' : ''}`,
+            ...Object.entries(publisher.options).map(([option, declared]) => `    ${signature(option, declared).padEnd(width)}  ${declared.help}${declared.default ? ` (default: ${declared.default})` : ''}`),
+        ]),
+        "An app's extensions add stores of their own, each with the options its package gives.",
+    ].join('\n');
+}
+
+// The changes the first publisher makes to the config for its build: a JSON merge patch of crossbind.config.js's
+// export.
+async function buildChanges(extension, api) {
+    const { name } = extension;
+    const changes = await step(extension, 'build', api);
+    if (changes === null || changes === undefined) return null;
+    if (!isObject(changes) || !isJsonValue(changes)) {
+        throw new Error(`crossbind: ${name}'s build gives no changes to crossbind.config.js, which are an object of JSON values merged into its export, where null removes a key.`);
+    }
+    return changes;
+}
+
+// Hands the build's output to the uploads of the publishers after the first, each with what the one before it put out.
+async function uploadAfter(chain, apis, sessions, output, firstPublished) {
+    let published = firstPublished;
+    for (const [index, extension] of chain.entries()) {
+        const { name } = extension;
+        if (index > 0) {
+            const answer = await step(extension, 'upload', apis[index], sessions[index], output, published);
+            if (answer?.isRebuildAsked) throw new Error(`crossbind: ${name} asks for another build, which ${chain[0].name}, whose build it publishes from, alone can ask for.`);
+            published = answer?.published;
+        }
+    }
+}
+
+// Sends an app to a store through its publisher, after those it comes after. All they need is checked before the build,
+// which takes minutes: on a terminal they ask for what is missing and set it up; without one, as in CI, every missing
+// piece is named at once. crossbind then builds the app once, with the first publisher's changes to the config, build
+// number and environment, and hands its output to each one's upload in turn. The first may ask for another build, as
+// an iOS app's does once its user has given Apple's reasons for an API it calls.
+export default async function publish(args, { platform, envPlatform, runVite }) {
+    const publishers = publishersOf(state.config.extensions);
+    const { store, rest } = storeOf(args, platform, envPlatform, publishers);
+    const chain = publishChain(publishers, store);
+    const own = builtInPublishers().map(({ name }) => name);
+    chain.filter((extension) => own.includes(extension.name) && state.config.extensions.includes(extension))
+        .forEach(({ name, root }) => console.log(`crossbind: the extension ${name} of ${root} replaces crossbind's own publisher of its name.`));
+    const target = publishPlatform(chain, platform, envPlatform);
+    const { options, viteArgs } = publishOptions(chain, rest, publishers);
+    const run = { buildNumber: undefined };
+    const isGuided = hasTerminal();
+    const apis = chain.map(({ name }) => extensionApi(name, {
+        platform: target, options: options[name], isGuided, run,
+    }));
+    const [first] = chain;
+    const changes = await buildChanges(first, apis[0]);
+    if (changes) state.config = await loadConfig(undefined, undefined, { changes });
+    const checked = [];
+    for (const [index, extension] of chain.entries()) checked.push((await step(extension, 'check', apis[index])) ?? {});
+    const missing = checked.flatMap((result) => result.missing ?? []);
+    if (missing.length > 0) throw new Error(missing.join('\n'));
+    const sessions = checked.map(({ session }) => session);
+    run.buildNumber = (await step(first, 'buildNumber', apis[0], sessions[0])) ?? null;
+    if (run.buildNumber !== null && !(Number.isInteger(run.buildNumber) && run.buildNumber >= 1 && run.buildNumber <= MAX_VERSION_CODE)) {
+        throw new Error(`crossbind: ${first.name}'s buildNumber gives ${JSON.stringify(run.buildNumber)}, which is no build number: a whole number from 1 to ${MAX_VERSION_CODE}, as both stores take, or null for the app's own.`);
+    }
+    for (let builds = 1; ; builds += 1) {
+        clearAppOutputs();
+        const buildEnv = await step(first, 'buildEnv', apis[0], sessions[0]);
+        const exitCode = await runVite(['build', ...viteArgs], {
+            ...process.env,
+            ...(changes ? { [CONFIG_CHANGES]: JSON.stringify(changes) } : {}),
+            ...buildEnv,
+            CROSSBIND_APP_PLATFORM: target,
+            ...(run.buildNumber === null ? {} : { CROSSBIND_APP_BUILD_NUMBER: String(run.buildNumber) }),
+        });
+        if (exitCode !== 0) {
+            throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to ${storeName(first)}.`), { exitCode });
+        }
+        const output = appOutputOf(target);
+        const answer = await step(first, 'upload', apis[0], sessions[0], output);
+        if (!answer?.isRebuildAsked) {
+            await uploadAfter(chain, apis, sessions, output, answer?.published);
+            return;
+        }
+        if (builds === MAX_BUILDS) throw new Error(`crossbind: ${first.name} asks for another build after ${MAX_BUILDS}, as many as a publish makes.`);
+    }
+}

package/src/actions/uploadKey.js

@@ -0,0 +1,134 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {
+    SIGNING, machineUploadKey, releaseSigning, uploadKeyEnv,
+} from './androidGradle.js';
+import pullDockerImage, { getDockerImage } from '../utils/pullDockerImage.js';
+import { DOCKER_RUN_SECURITY_ARGS } from '../utils/dockerSecurity.js';
+import getOsUserAndGroupId from '../utils/getOsUserAndGroupId.js';
+import loadSystemConfig, { updateSystemConfig } from '../utils/systemConfig.js';
+import { hasKeychain, readSecret, storeSecret } from '../utils/keychain.js';
+import { PASSWORD_RULES, makePassword, passwordProblem } from '../utils/password.js';
+import { askHidden, askLine, hasTerminal } from '../utils/ask.js';
+
+const ROLE = 'android-app';
+const PLATFORM = 'linux/amd64';
+const ALIAS = 'upload';
+// Nobody sees an upload key's name: an app installed from Google Play carries Google's signature.
+const NAME = 'CN=Android upload key';
+// Google Play wants a key valid past 2033; 10,000 days is 27 years.
+const VALIDITY_DAYS = 10000;
+
+// Where `crossbind app upload-key` makes this machine's upload key.
+export const uploadKeyFile = () => path.join(os.homedir(), '.crossbind', 'keys', 'android-upload.p12');
+
+// keytool in crossbind's android-app image, which an Android app's build pulls anyway: with no network, the key's folder
+// alone, and the password by name in the environment, never on a command line.
+function keytool(keystore, command, args, password, { isReadOnly = false } = {}) {
+    pullDockerImage(ROLE, PLATFORM);
+    const result = spawnSync('docker', [
+        'run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '--network', 'none', '--platform', PLATFORM, '--user', getOsUserAndGroupId(),
+        '-v', `${path.dirname(keystore)}:/keys${isReadOnly ? ':ro' : ''}`, '-e', SIGNING.password, getDockerImage(ROLE, PLATFORM),
+        'keytool', command, '-keystore', `/keys/${path.basename(keystore)}`, ...args, '-storepass:env', SIGNING.password,
+    ], { encoding: 'utf8', env: { ...process.env, [SIGNING.password]: password } });
+    if (result.error) throw new Error(`crossbind: cannot run keytool in the ${ROLE} image: ${result.error.message}`, { cause: result.error });
+    return { status: result.status, output: `${result.stdout ?? ''}${result.stderr ?? ''}`.trim() };
+}
+
+// The password the user types for a new key, held to the rules and typed twice the same.
+async function typedPassword() {
+    console.error(`The upload key's password needs:\n${PASSWORD_RULES.map((rule) => `  - ${rule}`).join('\n')}`);
+    for (;;) {
+        const password = await askHidden('Password: ');
+        const problem = passwordProblem(password);
+        if (problem) {
+            console.error(`That one will not do: ${problem}.`);
+        } else if (await askHidden('Again: ') === password) {
+            return password;
+        } else {
+            console.error('The two did not match.');
+        }
+    }
+}
+
+// A new key's password: the environment's, else one crossbind makes or one the user types. Only a keychain keeps a made
+// one, so without a keychain the user types their own.
+async function newPassword(canKeep) {
+    const given = process.env[SIGNING.password];
+    if (given) {
+        const problem = passwordProblem(given);
+        if (problem) throw new Error(`crossbind: ${SIGNING.password} cannot lock an upload key: ${problem}.`);
+        return { password: given, isMade: false };
+    }
+    if (!hasTerminal()) throw new Error(`crossbind: an upload key needs a password: run this on a terminal, which asks for one, or set ${SIGNING.password}.`);
+    const choice = canKeep
+        ? await askLine("The upload key's password:\n  1) make a strong one for me (recommended)\n  2) I will type my own\nChoose 1 or 2 [1]: ")
+        : '2';
+    if (choice.trim() !== '2') return { password: makePassword(), isMade: true };
+    return { password: await typedPassword(), isMade: false };
+}
+
+// Makes a key this machine's upload key, its password kept in the system keychain where it can be.
+function keep(keystore, alias, password, isKeychain) {
+    const isKept = isKeychain && storeSecret(keystore, password);
+    updateSystemConfig({ ANDROID_KEYSTORE: keystore, ANDROID_KEY_ALIAS: alias });
+    console.log(isKept
+        ? 'crossbind: the system keychain keeps its password, so builds sign without asking.'
+        : `crossbind: builds ask for its password, as no keychain keeps it; set ${SIGNING.password} where no one can type it, as in CI.`);
+}
+
+// Makes this machine's upload key, which signs its Android apps' bundles for Google Play. It never makes one over a key
+// the machine has.
+export async function makeUploadKey({ isKeychain = true } = {}) {
+    const system = loadSystemConfig();
+    if (system.ANDROID_KEYSTORE) {
+        throw new Error(`crossbind: this machine's upload key is ${system.ANDROID_KEYSTORE}, and crossbind never makes another over it, as Google Play takes an app's updates only signed with the key it knows. To make a new one anyway, drop it first with crossbind config delete ANDROID_KEYSTORE.`);
+    }
+    const file = uploadKeyFile();
+    if (fs.existsSync(file)) {
+        throw new Error(`crossbind: ${file} is there already, and crossbind never replaces an upload key: use it with crossbind app upload-key --use ${file}.`);
+    }
+    const canKeep = isKeychain && hasKeychain();
+    const { password, isMade } = await newPassword(canKeep);
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const made = keytool(file, '-genkeypair', ['-storetype', 'PKCS12', '-alias', ALIAS, '-keyalg', 'RSA', '-keysize', '2048',
+        '-validity', String(VALIDITY_DAYS), '-dname', NAME], password);
+    if (made.status !== 0) throw new Error(`crossbind: keytool did not make the upload key:\n${made.output}`);
+    fs.chmodSync(file, 0o600);
+    console.log(`crossbind: your upload key is ${file}.`);
+    if (isMade) console.log(`crossbind: its password, shown this once: ${password}`);
+    keep(file, ALIAS, password, canKeep);
+    console.log(`crossbind: keep a copy of ${file} and of its password somewhere safe, as a password manager. Google keeps only the key's certificate: a lost key takes an upload key reset in Play Console, which takes effect 72 hours later.`);
+}
+
+// Makes a key the user has this machine's upload key, once it opens with its password and alias.
+export async function useUploadKey(file, { alias = ALIAS, isKeychain = true } = {}) {
+    const keystore = path.resolve(file);
+    if (!fs.statSync(keystore, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${keystore} is no file.`);
+    const password = process.env[SIGNING.password] || (hasTerminal() ? await askHidden(`Password of ${keystore}: `) : '');
+    if (!password) throw new Error(`crossbind: ${keystore} needs its password: run this on a terminal, which asks for it, or set ${SIGNING.password}.`);
+    const opened = keytool(keystore, '-list', ['-alias', alias], password, { isReadOnly: true });
+    if (opened.status !== 0) throw new Error(`crossbind: ${keystore} did not open with that password and the alias ${alias}:\n${opened.output}`);
+    console.log(`crossbind: this machine's upload key is ${keystore}, alias ${alias}.`);
+    keep(keystore, alias, password, isKeychain);
+}
+
+// The environment an Android release builds in, with the environment's upload key, else this machine's, whose password
+// the keychain keeps or the terminal gives, and whether a key signs it: checked before the native build, not after it.
+export async function releaseSigningEnv() {
+    const key = machineUploadKey();
+    const password = key && !key.password && hasTerminal() ? await askHidden(`Password of this machine's upload key, ${key.keystore}: `) : null;
+    const env = key ? uploadKeyEnv({ ...key, password: key.password || password }) : {};
+    return { env, isSigned: releaseSigning({ ...process.env, ...env }) !== null };
+}
+
+// The password the keychain keeps for this machine's upload key, for another machine or CI.
+export function showUploadKeyPassword() {
+    const { ANDROID_KEYSTORE: keystore } = loadSystemConfig();
+    if (!keystore) throw new Error('crossbind: this machine has no upload key: crossbind app upload-key makes one.');
+    const password = readSecret(keystore);
+    if (!password) throw new Error(`crossbind: no keychain keeps the password of ${keystore}.`);
+    console.log(password);
+}

package/src/actions/windowsSigning.js

@@ -49,7 +49,7 @@ export function windowsSigning(env = process.env) {
         return null;
     }
     if (TOKENS.includes(storetype)) {
-        throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is a hardware token, which crossbind's windows container does not reach. Sign with a cloud's key service, as Azure Trusted Signing (TRUSTEDSIGNING) or Azure Key Vault (AZUREKEYVAULT), or with a PKCS#12 file.`);
+        throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is a hardware token, which crossbind's windows container does not reach. Sign with a cloud's key service, as Azure Artifact Signing (TRUSTEDSIGNING) or Azure Key Vault (AZUREKEYVAULT), or with a PKCS#12 file.`);
     }
     if (![...FILE_STORES, ...CLOUDS].includes(storetype)) {
         throw new Error(`crossbind: ${WINDOWS_SIGNING.storetype} ${storetype} is no store type jsign takes: ${[...FILE_STORES, ...CLOUDS].join(', ')}.`);