crossbind 2.0.0-beta.69 → 2.0.0-beta.73

package/src/utils/conanInstall.js

@@ -1,154 +0,0 @@
-import fs from 'node:fs';
-import upath from 'upath';
-import withDirLock from './dirLock.js';
-import logger from './logger.js';
-import loadJson from './loadJson.js';
-import writeIfChanged from './writeIfChanged.js';
-import { getContentHash } from './hash.js';
-import { getDockerImage, imageRoleFor } from './pullDockerImage.js';
-import runConan, {
-    clearConanWork, conanRoot, conanRunner, createConanWork, localToolchainIdentity, removeConanWork, toHostPath,
-} from './runConan.js';
-import { hostProfile, settingsUser, BUILD_PROFILE } from './conanProfile.js';
-import { conanRequires, conanOptionArgs, conanDependenciesKey } from './conanDependencies.js';
-import {
-    conanPackagesOf, stageConanPackage, writeConanManifest, readConanManifest, isControlCharacter,
-} from './conanStage.js';
-import { conanStageDir } from './conanImport.js';
-
-// Bumped when the stage changes shape, so a stage an older crossbind made is made again.
-const CONAN_STAGE_FORMAT = 4;
-// Enough of a failed build's log to reach the error conan ends it with.
-const LOG_TAIL_LINES = 60;
-
-const lockFileOf = (config) => upath.join(config.paths.project, 'conan.lock');
-const stampFileOf = (stageDir, target) => upath.join(stageDir, 'stamps', `${target.path}.json`);
-const logFileOf = (stageDir, target) => upath.join(stageDir, 'logs', `${target.path}.log`);
-const printable = (text) => [...text].filter((char) => char === '\n' || char === '\t' || !isControlCharacter(char)).join('');
-
-// What a staged target was made from. The toolchain is the image, or the host's compiler and conan where
-// conan runs on the host (RUNNER=LOCAL, and iOS always): the profile asks that compiler for its version,
-// so a new one is a new package id and must restage.
-function stampKey(config, target) {
-    const lock = lockFileOf(config);
-    return getContentHash(JSON.stringify({
-        format: CONAN_STAGE_FORMAT,
-        dependencies: config.conanDependencies,
-        host: hostProfile(target),
-        build: BUILD_PROFILE,
-        toolchain: conanRunner(config, target) === 'LOCAL' ? localToolchainIdentity(target) : getDockerImage(imageRoleFor(target)),
-        lock: fs.existsSync(lock) ? fs.readFileSync(lock, 'utf8') : null,
-    }));
-}
-
-// The target's manifest names the dependencies it was staged for.
-const isStaged = (config, stageDir, target) => loadJson(stampFileOf(stageDir, target))?.key === stampKey(config, target)
-    && readConanManifest(stageDir, conanDependenciesKey(config.conanDependencies), target.path) !== null;
-
-function conanFailure(target, result, logFile) {
-    if (result.error && result.error.code !== 'ENOBUFS') {
-        return new Error(`crossbind: could not run conan for ${target.path} (${result.error.message}).`);
-    }
-    let ending = `failed (exit code ${result.status})`;
-    if (result.error) ending = 'was stopped: it printed more than crossbind reads';
-    else if (result.signal) ending = `was stopped by ${result.signal}`;
-    const tail = printable(`${result.stderr ?? ''}`).trim().split('\n').slice(-LOG_TAIL_LINES).join('\n');
-    return new Error(`crossbind: conan install for ${target.path} ${ending}. Its whole log is in ${logFile}.\n${tail}`);
-}
-
-// The parsed file, or null. The parse error is left out: it quotes the text, which recipes can write.
-function readJson(file) {
-    try {
-        return JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch {
-        return null;
-    }
-}
-
-// The lockfile comes back from where the recipes ran, so only a lockfile goes into the project.
-function lockfileText(file) {
-    const lock = readJson(file);
-    if (typeof lock?.version !== 'string') {
-        throw new Error('crossbind: conan wrote no lockfile crossbind can read, so conan.lock is left as it was.');
-    }
-    return `${JSON.stringify(lock, null, 4)}\n`;
-}
-
-function installTarget(config, stageDir, target) {
-    const dependencies = config.conanDependencies;
-    const lock = lockFileOf(config);
-    const hasLock = fs.existsSync(lock);
-    const stampFile = stampFileOf(stageDir, target);
-    const logFile = logFileOf(stageDir, target);
-    // A restage that stops halfway must not pass for a finished one.
-    fs.rmSync(stampFile, { force: true });
-    const work = createConanWork(conanRunner(config, target));
-    const label = `conan ${target.path}`;
-    logger.startTask(label);
-    try {
-        fs.writeFileSync(upath.join(work.dir, 'host.profile'), hostProfile(target));
-        fs.writeFileSync(upath.join(work.dir, 'build.profile'), BUILD_PROFILE);
-        const settings = settingsUser(target);
-        if (settings) fs.writeFileSync(upath.join(work.dir, 'home', 'settings_user.yml'), settings);
-        if (hasLock) fs.copyFileSync(lock, upath.join(work.dir, 'input.lock'));
-        const result = runConan([
-            'install',
-            ...conanRequires(dependencies).flatMap((reference) => ['--requires', reference]),
-            ...conanOptionArgs(dependencies),
-            '-pr:h', work.conanPath('host.profile'),
-            '-pr:b', work.conanPath('build.profile'),
-            '--output-folder', work.conanPath('output'),
-            '--build=missing',
-            '--format=json',
-            // A file, since a build tool writing to stdout would end up inside the JSON.
-            '--out-file', work.conanPath('graph.json'),
-            // Unless told which lockfile to use, conan takes any conan.lock in its working directory.
-            ...(hasLock ? ['--lockfile', work.conanPath('input.lock'), '--lockfile-partial'] : ['--lockfile=']),
-            '--lockfile-out', work.conanPath('resolution.lock'),
-        ], { config, target, work });
-        writeIfChanged(logFile, `${result.stderr ?? ''}`);
-        if (result.error || result.status !== 0) throw conanFailure(target, result, logFile);
-
-        const graph = readJson(upath.join(work.dir, 'graph.json'))?.graph;
-        if (!graph) throw new Error(`crossbind: conan install wrote no graph crossbind can read. Its log is in ${logFile}.`);
-        const packages = conanPackagesOf(graph);
-        const distCmake = fs.readFileSync(upath.join(config.paths.cli, 'assets', 'cmake', 'dist.cmake'), 'utf8');
-        packages.forEach((pkg) => stageConanPackage(pkg, {
-            stageDir, targetPath: target.path, toHost: (reported) => toHostPath(reported, work), store: work.store, distCmake,
-        }));
-        writeConanManifest(stageDir, target.path, {
-            key: conanDependenciesKey(dependencies),
-            packages: packages.map(({
-                packageFolder, includedirs, libdirs, ...entry
-            }) => entry),
-        });
-        writeIfChanged(lock, lockfileText(upath.join(work.dir, 'resolution.lock')));
-        writeIfChanged(stampFile, `${JSON.stringify({ key: stampKey(config, target) })}\n`);
-        logger.doneTask(label, packages.map((pkg) => `${pkg.name} ${pkg.version}`).join(', '));
-    } finally {
-        // Not over the error that ended the run; the next install clears what is left.
-        try {
-            removeConanWork(work);
-        } catch (e) {
-            logger.info(`crossbind: could not remove ${work.dir} (${e.message}).`);
-        }
-    }
-}
-
-// Installs the declared Conan packages for every target not staged from the same inputs yet, and
-// says whether it staged any, so the caller attaches the new manifest.
-export default async function installConanPackages(config, targets) {
-    if (Object.keys(config.conanDependencies ?? {}).length === 0) return false;
-    const stageDir = conanStageDir(config.paths.cache);
-    const pending = targets.filter((target) => !isStaged(config, stageDir, target));
-    if (pending.length === 0) return false;
-    for (const runner of new Set(pending.map((target) => conanRunner(config, target)))) {
-        // A conan store takes one writer at a time, and every project on the machine shares it.
-        await withDirLock(`${conanRoot(runner)}-install.lock`, async () => {
-            clearConanWork(runner);
-            pending.filter((target) => conanRunner(config, target) === runner && !isStaged(config, stageDir, target))
-                .forEach((target) => installTarget(config, stageDir, target));
-        });
-    }
-    return true;
-}

package/src/utils/conanProfile.js

@@ -1,203 +0,0 @@
-import { WASM_EXCEPTION_FLAGS, targetArchiveFlags } from './archiveFlags.js';
-import { ANDROID_NDK, ANDROID_API_LEVEL } from './androidToolchain.js';
-import { IOS_DEPLOYMENT_TARGET } from './iosToolchain.js';
-import {
-    LINUX_ARCHIVE_FLAGS, linuxBuildEnv, linuxTool, linuxToolchainFile, linuxTriple,
-} from './linuxToolchain.js';
-import {
-    DARWIN_CC, DARWIN_CXX, DARWIN_DEPLOYMENT_TARGET, DARWIN_HOST_PACKAGE_PREFIXES,
-} from './darwinToolchain.js';
-import {
-    windowsBuildEnv, windowsTool, windowsToolchainFile, windowsTriple,
-} from './windowsToolchain.js';
-
-// The app's own sources compile as C++20 (assets/cmake/CMakeLists.txt), so C++ packages do too.
-const CPP_STANDARD = '20';
-// The flags change the ABI without changing a setting, and glibc and musl builds share every setting,
-// so these have to change the package id. A conf the profile leaves unset adds nothing to it.
-const PACKAGE_ID_CONFS = ['tools.build:cflags', 'tools.build:cxxflags', 'tools.build:exelinkflags', 'tools.build:sharedlinkflags', 'user.crossbind:libc'];
-
-// Conan renders profiles as Jinja templates: these read the toolchain of whatever runs Conan, the image
-// or the host (under RUNNER=LOCAL, and for iOS and macOS).
-const EMCC_VERSION = "{{ subprocess.check_output(['emcc', '-dumpversion'], text=True).strip() }}";
-const EMSCRIPTEN_TOOLCHAIN = "{{ subprocess.check_output(['em-config', 'EMSCRIPTEN_ROOT'], text=True).strip() }}/cmake/Modules/Platform/Emscripten.cmake";
-const clangMajorVersion = (clang) => `{{ subprocess.check_output(['${clang}', '-dumpversion'], text=True).split('.')[0] }}`;
-const NDK_CLANG_VERSION = clangMajorVersion(`${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/clang`);
-const XCODE_CLANG_VERSION = "{{ subprocess.check_output(['xcrun', 'clang', '-dumpversion'], text=True).split('.')[0] }}";
-const CMAKE_VERSION = "{{ subprocess.check_output(['cmake', '--version'], text=True).split()[2] }}";
-
-const ANDROID_ARCHS = { 'arm64-v8a': 'armv8', x86_64: 'x86_64' };
-// Node's names for the desktop arches, in Conan's spelling.
-const NODE_ARCHS = { x64: 'x86_64', arm64: 'armv8' };
-const LINUX_LIBCS = { linux: 'glibc', linuxmusl: 'musl' };
-const envLines = (env) => Object.entries(env).map(([variable, value]) => `${variable}=${value}`);
-
-// The image's clang wrappers through its CMake toolchain file for the triple, as a port archive for an
-// addon is built. The image runs no musl program, so a musl build is a cross build even on a machine of
-// the same arch, which Conan would take for a native one; configure is told the triple itself.
-const LINUX = {
-    settings: (target) => [
-        'os=Linux',
-        `arch=${NODE_ARCHS[target.arch]}`,
-        'compiler=clang',
-        `compiler.version=${clangMajorVersion(linuxTool(target, 'clang'))}`,
-        'compiler.libcxx=libc++',
-        `compiler.cppstd=${CPP_STANDARD}`,
-    ],
-    conf: (target) => [
-        `tools.build:compiler_executables={'c': '${linuxTool(target, 'clang')}', 'cpp': '${linuxTool(target, 'clang++')}'}`,
-        `tools.cmake.cmaketoolchain:user_toolchain=["${linuxToolchainFile(target)}"]`,
-        `tools.gnu:host_triplet=${linuxTriple(target)}`,
-        ...(target.platform === 'linuxmusl' ? ['tools.build.cross_building:cross_build=True'] : []),
-        `user.crossbind:libc=${LINUX_LIBCS[target.platform]}`,
-    ],
-    buildenv: (target) => envLines(linuxBuildEnv(target)),
-    flags: LINUX_ARCHIVE_FLAGS,
-};
-
-// What differs per platform; the rest of the host profile is shared.
-const PLATFORMS = {
-    wasm: {
-        settings: (target) => [
-            'os=Emscripten',
-            `arch=${target.arch === 'wasm64' ? 'wasm64' : 'wasm'}`,
-            'compiler=emcc',
-            `compiler.version=${EMCC_VERSION}`,
-            'compiler.libcxx=libc++',
-            `compiler.cppstd=${CPP_STANDARD}`,
-            ...(target.runtime === 'mt' ? ['compiler.threads=posix'] : []),
-        ],
-        conf: () => [
-            "tools.build:compiler_executables={'c': 'emcc', 'cpp': 'em++'}",
-            `tools.cmake.cmaketoolchain:user_toolchain=["${EMSCRIPTEN_TOOLCHAIN}"]`,
-        ],
-        buildenv: () => ['CC=emcc', 'CXX=em++', 'AR=emar', 'NM=emnm', 'RANLIB=emranlib', 'STRIP=emstrip'],
-        flags: WASM_EXCEPTION_FLAGS,
-    },
-    // The image's NDK through its own CMake toolchain and default STL, as a port archive is built.
-    android: {
-        settings: (target) => [
-            'os=Android',
-            `os.api_level=${ANDROID_API_LEVEL}`,
-            `arch=${ANDROID_ARCHS[target.arch]}`,
-            'compiler=clang',
-            `compiler.version=${NDK_CLANG_VERSION}`,
-            'compiler.libcxx=c++_static',
-            `compiler.cppstd=${CPP_STANDARD}`,
-        ],
-        conf: () => [`tools.android:ndk_path=${ANDROID_NDK}`],
-        buildenv: () => [],
-        flags: [],
-    },
-    // Xcode's clang for the target's SDK, arm64 only like every crossbind iOS slice. No bitcode flag:
-    // Xcode 27 ld takes the "marker" of -fembed-bitcode-marker for a file when CMake links its check.
-    ios: {
-        settings: (target) => [
-            'os=iOS',
-            `os.version=${IOS_DEPLOYMENT_TARGET}`,
-            `os.sdk=${target.arch}`,
-            'arch=armv8',
-            'compiler=apple-clang',
-            `compiler.version=${XCODE_CLANG_VERSION}`,
-            'compiler.libcxx=libc++',
-            `compiler.cppstd=${CPP_STANDARD}`,
-        ],
-        conf: () => [],
-        buildenv: () => [],
-        flags: [],
-    },
-    linux: LINUX,
-    linuxmusl: LINUX,
-    // The clang xcode-select picks, for the macOS the addons support, as a port archive for a macOS addon
-    // is built; the machine's own packages stay out of reach.
-    darwin: {
-        settings: (target) => [
-            'os=Macos',
-            `os.version=${DARWIN_DEPLOYMENT_TARGET}`,
-            `arch=${NODE_ARCHS[target.arch]}`,
-            'compiler=apple-clang',
-            `compiler.version=${clangMajorVersion(DARWIN_CC)}`,
-            'compiler.libcxx=libc++',
-            `compiler.cppstd=${CPP_STANDARD}`,
-        ],
-        conf: () => [
-            `tools.build:compiler_executables={'c': '${DARWIN_CC}', 'cpp': '${DARWIN_CXX}'}`,
-            `tools.cmake.cmaketoolchain:extra_variables={'CMAKE_IGNORE_PREFIX_PATH': '${DARWIN_HOST_PACKAGE_PREFIXES.join(';')}'}`,
-        ],
-        buildenv: () => ['PKG_CONFIG_LIBDIR='],
-        flags: [],
-    },
-    // The windows image's llvm-mingw through its CMake toolchain file for the triple, as a port archive for
-    // an addon is built. No compiler.runtime: that would make it a clang standing in for MSVC.
-    win32: {
-        settings: (target) => [
-            'os=Windows',
-            `arch=${NODE_ARCHS[target.arch]}`,
-            'compiler=clang',
-            `compiler.version=${clangMajorVersion(windowsTool(target, 'clang'))}`,
-            'compiler.libcxx=libc++',
-            `compiler.cppstd=${CPP_STANDARD}`,
-        ],
-        conf: (target) => [
-            `tools.build:compiler_executables={'c': '${windowsTool(target, 'clang')}', 'cpp': '${windowsTool(target, 'clang++')}', 'rc': '${windowsTool(target, 'windres')}'}`,
-            `tools.cmake.cmaketoolchain:user_toolchain=["${windowsToolchainFile(target)}"]`,
-            `tools.gnu:host_triplet=${windowsTriple(target)}`,
-        ],
-        buildenv: (target) => envLines(windowsBuildEnv(target)),
-        flags: [],
-    },
-};
-
-export const BUILD_PROFILE = [
-    '{% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}',
-    '[settings]',
-    'os={{ detect_api.detect_os() }}',
-    'arch={{ detect_api.detect_arch() }}',
-    'build_type=Release',
-    'compiler={{ compiler }}',
-    'compiler.version={{ detect_api.default_compiler_version(compiler, version) }}',
-    'compiler.cppstd={{ detect_api.default_cppstd(compiler, version) }}',
-    'compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}',
-    '',
-].join('\n');
-
-const list = (values) => JSON.stringify(values);
-
-// Conan checks compiler.version against the versions its own release lists, and a compiler newer than the
-// Conan release lists none for it: Xcode's on the host, or an image's after a toolchain bump. Added to the
-// run's home, this lets any version of the profile's clang through.
-export function settingsUser(target) {
-    const compiler = PLATFORMS[target.platform]?.settings(target).find((setting) => setting.startsWith('compiler='))?.slice('compiler='.length);
-    return ['clang', 'apple-clang'].includes(compiler) ? `compiler:\n  ${compiler}:\n    version: ["ANY"]\n` : null;
-}
-
-export function hostProfile(target) {
-    const platform = PLATFORMS[target.platform];
-    if (!platform) {
-        const names = Object.keys(PLATFORMS);
-        throw new Error(`crossbind: conan: imports build for ${names.slice(0, -1).join(', ')} and ${names.at(-1)} so far; ${target.platform} is not supported yet, so its build cannot use conanDependencies.`);
-    }
-    const flags = list([...platform.flags, ...targetArchiveFlags(target)]);
-    const buildenv = platform.buildenv(target);
-    return [
-        '[settings]',
-        ...platform.settings(target),
-        'build_type=Release',
-        '',
-        '[options]',
-        '*:shared=False',
-        '',
-        '[conf]',
-        ...platform.conf(target),
-        `tools.build:cflags=${flags}`,
-        `tools.build:cxxflags=${flags}`,
-        `tools.build:exelinkflags=${flags}`,
-        `tools.build:sharedlinkflags=${flags}`,
-        `tools.info.package_id:confs=${list(PACKAGE_ID_CONFS)}`,
-        '',
-        ...(buildenv.length > 0 ? ['[buildenv]', ...buildenv, ''] : []),
-        '[platform_tool_requires]',
-        `cmake/${CMAKE_VERSION}`,
-        '',
-    ].join('\n');
-}

package/src/utils/runConan.js

@@ -1,257 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import getOsUserAndGroupId from './getOsUserAndGroupId.js';
-import makeTreeWritable from './makeTreeWritable.js';
-import pullDockerImage, { getDockerImage, getDockerContainerName, imageRoleFor } from './pullDockerImage.js';
-import { DOCKER_RUN_SECURITY_ARGS } from './dockerSecurity.js';
-import assertExecContainer from './execContainer.js';
-import { IOS_DEVELOPER_DIR, XCODE_TOOLCHAIN_BIN } from './iosToolchain.js';
-import { DARWIN_CC, DARWIN_TOOLS_BIN } from './darwinToolchain.js';
-import { HOST_BUILT_PLATFORMS } from './targets.js';
-import { remoteExecParams } from './remoteRunner.js';
-import { runnerFor } from './selectRunner.js';
-
-// Every conan invocation crossbind makes goes through here. The config is passed in instead of read
-// from state, because state attaches the staged Conan packages while it is still being built.
-//
-// A Conan home holds code conan runs (plugins, hooks) and settings every recipe obeys (global.conf,
-// remotes), and the recipes it builds can write to it. So every run gets a home of its own, made in a
-// fresh work directory and deleted with it; only the package store outlives a run. On the host the
-// environment is rebuilt from an allowlist, so CONAN_DEFAULT_PROFILE, a stray CC or a remote's
-// credentials never reach conan.
-const ALLOWED_ENV = [
-    /^PATH$/,
-    /^HOME$/,
-    /^USER$/,
-    /^LOGNAME$/,
-    /^SHELL$/,
-    /^TERM$/,
-    /^TMPDIR$/,
-    /^TEMP$/,
-    /^TMP$/,
-    /^LANG$/,
-    /^LC_[A-Z_]+$/,
-    /^(HTTP|HTTPS|ALL|NO)_PROXY$/i,
-    /^SSL_CERT_(FILE|DIR)$/,
-    /^REQUESTS_CA_BUNDLE$/,
-    // A host Emscripten under RUNNER=LOCAL.
-    /^EMSDK(_NODE|_PYTHON)?$/,
-    /^EM_(CONFIG|CACHE)$/,
-    /^SYSTEMROOT$/i,
-    /^WINDIR$/i,
-    /^USERPROFILE$/i,
-    /^PROGRAMDATA$/i,
-];
-
-// What conan can build on the host: wasm with a host Emscripten, iOS and macOS with Xcode.
-const HOST_PLATFORMS = ['wasm', 'ios', 'darwin'];
-const APPLE_PLATFORM_NAMES = { ios: 'iOS', darwin: 'macOS' };
-// Where a container sees conanRoot(): an exec container mounts all of it here, a run container only
-// the store and its own work directory, at the same places.
-const CONTAINER_ROOT = '/var/cache/crossbind/conan';
-// The package folders conan reports, which the host stages from: downloaded binaries sit in p/<ref>/p, ones
-// conan built in b/<ref>/p. Sources and build folders stay on a remote runner.
-const REMOTE_STORE_OUTPUTS = ['p/*/p', 'b/*/p'];
-// A recipe's build log is the whole compiler output of a library.
-const MAX_BUFFER = 256 * 1024 * 1024;
-// The JSON graph carries conandata, the source URL and SHA-256 of the license rows, from 2.19 on.
-const MIN_CONAN_VERSION = [2, 19];
-
-export function conanRunner(config, target) {
-    const { runner } = runnerFor(imageRoleFor(target), config.system);
-    // Xcode runs on the Mac alone, so iOS and macOS packages build there whatever runner the rest use.
-    return HOST_BUILT_PLATFORMS.includes(target?.platform) ? 'LOCAL' : runner;
-}
-
-// Machine-wide like the cargo cache: built packages are reused by every project, and `pnpm run clear`
-// in one project must not throw them away. Containers write to the store and conan runs the recipes
-// it keeps there, so conan on the host never shares a store with them.
-export function conanRoot(runner = 'DOCKER_RUN') {
-    return path.join(os.homedir(), '.crossbind', runner === 'LOCAL' ? 'conan-local' : 'conan');
-}
-
-// The directory one conan run reads its inputs from and writes its outputs to, with the home it runs
-// with. conanPath names a file of it as conan sees it.
-export function createConanWork(runner) {
-    const root = conanRoot(runner);
-    const store = path.join(root, 'store');
-    fs.mkdirSync(store, { recursive: true });
-    fs.mkdirSync(path.join(root, 'work'), { recursive: true });
-    const dir = fs.mkdtempSync(path.join(root, 'work', 'run-'));
-    const conanDir = runner === 'LOCAL' ? dir : `${CONTAINER_ROOT}/work/${path.basename(dir)}`;
-    const conanPath = (file) => (runner === 'LOCAL' ? path.join(dir, file) : `${conanDir}/${file}`);
-    // conan takes its home from the first .conanrc at or above its working directory, ahead of
-    // CONAN_HOME; one in the working directory itself is always that first one.
-    fs.writeFileSync(path.join(dir, '.conanrc'), 'conan_home=./home\n');
-    fs.mkdirSync(path.join(dir, 'home'));
-    fs.writeFileSync(path.join(dir, 'home', 'global.conf'), [
-        `core.cache:storage_path=${runner === 'LOCAL' ? store : `${CONTAINER_ROOT}/store`}`,
-        'core:non_interactive=True',
-        '',
-    ].join('\n'));
-    return {
-        runner, root, store, dir, conanDir, conanPath,
-    };
-}
-
-function removeTree(dir) {
-    if (!fs.existsSync(dir)) return;
-    makeTreeWritable(dir);
-    fs.rmSync(dir, { recursive: true, force: true });
-}
-
-export const removeConanWork = (work) => removeTree(work.dir);
-
-// What runs that were killed left behind. Only while holding the install lock: no run is going then.
-export const clearConanWork = (runner) => removeTree(path.join(conanRoot(runner), 'work'));
-
-// conan reports paths as it sees them. In a container that is through the mounts, which all sit under
-// CONTAINER_ROOT, so mapping the prefix back is exact; a path anywhere else is none crossbind gave it.
-export function toHostPath(reported, work) {
-    if (work.runner === 'LOCAL') return path.resolve(reported);
-    const clean = path.posix.normalize(reported);
-    // A backslash is a separator again once the path is joined on a Windows host.
-    if (reported.includes('\\') || !clean.startsWith(`${CONTAINER_ROOT}/`)) {
-        throw new Error(`crossbind: conan reported ${JSON.stringify(reported)}, outside the directories crossbind mounts for it.`);
-    }
-    return path.join(work.root, clean.slice(CONTAINER_ROOT.length + 1));
-}
-
-function allowedEnv() {
-    return Object.fromEntries(Object.entries(process.env).filter(([key]) => ALLOWED_ENV.some((allowed) => allowed.test(key))));
-}
-
-// The Xcode every crossbind iOS archive builds with, whichever one xcode-select points at.
-const iosEnv = () => ({ ...allowedEnv(), DEVELOPER_DIR: IOS_DEVELOPER_DIR });
-
-// A GNU ar or nm ahead of Apple's on a Mac's PATH (Homebrew's binutils) writes archives Apple's linker
-// cannot read, and recipes, the build tools they build and Meson all take these tools by name. So the
-// run gets links to Xcode's first on its PATH; for macOS to the ones xcode-select picks, as the macOS
-// ports are built with.
-const APPLE_TOOLS = {
-    ar: 'ar', as: 'as', nm: 'llvm-nm', ranlib: 'ranlib', strip: 'strip',
-};
-const appleToolOf = (target, name) => (target.platform === 'darwin'
-    ? path.join(DARWIN_TOOLS_BIN, name)
-    : path.join(XCODE_TOOLCHAIN_BIN, APPLE_TOOLS[name]));
-
-function withAppleTools(work, env, target) {
-    if (process.platform !== 'darwin') return env;
-    const dir = path.join(work.dir, 'apple-tools');
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir);
-        Object.keys(APPLE_TOOLS).forEach((name) => fs.symlinkSync(appleToolOf(target, name), path.join(dir, name)));
-    }
-    return { ...env, PATH: [dir, env.PATH].filter(Boolean).join(path.delimiter) };
-}
-
-const toolVersions = new Map();
-// The first line a tool prints for --version, asked once.
-function toolVersion(command, env = allowedEnv(), cwd = undefined) {
-    const key = command.join(' ');
-    if (!toolVersions.has(key)) {
-        const [program, ...args] = command;
-        const result = spawnSync(program, [...args, '--version'], { encoding: 'utf8', env, cwd });
-        toolVersions.set(key, `${result.stdout ?? ''}`.split('\n')[0].trim());
-    }
-    return toolVersions.get(key);
-}
-
-// conan migrates the home it starts in, even for --version, so it is asked from a home of crossbind's
-// instead of the user's ~/.conan2.
-function conanVersion() {
-    const dir = path.join(conanRoot('LOCAL'), 'probe');
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, '.conanrc'), 'conan_home=./home\n');
-    return toolVersion(['conan'], allowedEnv(), dir);
-}
-
-function compilerIdentity(target) {
-    if (target?.platform === 'ios') return toolVersion(['xcrun', 'clang'], iosEnv());
-    if (target?.platform === 'darwin') return toolVersion([DARWIN_CC]);
-    return toolVersion(['emcc']);
-}
-
-// What a host conan builds with; for a container the image digest says the same.
-export function localToolchainIdentity(target) {
-    return `${compilerIdentity(target)}\n${conanVersion()}`;
-}
-
-function assertLocalConan(target) {
-    const conan = conanVersion();
-    const [major, minor] = (conan.match(/(\d+)\.(\d+)/) ?? []).slice(1).map(Number);
-    const [needMajor, needMinor] = MIN_CONAN_VERSION;
-    if (major > needMajor || (major === needMajor && minor >= needMinor)) return;
-    const need = `Conan ${MIN_CONAN_VERSION.join('.')} or later; found ${conan || 'none'}.`;
-    throw new Error(HOST_BUILT_PLATFORMS.includes(target.platform)
-        ? `crossbind: Conan packages for ${APPLE_PLATFORM_NAMES[target.platform]} build on this Mac, with the conan on the PATH, which must be ${need} Install or upgrade it with \`brew install conan\` (\`brew upgrade conan\`) or \`pipx install conan\`.`
-        : `crossbind: RUNNER=LOCAL runs conan from the PATH and needs ${need}`);
-}
-
-export default function runConan(args, { config, target, work }) {
-    const options = { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8', maxBuffer: MAX_BUFFER };
-    const role = imageRoleFor(target);
-    if (work.runner === 'LOCAL') {
-        if (!HOST_PLATFORMS.includes(target.platform)) {
-            throw new Error(`crossbind: Conan packages for ${target.platform} build in the ${role} image, which RUNNER=LOCAL does not use.`);
-        }
-        if (HOST_BUILT_PLATFORMS.includes(target.platform) && process.platform !== 'darwin') {
-            throw new Error(`crossbind: Conan packages for ${APPLE_PLATFORM_NAMES[target.platform]} build with Xcode, on a Mac.`);
-        }
-        assertLocalConan(target);
-        const env = withAppleTools(work, { ...(target.platform === 'ios' ? iosEnv() : allowedEnv()), CONAN_HOME: path.join(work.dir, 'home') }, target);
-        return spawnSync('conan', args, { ...options, cwd: work.dir, env });
-    }
-
-    // Google ships the linux NDK for x86_64 only.
-    const platform = target.platform === 'android' ? 'linux/amd64' : undefined;
-    if (work.runner === 'REMOTE') {
-        return spawnSync(...remoteExecParams({
-            remote: runnerFor(role, config.system).remote,
-            role,
-            image: getDockerImage(role, platform),
-            mounts: [
-                { host: work.store, container: `${CONTAINER_ROOT}/store`, inputRoots: [], outputRoots: REMOTE_STORE_OUTPUTS },
-                { host: work.dir, container: work.conanDir, inputRoots: ['.'], outputRoots: ['.'] },
-            ],
-            cwd: work.conanDir,
-            argv: ['conan', ...args],
-            env: { CONAN_HOME: work.conanPath('home') },
-        }, options));
-    }
-
-    const env = ['-e', `CONAN_HOME=${work.conanPath('home')}`];
-    let runnerArgs;
-    if (work.runner === 'DOCKER_EXEC') {
-        const name = getDockerContainerName(config.paths.base, role);
-        assertExecContainer({
-            name,
-            mounts: [[CONTAINER_ROOT, work.root]],
-            workdir: work.conanDir,
-            hint: `Recreate it with \`crossbind docker stop ${role}\`, \`crossbind docker delete ${role}\` and \`crossbind docker create ${role}\`, which mount ${work.root} at ${CONTAINER_ROOT}.`,
-            mountNote: 'It predates the conan mount.',
-        });
-        runnerArgs = ['exec', ...env, '--user', getOsUserAndGroupId(), '--workdir', work.conanDir, name];
-    } else {
-        pullDockerImage(role, platform);
-        runnerArgs = [
-            'run',
-            '--rm',
-            ...(platform ? ['--platform', platform] : []),
-            ...DOCKER_RUN_SECURITY_ARGS,
-            '-v',
-            `${work.store}:${CONTAINER_ROOT}/store`,
-            '-v',
-            `${work.dir}:${work.conanDir}`,
-            ...env,
-            '--user',
-            getOsUserAndGroupId(),
-            '--workdir',
-            work.conanDir,
-            getDockerImage(role, platform),
-        ];
-    }
-    return spawnSync('docker', [...runnerArgs, 'conan', ...args], options);
-}