crossbind 2.0.0-beta.76 → 2.0.0-beta.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crossbind",
-  "version": "2.0.0-beta.76",
+  "version": "2.0.0-beta.77",
   "license": "MIT",
   "homepage": "https://crossbind.dev",
   "repository": {
@@ -55,7 +55,7 @@
     "upath": "^3.0.8"
   },
   "optionalDependencies": {
-    "@crossbind/bridge-tools": "2.0.0-beta.76"
+    "@crossbind/bridge-tools": "2.0.0-beta.77"
   },
   "keywords": [
     "webassembly",

package/src/actions/buildNativeCommand.js

@@ -4,10 +4,12 @@ import { fileURLToPath } from 'node:url';
 import run from './run.js';
 import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
+import copyNativeNotices from './nativeNotices.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { buildLinkLibArgs } from '../utils/linkLayout.js';
+import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const PROJECT_SOURCE = fileURLToPath(new URL('../assets/cmake/command', import.meta.url));
@@ -67,8 +69,10 @@ export default async function buildNativeCommand(target, options = {}) {
 
     const platformPrefix = `Native-${buildType}`;
     logger.startStep(target, 'native command');
+    const projectDir = stageProject(build);
+    resetCMakeCacheForSource(`${build}/${platformPrefix}/${target.path}`, projectDir, target);
     run(null, [
-        'cmake', stageProject(build),
+        'cmake', projectDir,
         `-DCMAKE_BUILD_TYPE=${buildType}`,
         `-DCROSSBIND_COMMAND_FILE=${target.commandName}`,
         `-DCROSSBIND_LINK_ARGS=${linkArgs.join(';')}`,
@@ -76,6 +80,7 @@ export default async function buildNativeCommand(target, options = {}) {
         `-DCROSSBIND_STATIC=${isStatic ? 'ON' : 'OFF'}`,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
+    copyNativeNotices(target);
     fs.copyFileSync(`${build}/${platformPrefix}/${target.path}/${target.commandName}`, `${build}/${target.commandName}`);
     logger.doneStep(target, 'native command');
 

package/src/actions/licenses.js

@@ -179,9 +179,9 @@ function toolchainNoticeTexts(platform, pattern) {
     return texts.length > 0 ? texts.join('\n\n') : null;
 }
 
-// A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
+// A Linux or Windows addon, app or executable carries its C++ runtime; a Windows one also carries parts of the
 // mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
-// A macOS addon uses the system's C++ runtime. Their texts and versions are what the link copied out of its image.
+// A macOS binary uses the system's C++ runtime. Their texts and versions are what the link copied out of its image.
 function addonToolchainRows(platform) {
     const shared = {
         npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
@@ -219,10 +219,43 @@ function addonToolchainRows(platform) {
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
             licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
             licenseText: toolchainNoticeTexts('win32', MINGW_NOTICE),
+            isNoticeRequired: true,
         },
     ];
 }
 
+// A static musl executable carries musl's libc, whose MIT license asks every copy for its notice. Its text and version
+// are what the link copied out of its image; an addon and a library leave the C library to what runs them.
+function muslRow() {
+    return {
+        npmName: null,
+        version: null,
+        sha256: null,
+        licenseSelected: null,
+        isCopyleft: false,
+        name: 'musl',
+        license: 'MIT',
+        licenseDeclared: 'MIT',
+        sourceUrl: 'https://git.musl-libc.org/cgit/musl',
+        nativeVersion: toolchainNotice('linuxmusl', NATIVE_NOTICES.muslVersion),
+        licenseText: toolchainNoticeText('linuxmusl', NATIVE_NOTICES.muslText),
+        licenseNotes: 'the musl libc of the linux toolchain image, statically linked into the executable',
+        isNoticeRequired: true,
+    };
+}
+
+const BINARY_KINDS = { node: 'addon', app: 'app', native: 'executable' };
+
+// The runtimes a binary carries without the notice their licenses ask its distribution for, which its link copies out of
+// the image. A list of no binary (no runtimeEnv), such as a static library's, leaves those notices to the binary's own.
+export function missingNotices(rows, { platform, runtimeEnv }) {
+    const kind = BINARY_KINDS[runtimeEnv];
+    if (!kind) return [];
+    return rows
+        .filter((row) => row.isNoticeRequired && !row.licenseText)
+        .map((row) => `x ${row.name}: its license asks a distribution of the ${platform} ${kind} for its notices, and the list has none; build the ${platform} ${kind}, whose link copies them out of its toolchain image`);
+}
+
 const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
 const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
 
@@ -613,7 +646,8 @@ export async function vendoringLibraries() {
 // copies and the toolchain runtime, and for wasm crossbind's runtime, which the
 // module's glue bundles. runtimeEnv 'node' adds the crossbind runtime an
 // addon of that platform compiles in, or without a platform the one its loader bundles;
-// runtimeEnv 'app' adds what an app's host carries.
+// runtimeEnv 'app' adds what an app's host carries; runtimeEnv 'native' adds the C library
+// a static musl executable links.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
     assertSourcesStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
@@ -646,6 +680,7 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (platform === 'wasm') rows.push(...wasmToolchainRows(), crossbindRow("crossbind's JavaScript runtime, which the module's glue bundles"));
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
+    if (platform === 'linuxmusl' && runtimeEnv === 'native') rows.push(muslRow());
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
     if (runtimeEnv === 'app') {
         rows.push(...appRuntimeRows(platform));

package/src/actions/nativeNotices.js

@@ -8,6 +8,7 @@ const MINGW_CLANG = '/opt/llvm-mingw/bin/clang';
 // The x64 and arm64 targets share one mingw-w64 build.
 const MINGW_VERSION_HEADER = '/opt/llvm-mingw/x86_64-w64-mingw32/include/_mingw_mac.h';
 const LIBCXX_LICENSE = '/opt/licenses/linux-sysroot/libcxx-LICENSE.TXT';
+const MUSL_LICENSE = '/opt/licenses/linux-sysroot/musl/musl-COPYRIGHT';
 const NDK_CLANG = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/clang`;
 
 const ifFile = (file, command) => `if [ -f ${file} ]; then ${command}; fi`;
@@ -31,7 +32,16 @@ const SCRIPTS = {
     },
     android: (dir) => [clangVersion(NDK_CLANG, dir)],
 };
-SCRIPTS.linuxmusl = SCRIPTS.linux;
+// A static musl executable also carries musl's libc, whose notice every musl link keeps. musl records its version only
+// in libc, as the one string of version.lo.
+SCRIPTS.linuxmusl = (dir, target) => {
+    const libc = `/opt/crossbind/sysroots/${linuxTriple(target)}/usr/lib/libc.a`;
+    return [
+        ...SCRIPTS.linux(dir, target),
+        ifFile(MUSL_LICENSE, `cp ${MUSL_LICENSE} ${dir}/${NATIVE_NOTICES.muslText}`),
+        ifFile(libc, `ar p ${libc} version.lo | tr -cs '[:print:]' '\\n' | grep -x -E '[0-9]+\\.[0-9]+\\.[0-9]+' > ${dir}/${NATIVE_NOTICES.muslVersion}`),
+    ];
+};
 
 // Copies them beside the build after a link in the target's image, where crossbind licenses reads them. A host
 // toolchain keeps none of these files, and its build goes on without them.

package/src/bin.js

@@ -48,7 +48,7 @@ import { cargoHome } from './utils/runCargo.js';
 import { containerRootOf, sourceRoot } from './utils/runPackageSource.js';
 import { importSchemesOf, sourceNamesOf } from './utils/packageSources.js';
 import { cleanDepsCache } from './utils/dependencyRebuild.js';
-import collectLicenseRows, { vendoringLibraries } from './actions/licenses.js';
+import collectLicenseRows, { missingNotices, vendoringLibraries } from './actions/licenses.js';
 import { formatNoticesMarkdown, formatCycloneDxSbom, validateSpdx } from './utils/licenseReport.js';
 import { SBOM_FILE, nodePackageMeta, shippedRows, writeNodePackageLicense } from './utils/packageLicense.js';
 import findFiles from './utils/findFiles.js';
@@ -225,9 +225,9 @@ program.command('licenses')
     .description('list bundled native dependencies with SPDX license, versions and source URL')
     .option('--notices [file]', 'write a THIRD-PARTY-NOTICES markdown file (default: THIRD-PARTY-NOTICES.md)')
     .option('--sbom [file]', 'write a CycloneDX SBOM json file (default: sbom.cdx.json)')
-    .option('--check', 'exit non-zero when a license field is missing or not valid SPDX')
+    .option('--check', 'exit non-zero when a license field is missing or not valid SPDX, and with -e when the binary lacks a notice the license of a runtime it carries asks for')
     .option('--platform <platform>', "also list what this platform's artifact statically links beyond the package graph (vendored copies, toolchain runtime)")
-    .addOption(new Option('-e, --runtime-env <runtimeEnv>', "also list the crossbind runtime an addon of --platform compiles in (without --platform the one its loader bundles), or what an app's host carries").choices(['node', 'app']))
+    .addOption(new Option('-e, --runtime-env <runtimeEnv>', "also list the crossbind runtime an addon of --platform compiles in (without --platform the one its loader bundles), what an app's host carries, or the C library a static musl executable links").choices(['node', 'app', 'native']))
     .option('--json [file]', 'write the rows, license texts included, as JSON (default: licenses.json)')
     .option('--package', "write this Node-API package's LICENSE, sbom.cdx.json and package.json license field (with -e node)")
     .action(async (options) => {
@@ -280,7 +280,9 @@ program.command('licenses')
                 .map((row) => ({ row, result: validateSpdx(row.license) }))
                 .filter(({ result }) => !result.isValid);
             invalid.forEach(({ row, result }) => console.error(`x ${row.name} (${row.npmName}): ${result.error}`));
-            if (invalid.length > 0) process.exit(1);
+            const unnoticed = missingNotices(rows, { platform: options.platform, runtimeEnv: options.runtimeEnv });
+            unnoticed.forEach((problem) => console.error(problem));
+            if (invalid.length > 0 || unnoticed.length > 0) process.exit(1);
             console.log('✓ all license fields are valid SPDX');
         }
     });

package/src/utils/toolchainNotices.js

@@ -20,6 +20,8 @@ export const NATIVE_NOTICES = {
     clangVersion: 'clang-version.txt',
     libcxxVersion: 'libcxx-version.txt',
     mingwVersion: 'mingw-w64-version.txt',
+    muslText: 'musl-COPYRIGHT',
+    muslVersion: 'musl-version.txt',
 };
 
 export const MINGW_NOTICE = /^COPYING/;