glasspane-harness 0.7.7 → 0.7.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +3 -3
  2. package/postinstall.mjs +20 -1
package/package.json CHANGED
@@ -25,7 +25,7 @@
25
25
  "scripts": {
26
26
  "postinstall": "node ./postinstall.mjs"
27
27
  },
28
- "version": "0.7.7",
28
+ "version": "0.7.8",
29
29
  "license": "MIT",
30
30
  "os": [
31
31
  "darwin"
@@ -44,7 +44,7 @@
44
44
  },
45
45
  "sideEffects": false,
46
46
  "optionalDependencies": {
47
- "glasspane-harness-darwin-arm64": "0.7.7",
48
- "glasspane-harness-darwin-x64": "0.7.7"
47
+ "glasspane-harness-darwin-arm64": "0.7.8",
48
+ "glasspane-harness-darwin-x64": "0.7.8"
49
49
  }
50
50
  }
package/postinstall.mjs CHANGED
@@ -28,6 +28,9 @@ const arch = archMap[os.arch()] ?? os.arch()
28
28
  // keeps these constants in step with it (this file ships inside the npm wrapper).
29
29
  const base = `glasspane-harness-${platform}-${arch}`
30
30
  const sourceBinary = platform === "windows" ? "glasspane-harness.exe" : "glasspane-harness"
31
+ // Same rule as the names above: the value lives in product.json (`npm.registry`), and
32
+ // harness/tools/product-surface.mjs is what keeps this literal from drifting away from it.
33
+ const REGISTRY = "https://registry.npmjs.org"
31
34
  const targetBinary = path.join(__dirname, "bin", "glasspane-harness.exe")
32
35
 
33
36
  function supportsAvx2() {
@@ -133,7 +136,23 @@ function installPackage(name) {
133
136
  try {
134
137
  const result = childProcess.spawnSync(
135
138
  "npm",
136
- ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", temp, `${name}@${version}`],
139
+ [
140
+ "install",
141
+ "--ignore-scripts",
142
+ "--no-save",
143
+ "--loglevel=error",
144
+ // The registry has to be named. npm resolves `npm_config_registry` (which npm exports
145
+ // into lifecycle scripts), `NPM_CONFIG_REGISTRY`, `~/.npmrc` and a project `.npmrc`, so
146
+ // without this the bytes fetched here — then chmod 0755 and executed — come from
147
+ // whatever mirror the ambient config names, and the package's integrity hash is
148
+ // self-attested by that same mirror. `script/verify-published.ts` passes `--registry`
149
+ // for exactly this reason; the install path is the one that runs on a user's machine.
150
+ "--registry",
151
+ REGISTRY,
152
+ "--prefix",
153
+ temp,
154
+ `${name}@${version}`,
155
+ ],
137
156
  { stdio: "inherit", windowsHide: true },
138
157
  )
139
158
  if (result.status !== 0) return