gspace 0.1.1 → 0.2.0

package/lib/bootstrap.js

@@ -1,17 +1,36 @@
-import { constants, promises as fs, createReadStream } from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { createHash, randomBytes } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { Readable } from 'node:stream';
+import { constants, promises as fs, createReadStream } from 'fs';
+import path from 'path';
+import os from 'os';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { createHash, randomBytes } from 'crypto';
+import { spawn, execFile } from 'child_process';
+import { promisify } from 'util';
+import { Readable } from 'stream';
+import { requestHTTPS, cancelBody } from './https.js';
 import { extractBundle, validateFiles, verifyBundle } from './bundle.js';
 
-const VERSION = '0.1.1';
+const VERSION = '0.2.0';
 const DAY = 24 * 60 * 60 * 1000;
 const MAX_ARTIFACT = 256 * 1024 * 1024;
 const nonce = () => randomBytes(12).toString('hex');
 const uid = () => process.getuid();
+const execFileAsync = promisify(execFile);
+
+export async function availableSpace(directory, statfs = fs.statfs) {
+  if (typeof statfs === 'function') {
+    const space = await statfs(directory);
+    return space.bavail * space.bsize;
+  }
+  // Ubuntu 22.04's Node 12 predates fs.statfs. GNU df is part of the base
+  // workstation; use an absolute path and argument vector, never a shell.
+  const result = await execFileAsync('/usr/bin/df', ['--output=avail', '--block-size=1', '--', directory], {
+    env: { ...process.env, LC_ALL: 'C' }, timeout: 10000, maxBuffer: 65536,
+  });
+  const match = /^\s*Avail\s*\n\s*(\d+)\s*$/.exec(result.stdout);
+  const bytes = match && Number(match[1]);
+  if (!match || !Number.isSafeInteger(bytes)) throw new Error('Cannot determine available goinfre space.');
+  return bytes;
+}
 
 async function exists(file) {
   try { await fs.lstat(file); return true; } catch (error) { if (error.code === 'ENOENT') return false; throw error; }
@@ -97,21 +116,21 @@ function asURL(location) {
   return pathToFileURL(path.resolve(location));
 }
 
-export async function fetchHTTPS(url, timeout = 60000, request = fetch, headers = {}) {
-  const signal = AbortSignal.timeout(timeout);
+export async function fetchHTTPS(url, timeout = 60000, request = requestHTTPS, headers = {}) {
+  const deadline = Date.now() + timeout;
   for (let redirects = 0; redirects <= 5; redirects++) {
     url = new URL(url);
     if (url.protocol !== 'https:' || url.username || url.password) throw new Error('Release downloads require HTTPS without embedded credentials.');
-    const response = await request(url, { signal, redirect: 'manual', headers });
+    const response = await request(url, { timeout: Math.max(1, deadline - Date.now()), redirect: 'manual', headers });
     if ([301, 302, 303, 307, 308].includes(response.status)) {
       const location = response.headers.get('location');
-      await response.body?.cancel();
+      await cancelBody(response);
       if (!location) throw new Error('Release redirect has no destination.');
       url = new URL(location, url);
       continue;
     }
     if (!response.ok) {
-      await response.body?.cancel();
+      await cancelBody(response);
       throw new Error(`Release download failed: HTTP ${response.status}`);
     }
     return response;
@@ -142,12 +161,17 @@ function artifact(value, source) {
   const url = new URL(value.url, source);
   if (source.protocol === 'https:' && url.protocol !== 'https:') throw new Error('Remote manifests cannot reference local or insecure artifacts.');
   if (!['https:', 'file:'].includes(url.protocol)) throw new Error('Unsupported artifact URL.');
+  if (value.mirrors !== undefined && (!Array.isArray(value.mirrors) || value.mirrors.length > 3)) throw new Error('Invalid artifact mirrors.');
+  for (const mirror of value.mirrors || []) {
+    const parsed = new URL(mirror);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password) throw new Error('Mirrors require HTTPS without credentials.');
+  }
   return { ...value, url: url.href };
 }
 
 export function validateManifest(value, source) {
-  if (value?.schema_version !== 2 || !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(value.version)) throw new Error('Unsupported release manifest.');
-  const platform = value.platforms?.['linux-x86_64'];
+  if (!value || value.schema_version !== 2 || !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(value.version)) throw new Error('Unsupported release manifest.');
+  const platform = value.platforms && value.platforms['linux-x86_64'];
   if (!platform || !/^2\.\d+$/.test(platform.glibc_min)) throw new Error('Release lacks a supported Linux x86_64 bundle.');
   const unpacked = validateFiles(platform.files);
   if (unpacked !== platform.unpacked_size) throw new Error('Invalid unpacked size.');
@@ -160,7 +184,7 @@ export async function sha256(file) {
     const info = await handle.stat();
     if (!info.isFile() || info.nlink !== 1 || info.size > MAX_ARTIFACT) throw new Error('Unsafe runtime artifact.');
     const hash = createHash('sha256');
-    for await (const chunk of handle.createReadStream({ autoClose: false })) hash.update(chunk);
+    for await (const chunk of createReadStream(null, { fd: handle.fd, autoClose: false })) hash.update(chunk);
     return hash.digest('hex');
   } finally { await handle.close(); }
 }
@@ -170,7 +194,7 @@ const RANGE_SIZE = 1024 * 1024;
 async function downloadRanges(value, handle, first, request) {
   async function copy(response, start, end) {
     if (response.status !== 206 || response.headers.get('content-range') !== `bytes ${start}-${end}/${value.size}`) {
-      await response.body?.cancel();
+      await cancelBody(response);
       throw new Error('Invalid artifact byte range.');
     }
     let position = start;
@@ -202,7 +226,16 @@ async function downloadRanges(value, handle, first, request) {
   if (failure) throw failure.reason;
 }
 
-export async function downloadVerified(value, destination) {
+export async function downloadVerified(value, destination, transport = requestHTTPS) {
+  let failure;
+  for (const url of [value.url, ...(value.mirrors || [])]) {
+    try { return await downloadFromSource({ ...value, url }, destination, transport); }
+    catch (error) { failure = error; }
+  }
+  throw failure;
+}
+
+async function downloadFromSource(value, destination, transport) {
   if (!Number.isSafeInteger(value.size) || value.size <= 0 || value.size > MAX_ARTIFACT || !/^[a-f0-9]{64}$/.test(value.sha256)) throw new Error('Invalid release artifact metadata.');
   const url = new URL(value.url);
   const temporary = `${destination}.download-${nonce()}`;
@@ -212,15 +245,15 @@ export async function downloadVerified(value, destination) {
     let ranged = false;
     if (url.protocol === 'file:') stream = createReadStream(fileURLToPath(url));
     else if (url.protocol === 'https:') {
-      const request = (start, end) => fetchHTTPS(url, 600000, fetch, { Range: `bytes=${start}-${end}` });
-      const response = value.size > RANGE_SIZE ? await request(0, 0) : await fetchHTTPS(url, 600000);
+      const request = (start, end) => fetchHTTPS(url, 600000, transport, { Range: `bytes=${start}-${end}` });
+      const response = value.size > RANGE_SIZE ? await request(0, 0) : await fetchHTTPS(url, 600000, transport);
       if (response.status === 206 && value.size > RANGE_SIZE) {
         await downloadRanges(value, handle, response, request);
         ranged = true;
       } else {
         // Servers without range support can return the entire file as HTTP 200.
-        if (response.status !== 200) { await response.body?.cancel(); throw new Error('Unexpected artifact response.'); }
-        stream = Readable.fromWeb(response.body);
+        if (response.status !== 200) { await cancelBody(response); throw new Error('Unexpected artifact response.'); }
+        stream = Readable.from(response.body);
       }
     } else throw new Error('Artifact requires HTTPS or a local file URL.');
     const hash = createHash('sha256');
@@ -250,13 +283,13 @@ export async function downloadVerified(value, destination) {
 
 export function run(executable, args, options = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, { shell: false, stdio: options.stdio ?? 'inherit', env: options.env ?? process.env });
+    const child = spawn(executable, args, { shell: false, stdio: options.stdio === undefined ? 'inherit' : options.stdio, env: options.env || process.env });
     const forward = signal => { if (!child.killed) child.kill(signal); };
     const onInt = () => forward('SIGINT'), onTerm = () => forward('SIGTERM');
     process.on('SIGINT', onInt); process.on('SIGTERM', onTerm);
     const remove = () => { process.off('SIGINT', onInt); process.off('SIGTERM', onTerm); };
     child.once('error', error => { remove(); reject(new Error(`Cannot start ${executable}: ${error.message}`)); });
-    child.once('exit', (code, signal) => { remove(); resolve(code ?? (signal === 'SIGINT' ? 130 : signal === 'SIGTERM' ? 143 : 1)); });
+    child.once('exit', (code, signal) => { remove(); resolve(code === null ? (signal === 'SIGINT' ? 130 : signal === 'SIGTERM' ? 143 : 1) : code); });
   });
 }
 
@@ -268,7 +301,7 @@ async function lock(root) {
     if (error.code !== 'EEXIST') throw error;
     await safeDirectory(directory);
     const info = await readJSON(path.join(directory, 'owner.json'));
-    if (info?.hostname === os.hostname() && Number.isSafeInteger(info.pid) && info.pid > 1) {
+    if (info && info.hostname === os.hostname() && Number.isSafeInteger(info.pid) && info.pid > 1) {
       let alive = true;
       try { process.kill(info.pid, 0); } catch (failure) { if (failure.code === 'ESRCH') alive = false; }
       if (!alive) {
@@ -296,11 +329,11 @@ async function currentRuntime(root) {
 }
 
 async function prepareRuntime(context, manifest, manifestHash, logFd) {
-  const space = await fs.statfs(context.goinfre);
+  const available = await availableSpace(context.goinfre);
   const libc = process.report.getReport().header.glibcVersionRuntime;
   const minimum = Number(manifest.glibc_min.split('.')[1]);
   if (!libc || Number(libc.split('.')[0]) !== 2 || Number(libc.split('.')[1]) < minimum) throw new Error(`This release requires Linux glibc ${manifest.glibc_min} or newer.`);
-  if (space.bavail * space.bsize < manifest.bundle.size + manifest.unpacked_size + 64 * 1024 * 1024) throw new Error('Not enough goinfre space to download and unpack the runtime safely.');
+  if (available < manifest.bundle.size + manifest.unpacked_size + 64 * 1024 * 1024) throw new Error('Not enough goinfre space to download and unpack the runtime safely.');
   const id = `${manifest.version}-${manifestHash.slice(0, 16)}`;
   const directory = path.join(context.root, 'runtime', id);
   // An incomplete version stays quarantined; a fresh installation gets a unique name.
@@ -348,7 +381,8 @@ export async function main(args, env = process.env) {
     releaseLock = await lock(context.root);
     runtime = await currentRuntime(context.root);
     const config = JSON.parse(await fs.readFile(new URL('../release.json', import.meta.url), 'utf8'));
-    const location = env.GSPACE_RELEASE_MANIFEST || config.manifest;
+    const locations = env.GSPACE_RELEASE_MANIFEST ? [env.GSPACE_RELEASE_MANIFEST] : [config.manifest, ...(config.fallbacks || [])].filter(Boolean);
+    const location = locations[0];
     const forceUpdate = args[0] === '--update';
     if (forceUpdate) args = args.slice(1);
     const cacheFile = path.join(context.root, 'runtime', 'update.json');
@@ -358,9 +392,16 @@ export async function main(args, env = process.env) {
       if (!location && !runtime) throw new Error('No release source configured. Set GSPACE_RELEASE_MANIFEST to a local manifest.json or HTTPS URL, or use GSPACE_CORE for a development build.');
       if (location) {
         try {
-          const source = asURL(location);
-          const raw = await fetchBytes(source, 1024 * 1024);
-          const manifest = validateManifest(JSON.parse(raw.toString('utf8')), source);
+          let source, raw, manifest, sourceError;
+          for (const candidate of locations) {
+            try {
+              source = asURL(candidate);
+              raw = await fetchBytes(source, 1024 * 1024);
+              manifest = validateManifest(JSON.parse(raw.toString('utf8')), source);
+              break;
+            } catch (error) { sourceError = error; }
+          }
+          if (!manifest) throw sourceError;
           const hash = createHash('sha256').update(raw).digest('hex');
           if (!runtime || runtime.manifest_hash !== hash) {
             if (!runtime) console.error(`Gspace is not installed on this workstation.\nUsing ${context.goinfre}`);

package/lib/bundle.js

@@ -1,7 +1,7 @@
-import { constants, createReadStream, promises as fs } from 'node:fs';
-import path from 'node:path';
-import { createHash } from 'node:crypto';
-import { createGunzip } from 'node:zlib';
+import { constants, createReadStream, promises as fs } from 'fs';
+import path from 'path';
+import { createHash } from 'crypto';
+import { createGunzip } from 'zlib';
 
 export const MAX_UNPACKED = 512 * 1024 * 1024;
 const digest = /^[a-f0-9]{64}$/;
@@ -141,7 +141,7 @@ export async function verifyBundle(directory, files) {
     const handle = await fs.open(location, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
       const hash = createHash('sha256');
-      for await (const bytes of handle.createReadStream({ autoClose: false })) hash.update(bytes);
+      for await (const bytes of createReadStream(null, { fd: handle.fd, autoClose: false })) hash.update(bytes);
       if (hash.digest('hex') !== file.sha256) throw new Error('Installed runtime checksum mismatch; refusing execution.');
     } finally { await handle.close(); }
     count++;

package/lib/https.js

@@ -0,0 +1,38 @@
+import https from 'https';
+
+// Node 12 has HTTPS and async iterable streams, but no fetch/AbortSignal API.
+// Keep TLS verification enabled and leave all redirect policy to the caller.
+export function requestHTTPS(url, options = {}) {
+  return new Promise((resolve, reject) => {
+    let incoming;
+    const request = https.get(url, { headers: options.headers || {} }, response => {
+      incoming = response;
+      response.once('end', clear);
+      response.once('close', clear);
+      response.once('error', clear);
+      // Match the small response interface used by the bootstrap and tests.
+      response.cancel = async () => { response.destroy(); clear(); };
+      resolve({
+        status: response.statusCode,
+        ok: response.statusCode >= 200 && response.statusCode < 300,
+        headers: { get: name => {
+          const value = response.headers[name.toLowerCase()];
+          return Array.isArray(value) ? value.join(', ') : value || null;
+        } },
+        body: response,
+      });
+    });
+    const timer = setTimeout(() => {
+      const error = new Error('Release download timed out.');
+      request.destroy(error);
+      if (incoming) incoming.destroy(error);
+    }, options.timeout || 60000);
+    timer.unref();
+    function clear() { clearTimeout(timer); }
+    request.once('error', error => { clear(); reject(error); });
+  });
+}
+
+export async function cancelBody(response) {
+  if (response.body) await response.body.cancel();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gspace",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Gspace launcher for 1337/42 Linux workstations",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     "THIRD_PARTY_NOTICES.txt"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=12.22.9"
   },
   "os": [
     "linux"

package/release.json

@@ -1 +1 @@
-{"manifest": "https://github.com/Seraph919/gspace-releases/releases/latest/download/manifest.json"}
+{"manifest":"https://gspace-downloads.pages.dev/manifest.json","fallbacks":["https://github.com/Seraph919/gspace-releases/releases/latest/download/manifest.json"]}