hammerkit 1.27.0-next.6 → 1.27.0-next.8

package/dist/cache/backends/registry-cache-backend.js

@@ -5,6 +5,7 @@ const crypto_1 = require("crypto");
 const os_1 = require("os");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../../utils/tar");
 const registry_reference_1 = require("./registry/registry-reference");
 const registry_client_1 = require("./registry/registry-client");
 const MAX_TAG_LENGTH = 128;
@@ -74,8 +75,7 @@ function createRegistryCacheBackend(spec) {
                 const layerFile = (0, path_1.join)(dir, 'layer.tar');
                 const files = (await environment.file.listFiles(from)).sort();
                 // portable + mtime-free so identical entries produce identical digests
-                // `noMtime` is supported by tar 6 but missing from its type definitions
-                await (0, tar_1.create)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
+                await (0, tar_2.packArchive)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
                 const layer = await (0, registry_client_1.digestFile)(layerFile);
                 const config = Buffer.from(JSON.stringify({
                     architecture: 'amd64',

package/dist/kubernetes/ensure-kubernetes-persistent-volume-claim-exists.js

@@ -65,7 +65,7 @@ async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume
             },
         },
     };
-    service.status.console('stdout', `ensure volume ${volume.name}`);
+    service.status.write('debug', `ensure volume ${volume.name}`);
     // Don't block on the PVC reaching "Bound". Storage classes with
     // volumeBindingMode WaitForFirstConsumer (docker-desktop's "standard",
     // k3d/k3s local-path, most cloud defaults) keep the claim Pending until a pod

package/dist/kubernetes/ensure-persistent-data.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensurePersistentData = exports.packSource = exports.clearClaim = exports.getPodForPersistence = void 0;
 const apply_1 = require("./apply");
 const path_1 = require("path");
-const tar_1 = require("tar");
+const tar_1 = require("../utils/tar");
 const resources_1 = require("./resources");
 const await_running_state_1 = require("./await-running-state");
 const sleep_1 = require("../utils/sleep");
@@ -104,18 +104,18 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
             volumes: persistence.volumes,
         },
     };
-    service.status.console('stdout', `create pod ${name}`);
+    service.status.write('debug', `create pod ${name}`);
     await removeStalePod(instance, env.namespace, name);
     const pod = await (0, apply_1.apply)(instance, podSpec);
     if (pod.status?.phase !== 'Running') {
-        service.status.console('stdout', `await running state ${name}`);
+        service.status.write('debug', `await running state ${name}`);
         await (0, await_running_state_1.awaitRunningState)(instance, env, name, 'Running');
     }
     try {
         await fn(name);
     }
     finally {
-        service.status.console('stdout', `delete pod ${name}`);
+        service.status.write('debug', `delete pod ${name}`);
         await instance.coreApi.deleteNamespacedPod({ name, namespace: env.namespace });
     }
 }
@@ -124,7 +124,7 @@ exports.getPodForPersistence = getPodForPersistence;
 // the task runs on it or outputs are restored into it, so it holds what a new one would
 async function clearClaim(instance, env, work, pod) {
     const targetPath = `/dev/hammerkit/${work.id()}`;
-    work.status.console('stdout', `clear what an earlier run left in ${targetPath}`);
+    work.status.write('info', `clear what an earlier run left in ${targetPath}`);
     let failure = null;
     const res = await instance.exec.exec(env.namespace, pod, 'volume', ['find', targetPath, '-mindepth', '1', '-maxdepth', '1', '-exec', 'rm', '-rf', '{}', '+'], process.stdout, process.stderr, null, false, (status) => {
         if (status.status !== 'Success') {
@@ -141,7 +141,7 @@ exports.clearClaim = clearClaim;
 // the claim (see getClaimSubPath) instead of under its own name
 function packSource(source) {
     const fileItem = (0, path_1.basename)(source.localPath);
-    return stream_1.Readable.from((0, tar_1.create)({
+    return stream_1.Readable.from((0, tar_1.packArchive)({
         cwd: (0, path_1.dirname)(source.localPath),
         filter(path) {
             return source.matcher(path, source.localPath);
@@ -172,7 +172,7 @@ options = {}) {
     if (persistence.sources.length === 0 && !options.reset) {
         return;
     }
-    service.status.console('stdout', 'start upload container');
+    service.status.write('debug', 'start upload container');
     await getPodForPersistence(instance, env, service, persistence, 'write', async (name) => {
         if (options.reset) {
             await clearClaim(instance, env, service, name);
@@ -183,7 +183,7 @@ options = {}) {
                 continue;
             }
             const data = packSource(source);
-            service.status.console('stdout', `upload ${source.localPath}`);
+            service.status.write('info', `upload ${source.localPath}`);
             const targetPath = `/dev/hammerkit/${service.id()}`;
             const res = await instance.exec.exec(env.namespace, name, 'volume', ['tar', 'xf', '-', '-C', targetPath], process.stdout, process.stderr, data, false, (status) => {
                 service.status.write('debug', `upload ${source.localPath} to ${name}: ${status}`);

package/dist/planner/work-runtime-docker.js

@@ -12,6 +12,7 @@ const event_cache_1 = require("../executer/event-cache");
 const get_docker_executor_1 = require("../executer/get-docker-executor");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const plan_work_volume_1 = require("./utils/plan-work-volume");
 const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
@@ -302,7 +303,7 @@ async function archiveContainer(docker, environment, item, path) {
         for (const generatedArchive of (0, event_cache_1.getArchivePaths)(item.data, path)) {
             // a file output is a bind mount of a host file, so archive it from the host
             const readable = hostFiles.has(generatedArchive.path)
-                ? stream_1.Readable.from((0, tar_1.create)({ cwd: (0, path_1.dirname)(generatedArchive.path) }, [(0, path_1.basename)(generatedArchive.path)]))
+                ? stream_1.Readable.from((0, tar_2.packArchive)({ cwd: (0, path_1.dirname)(generatedArchive.path) }, [(0, path_1.basename)(generatedArchive.path)]))
                 : await container.getArchive({
                     path: generatedArchive.path,
                 });

package/dist/planner/work-runtime-local.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLocalWorkRuntime = exports.getStateFilename = void 0;
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const path_1 = require("path");
 const local_task_1 = require("../executer/local-task");
 const event_cache_1 = require("../executer/event-cache");
@@ -121,7 +122,7 @@ async function archiveLocal(environment, task, path) {
     for (const generatedArchive of (0, event_cache_1.getArchivePaths)(task.data, path)) {
         await environment.file.writeStream(generatedArchive.filename, 
         // tar's stream is a Minipass stream; Readable.from adapts it to a Node one
-        stream_1.Readable.from((0, tar_1.create)({ cwd: task.data.cwd, gzip: true }, [(0, path_1.relative)(task.data.cwd, generatedArchive.path)])));
+        stream_1.Readable.from((0, tar_2.packArchive)({ cwd: task.data.cwd, gzip: true }, [(0, path_1.relative)(task.data.cwd, generatedArchive.path)])));
     }
 }
 async function restoreLocal(environment, task, path) {

package/dist/server/kubernetes-sandbox-storage.js

@@ -7,6 +7,7 @@ const path_1 = require("path");
 const stream_1 = require("stream");
 const promises_2 = require("stream/promises");
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const apply_1 = require("../kubernetes/apply");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
 const network_policy_1 = require("../kubernetes/network-policy");
@@ -463,7 +464,7 @@ class KubernetesSandboxStorage {
             await (0, git_checkout_1.git)([`--git-dir=${repository}`, 'fetch', '--quiet', '--depth', '1', '--', fetch.url, fetch.ref], fetch.env, fetch.signal, what);
             await (0, git_checkout_1.git)([`--git-dir=${repository}`, 'update-ref', `refs/heads/${sandbox_pod_1.INCOMING_REF}`, 'FETCH_HEAD'], fetch.env, fetch.signal, what, op);
             const incoming = `${CLAIM_PATH}/${sandbox_pod_1.INCOMING}`;
-            await this.withPod(key, (pod) => this.exec(pod, ['sh', '-c', 'rm -rf "$1" && mkdir -p "$1" && tar xf - -C "$1"', 'sh', incoming], stream_1.Readable.from((0, tar_1.create)({ cwd: repository, portable: true }, ['.'])), null, fetch.signal));
+            await this.withPod(key, (pod) => this.exec(pod, ['sh', '-c', 'rm -rf "$1" && mkdir -p "$1" && tar xf - -C "$1"', 'sh', incoming], stream_1.Readable.from((0, tar_2.packArchive)({ cwd: repository, portable: true }, ['.'])), null, fetch.signal));
             return (await this.request(key, { op, id: key.id }, fetch.signal)).result;
         }
         finally {

package/dist/server/oauth.js

@@ -106,7 +106,7 @@ class TokenVerifier {
                     ? [groups]
                     : [],
             claims,
-            ...(typeof payload.email_verified === 'boolean' ? { emailVerified: payload.email_verified } : {}),
+            ...emailVerified(payload.email_verified),
         };
     }
     async findKey(issuer, algorithm, kid) {
@@ -224,4 +224,15 @@ function isSecureUrl(value) {
         return false;
     }
 }
+// Some issuers send `email_verified` as the string "true" or "false": either says it as
+// much as the boolean does, anything else says nothing
+function emailVerified(value) {
+    if (value === true || value === 'true') {
+        return { emailVerified: true };
+    }
+    if (value === false || value === 'false') {
+        return { emailVerified: false };
+    }
+    return {};
+}
 //# sourceMappingURL=oauth.js.map

package/dist/server/sandboxes-api.js

@@ -175,7 +175,8 @@ function parse(schema, body) {
 /**
  * Who the commit of a push is by: the caller, as their token names them (`name` and
  * `email`, unless the issuer says the address is not verified), else by their subject at the
- * host of their issuer. Never what the request says, so a commit can not claim to be
+ * host of their issuer. Without a name, the local part of the address names them, then the
+ * subject. Never what the request says, so a commit can not claim to be
  * somebody else's.
  */
 function author(principal) {
@@ -183,11 +184,16 @@ function author(principal) {
         .replace(/[<>\0\r\n]/g, '')
         .trim()
         .slice(0, 200);
-    const name = clean(principal.claims.name) || clean(principal.claims.preferred_username) || clean(principal.sub);
     // an address the issuer says it did not verify is whatever the caller typed in
     const claimed = principal.emailVerified === false ? '' : clean(principal.claims.email);
-    if (/^[^\s@]+@[^\s@]+$/.test(claimed)) {
-        return { name, email: claimed };
+    const email = /^[^\s@]+@[^\s@]+$/.test(claimed) ? claimed : '';
+    // a Google service account's token has an address but no name: its local part reads better than the number in sub
+    const name = clean(principal.claims.name) ||
+        clean(principal.claims.preferred_username) ||
+        email.slice(0, email.indexOf('@')) ||
+        clean(principal.sub);
+    if (email) {
+        return { name, email };
     }
     let host = 'hammerkit';
     try {

package/dist/utils/tar.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packArchive = void 0;
+const tar_1 = require("tar");
+function packArchive(options, files) {
+    return (0, tar_1.create)({ ...options, jobs: 1 }, files);
+}
+exports.packArchive = packArchive;
+//# sourceMappingURL=tar.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.6",
+  "version": "1.27.0-next.8",
   "keywords": [
     "build",
     "build-tool",