nw-builder 4.8.0 → 4.9.0

package/README.md

@@ -386,7 +386,6 @@ nwbuild({
 ### Chores
 
 - chore(docs): don't store JSDoc definitions in `typedef`s - get's hard to understand during development.
-- chore(get): verify sha checksum for downloads
 - chore: annotate file paths as `fs.PathLike` instead of `string`.
 - chore(bld): factor out core build step
 - chore(bld): factor out linux config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nw-builder",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "description": "Build NW.js desktop applications for MacOS, Windows and Linux.",
   "keywords": [
     "NW.js",
@@ -9,7 +9,7 @@
     "Application"
   ],
   "author": {
-    "name": "Steffen Müller",
+    "name": "Steffen Müller",
     "url": "https://www.mllrsohn.com/"
   },
   "maintainers": [
@@ -52,26 +52,24 @@
     "license-check": "jsgl --local ."
   },
   "devDependencies": {
-    "@stylistic/eslint-plugin-js": "^2.3.0",
-    "@vitest/coverage-v8": "^2.0.4",
+    "@stylistic/eslint-plugin-js": "^2.6.2",
+    "@vitest/coverage-v8": "^2.0.5",
     "base-volta-off-of-nwjs": "^1.0.5",
-    "eslint": "^9.8.0",
+    "eslint": "^9.9.0",
     "eslint-config-tjw-jsdoc": "^1.0.5",
-    "eslint-plugin-jsdoc": "^48.8.3",
+    "eslint-plugin-jsdoc": "^50.2.2",
     "eslint-plugin-markdown": "^5.0.0",
     "js-green-licenses": "^4.0.0",
     "jsdoc": "^4.0.3",
-    "nw": "^0.89.0",
-    "patch-package": "^8.0.0",
+    "nw": "^0.90.0",
     "selenium-webdriver": "^4.23.0",
     "vitest": "^2.0.4"
   },
   "dependencies": {
     "archiver": "^7.0.1",
-    "axios": "^1.7.2",
-    "cli-progress": "^3.12.0",
+    "axios": "^1.7.4",
     "glob": "^11.0.0",
-    "node-gyp": "^10.1.0",
+    "node-gyp": "^10.2.0",
     "plist": "^3.1.0",
     "resedit": "^2.0.2",
     "semver": "^7.6.3",

package/src/bld.js

@@ -230,21 +230,19 @@ const manageManifest = async ({ nwPkg, managedManifest, outDir, platform }) => {
     "utf8",
   );
 
-  process.chdir(
-    path.resolve(
-      outDir,
-      platform !== "osx"
-        ? "package.nw"
-        : "nwjs.app/Contents/Resources/app.nw",
-    ),
+  const cwd = path.resolve(
+    outDir,
+    platform !== "osx"
+      ? "package.nw"
+      : "nwjs.app/Contents/Resources/app.nw",
   );
 
   if (manifest.packageManager.startsWith("npm")) {
-    child_process.execSync(`npm install`);
+    child_process.execSync(`npm install`, { cwd });
   } else if (manifest.packageManager.startsWith("yarn")) {
-    child_process.execSync(`yarn install`);
+    child_process.execSync(`yarn install`, { cwd });
   } else if (manifest.packageManager.startsWith("pnpm")) {
-    child_process.execSync(`pnpm install`);
+    child_process.execSync(`pnpm install`, { cwd });
   }
 };
 
@@ -420,16 +418,14 @@ const setOsxConfig = async ({ outDir, app }) => {
 
 const buildNativeAddon = ({ cacheDir, version, platform, arch, outDir, nodeVersion }) => {
   let nodePath = path.resolve(cacheDir, `node-v${version}-${platform}-${arch}`);
-  process.chdir(
-    path.resolve(
-      outDir,
-      platform !== "osx"
-        ? "package.nw"
-        : "nwjs.app/Contents/Resources/app.nw",
-    ),
+  const cwd = path.resolve(
+    outDir,
+    platform !== "osx"
+      ? "package.nw"
+      : "nwjs.app/Contents/Resources/app.nw",
   );
 
-  child_process.execSync(`node-gyp rebuild --target=${nodeVersion} --nodedir=${nodePath}`);
+  child_process.execSync(`node-gyp rebuild --target=${nodeVersion} --nodedir=${nodePath}`, { cwd });
 };
 
 const compress = async ({

package/src/get/index.js

@@ -6,6 +6,7 @@ import decompress from "./decompress.js";
 import ffmpeg from "./ffmpeg.js";
 import node from "./node.js";
 import nw from "./nw.js";
+import verify from './verify.js';
 
 import util from "../util.js";
 
@@ -24,7 +25,7 @@ import util from "../util.js";
 
 /**
  * Get binaries.
- * 
+ *
  * @deprecated since v4.6.4. This logic will be ported over to `nwjs/npm-installer` repo and removed in the next major release (v5.0).
  *
  * @async
@@ -133,6 +134,12 @@ async function get(options) {
 
     await decompress(ffmpegFilePath, options.cacheDir);
 
+    await verify(
+      `${options.downloadUrl}/v${options.version}/SHASUMS256.txt`,
+      `${options.cacheDir}/shasum/${options.version}.txt`,
+      options.cacheDir,
+    );
+
     /**
      * Platform dependant file name of FFmpeg binary.
      *

package/src/get/verify.js

@@ -0,0 +1,48 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import request from './request.js';
+
+import util from '../util.js';
+
+/**
+ * Verify the SHA256 checksum of downloaded artifacts.
+ *
+ * @param {string} shaUrl - URL to get the shasum text file from.
+ * @param {string} shaOut - File path to shasum text file.
+ * @param {string} cacheDir - File path to cache directory.
+ * @throws {Error}
+ * @returns {Promise<boolean>}
+ */
+export default async function verify(shaUrl, shaOut, cacheDir) {
+  const shaOutExists = await util.fileExists(shaOut);
+
+  if (shaOutExists === false) {
+    /* Create directory if does not exist. */
+    await fs.promises.mkdir(path.dirname(shaOut), { recursive: true });
+
+    /* Download SHASUM text file. */
+    await request(shaUrl, shaOut);
+  }
+
+  /* Read SHASUM text file */
+  const shasum = await fs.promises.readFile(shaOut, { encoding: 'utf-8' });
+  const shasums = shasum.trim().split('\n');
+  for await (const line of shasums) {
+    const [storedSha, filePath] = line.split('  ');
+    const relativeFilePath = path.resolve(cacheDir, filePath);
+    const relativefilePathExists = await util.fileExists(relativeFilePath);
+    if (relativefilePathExists) {
+      const fileBuffer = await fs.promises.readFile(relativeFilePath);
+      const hash = crypto.createHash('sha256');
+      hash.update(fileBuffer);
+      const generatedSha = hash.digest('hex');
+      if (storedSha !== generatedSha) {
+        throw new Error('SHA256 checksums do not match.');
+      }
+    }
+  }
+
+  return true;
+}

package/src/get/verify.test.js

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+
+import verify from "./verify.js";
+
+describe("get/verify", function () {
+
+  it("verify shasums", async function () {
+    const status = await verify(
+      'https://dl.nwjs.io/v0.90.0/SHASUMS256.txt',
+      './node_modules/nw/shasum/0.90.0.txt',
+      './node_modules/nw'
+    );
+    expect(status).toBe(true);
+  }, Infinity);
+});

package/src/postinstall.js

@@ -6,13 +6,8 @@ import url from 'node:url';
 const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
 
 const baseVoltaPath = path.resolve(path.join(__dirname, '..', 'node_modules', 'base-volta-off-of-nwjs', 'index.js'));
-const patchPackagePath = path.resolve(path.join(__dirname, '..', 'node_modules', 'patch-package'));
 
 /* Execute the script in development mode only since it is used during testing */
 if (fs.existsSync(baseVoltaPath)) {
   child_process.execSync('node ' + baseVoltaPath);
 }
-
-if (fs.existsSync(patchPackagePath)) {
-  child_process.execSync('node ' + patchPackagePath);
-}