pinokiod 7.5.30 → 7.5.31

package/kernel/bin/conda.js

@@ -14,6 +14,61 @@ const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
+const WINDOWS_OPENSSL_HOOKS = {
+  activate: {
+    "openssl_activate-win.bat": [
+      "@echo off",
+      'if "%SSL_CERT_FILE%"=="" (',
+      '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+      '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.ps1": [
+      "if (-not $Env:SSL_CERT_FILE) {",
+      '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+      '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.sh": [
+      'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+      '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+      '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+      "fi",
+      "",
+    ].join("\n"),
+  },
+  deactivate: {
+    "openssl_deactivate-win.bat": [
+      "@echo off",
+      'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+      "    set SSL_CERT_FILE=",
+      "    set __CONDA_OPENSSL_CERT_FILE_SET=",
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.ps1": [
+      'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+      "    Remove-Item -Path Env:\\SSL_CERT_FILE",
+      "    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET",
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.sh": [
+      'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+      "    unset SSL_CERT_FILE",
+      "    unset __CONDA_OPENSSL_CERT_FILE_SET",
+      "fi",
+      "",
+    ].join("\n"),
+  },
+}
+const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
+  "zz_pinokio_unset_ssl_cert_dir-win.bat",
+  "zz_pinokio_unset_ssl_cert_dir-win.ps1",
+  "zz_pinokio_unset_ssl_cert_dir-win.sh",
+]
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -69,7 +124,7 @@ class Conda {
     }
     return base
   }
-  async ensureSslCertDirOverride() {
+  async ensureWindowsOpenSslHooks() {
     if (this.kernel.platform !== "win32") {
       return
     }
@@ -82,33 +137,26 @@ class Conda {
     if (condaRootDirs.length === 0) {
       return
     }
-    const hookFiles = {
-      "zz_pinokio_unset_ssl_cert_dir-win.bat": `@echo off
-if "%__CONDA_OPENSSL_CERT_DIR_SET%"=="1" (
-    set "SSL_CERT_DIR="
-    set "__CONDA_OPENSSL_CERT_DIR_SET="
-)
-`,
-      "zz_pinokio_unset_ssl_cert_dir-win.ps1": `if ($Env:__CONDA_OPENSSL_CERT_DIR_SET -eq "1") {
-  Remove-Item -Path Env:\\SSL_CERT_DIR -ErrorAction SilentlyContinue
-  Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_DIR_SET -ErrorAction SilentlyContinue
-}
-`,
-      "zz_pinokio_unset_ssl_cert_dir-win.sh": `if [[ "\${__CONDA_OPENSSL_CERT_DIR_SET:-}" == "1" ]]; then
-  unset SSL_CERT_DIR
-  unset __CONDA_OPENSSL_CERT_DIR_SET
-fi
-`,
-    }
     for (const rootDir of condaRootDirs) {
-      const hookDirs = [
-        this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`),
-        this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`),
-      ]
-      for (const hookDir of hookDirs) {
-        await fs.promises.mkdir(hookDir, { recursive: true }).catch(() => {})
-        for (const [filename, content] of Object.entries(hookFiles)) {
-          await fs.promises.writeFile(path.resolve(hookDir, filename), content)
+      const activateDir = this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`)
+      const deactivateDir = this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`)
+      for (const hookDir of [activateDir, deactivateDir]) {
+        for (const filename of LEGACY_SSL_CERT_DIR_HOOK_FILES) {
+          await fs.promises.rm(path.resolve(hookDir, filename), { force: true }).catch(() => {})
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.activate)) {
+        const hookPath = path.resolve(activateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.deactivate)) {
+        const hookPath = path.resolve(deactivateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
         }
       }
     }
@@ -134,7 +182,7 @@ report_errors: false`)
         await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
         await this.ensureCompatibilityAlias()
       }
-      await this.ensureSslCertDirOverride()
+      await this.ensureWindowsOpenSslHooks()
     }
   }
   async check() {
@@ -282,7 +330,7 @@ report_errors: false`)
         this.kernel.bin.path(CONDA_ROOT_DIR, "python3.exe"),
       )
     }
-    await this.ensureSslCertDirOverride()
+    await this.ensureWindowsOpenSslHooks()
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)

package/kernel/bin/index.js

@@ -448,6 +448,9 @@ class Bin {
           break 
         }
       }
+      if (this.mod && this.mod.conda && this.mod.conda.ensureWindowsOpenSslHooks) {
+        await this.mod.conda.ensureWindowsOpenSslHooks()
+      }
     }
 
     if (this.platform === "darwin") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "7.5.30",
+  "version": "7.5.31",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -6041,6 +6041,13 @@ class Server {
       if (version === this.version.pinokiod) {
         console.log("version up to date")
       } else if (!(await fse.pathExists(path.resolve(home, "bin/miniforge/conda-meta")))) {
+        // if miniconda => miniforge migration hasn't happened yet
+        if (!(await fse.pathExists(path.resolve(home, "bin/miniconda/conda-meta")))) {
+          // if miniconda folder does NOT exist (new user), set version
+          // if miniconda folder exists (existing user), don't set version yet
+          //    => version only set after miniconda => miniforge migration has happened
+          this.kernel.store.set("version", this.version.pinokiod)
+        }
         console.warn("[WARN] Managed home refresh deferred until Miniforge is installed")
       } else {
         // For every update, this gets triggered exactly once.

package/test/conda-bin.test.js

@@ -78,6 +78,88 @@ function createConda(kernel) {
   return conda
 }
 
+const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
+  [path.join('activate.d', 'openssl_activate-win.bat')]: [
+    '@echo off',
+    'if "%SSL_CERT_FILE%"=="" (',
+    '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+    '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.ps1')]: [
+    'if (-not $Env:SSL_CERT_FILE) {',
+    '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+    '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.sh')]: [
+    'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+    '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+    '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+    'fi',
+    '',
+  ].join('\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.bat')]: [
+    '@echo off',
+    'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+    '    set SSL_CERT_FILE=',
+    '    set __CONDA_OPENSSL_CERT_FILE_SET=',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.ps1')]: [
+    'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+    '    Remove-Item -Path Env:\\SSL_CERT_FILE',
+    '    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.sh')]: [
+    'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+    '    unset SSL_CERT_FILE',
+    '    unset __CONDA_OPENSSL_CERT_FILE_SET',
+    'fi',
+    '',
+  ].join('\n'),
+}
+
+async function seedWindowsOpenSslHooks(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    await fs.mkdir(path.dirname(hookPath), { recursive: true })
+    await fs.writeFile(hookPath, 'upstream hook with SSL_CERT_DIR\n')
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      await fs.writeFile(path.join(condaHookRoot, hookDirName, filename), 'legacy hook\n')
+    }
+  }
+}
+
+async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    assert.equal(await fs.readFile(hookPath, 'utf8'), expectedContent)
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      assert.equal(await pathExists(path.join(condaHookRoot, hookDirName, filename)), false)
+    }
+  }
+}
+
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-config-'))
   const conda = createConda(createKernel(root))
@@ -99,59 +181,26 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
   assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
 })
 
-test('Conda init writes SSL_CERT_DIR neutralizing hooks only after Miniforge exists', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-init-hooks-'))
+test('Conda init patches Windows OpenSSL hooks and removes legacy SSL_CERT_DIR hooks', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-openssl-hooks-'))
   await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniforge')
   const conda = createConda(createKernel(root))
 
   await conda.init()
 
-  const hookRelativePaths = [
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.ps1'),
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.sh'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.ps1'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.sh'),
-  ]
-  for (const hookRelativePath of hookRelativePaths) {
-    assert.equal(
-      await pathExists(path.join(root, 'bin', 'miniforge', 'etc', 'conda', hookRelativePath)),
-      true
-    )
-  }
-
-  const batHook = await fs.readFile(
-    path.join(root, 'bin', 'miniforge', 'etc', 'conda', 'activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    'utf8'
-  )
-  assert.match(batHook, /set "SSL_CERT_DIR="/)
-  assert.match(batHook, /set "__CONDA_OPENSSL_CERT_DIR_SET="/)
-  assert.doesNotMatch(batHook, /SSL_CERT_FILE/)
+  await assertWindowsOpenSslHooksPatched(root, 'miniforge')
 })
 
-test('Conda init writes SSL_CERT_DIR neutralizing hooks for legacy Miniconda roots', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-init-hooks-'))
+test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-openssl-hooks-'))
   await fs.mkdir(path.join(root, 'bin', 'miniconda', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniconda')
   const conda = createConda(createKernel(root))
 
   await conda.init()
 
-  const batHookPath = path.join(
-    root,
-    'bin',
-    'miniconda',
-    'etc',
-    'conda',
-    'deactivate.d',
-    'zz_pinokio_unset_ssl_cert_dir-win.bat'
-  )
-  assert.equal(await pathExists(batHookPath), true)
-
-  const batHook = await fs.readFile(batHookPath, 'utf8')
-  assert.match(batHook, /set "SSL_CERT_DIR="/)
-  assert.match(batHook, /set "__CONDA_OPENSSL_CERT_DIR_SET="/)
-  assert.doesNotMatch(batHook, /SSL_CERT_FILE/)
+  await assertWindowsOpenSslHooksPatched(root, 'miniconda')
 })
 
 test('Conda pins Python 3.10.20 consistently across platforms', async () => {