pinokiod 7.5.30 → 7.5.32

package/kernel/bin/conda-pins.js

@@ -1,6 +1,6 @@
 const semver = require('semver')
 
-const CONDA_PIN_VERSION = "26.3.2"
+const CONDA_PIN_VERSION = "26.5.2"
 const PYTHON_PIN_VERSION = "3.10.20"
 const PYTHON_INSTALL_SPEC = `python=${PYTHON_PIN_VERSION}`
 const WINDOWS_PYTHON_SSL_FIX_SPEC = `${PYTHON_INSTALL_SPEC}=*_1_cpython`

package/kernel/bin/conda.js

@@ -14,6 +14,61 @@ const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
+const WINDOWS_OPENSSL_HOOKS = {
+  activate: {
+    "openssl_activate-win.bat": [
+      "@echo off",
+      'if "%SSL_CERT_FILE%"=="" (',
+      '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+      '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.ps1": [
+      "if (-not $Env:SSL_CERT_FILE) {",
+      '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+      '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.sh": [
+      'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+      '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+      '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+      "fi",
+      "",
+    ].join("\n"),
+  },
+  deactivate: {
+    "openssl_deactivate-win.bat": [
+      "@echo off",
+      'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+      "    set SSL_CERT_FILE=",
+      "    set __CONDA_OPENSSL_CERT_FILE_SET=",
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.ps1": [
+      'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+      "    Remove-Item -Path Env:\\SSL_CERT_FILE",
+      "    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET",
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.sh": [
+      'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+      "    unset SSL_CERT_FILE",
+      "    unset __CONDA_OPENSSL_CERT_FILE_SET",
+      "fi",
+      "",
+    ].join("\n"),
+  },
+}
+const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
+  "zz_pinokio_unset_ssl_cert_dir-win.bat",
+  "zz_pinokio_unset_ssl_cert_dir-win.ps1",
+  "zz_pinokio_unset_ssl_cert_dir-win.sh",
+]
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -69,7 +124,7 @@ class Conda {
     }
     return base
   }
-  async ensureSslCertDirOverride() {
+  async ensureWindowsOpenSslHooks() {
     if (this.kernel.platform !== "win32") {
       return
     }
@@ -82,33 +137,26 @@ class Conda {
     if (condaRootDirs.length === 0) {
       return
     }
-    const hookFiles = {
-      "zz_pinokio_unset_ssl_cert_dir-win.bat": `@echo off
-if "%__CONDA_OPENSSL_CERT_DIR_SET%"=="1" (
-    set "SSL_CERT_DIR="
-    set "__CONDA_OPENSSL_CERT_DIR_SET="
-)
-`,
-      "zz_pinokio_unset_ssl_cert_dir-win.ps1": `if ($Env:__CONDA_OPENSSL_CERT_DIR_SET -eq "1") {
-  Remove-Item -Path Env:\\SSL_CERT_DIR -ErrorAction SilentlyContinue
-  Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_DIR_SET -ErrorAction SilentlyContinue
-}
-`,
-      "zz_pinokio_unset_ssl_cert_dir-win.sh": `if [[ "\${__CONDA_OPENSSL_CERT_DIR_SET:-}" == "1" ]]; then
-  unset SSL_CERT_DIR
-  unset __CONDA_OPENSSL_CERT_DIR_SET
-fi
-`,
-    }
     for (const rootDir of condaRootDirs) {
-      const hookDirs = [
-        this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`),
-        this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`),
-      ]
-      for (const hookDir of hookDirs) {
-        await fs.promises.mkdir(hookDir, { recursive: true }).catch(() => {})
-        for (const [filename, content] of Object.entries(hookFiles)) {
-          await fs.promises.writeFile(path.resolve(hookDir, filename), content)
+      const activateDir = this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`)
+      const deactivateDir = this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`)
+      for (const hookDir of [activateDir, deactivateDir]) {
+        for (const filename of LEGACY_SSL_CERT_DIR_HOOK_FILES) {
+          await fs.promises.rm(path.resolve(hookDir, filename), { force: true }).catch(() => {})
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.activate)) {
+        const hookPath = path.resolve(activateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.deactivate)) {
+        const hookPath = path.resolve(deactivateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
         }
       }
     }
@@ -134,7 +182,7 @@ report_errors: false`)
         await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
         await this.ensureCompatibilityAlias()
       }
-      await this.ensureSslCertDirOverride()
+      await this.ensureWindowsOpenSslHooks()
     }
   }
   async check() {
@@ -157,7 +205,8 @@ report_errors: false`)
           conda_versions[name] = version
           conda_builds[name] = build
           if (name === "conda") {
-            conda_check.conda = true
+            const coerced = semver.coerce(version)
+            conda_check.conda = coerced && semver.eq(coerced, CONDA_PIN_VERSION)
           }
           // check conda-libmamba-solver is up to date
           // sometimes it just fails silently so need to check
@@ -260,6 +309,7 @@ report_errors: false`)
 
     let condaPackages = [
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
+      `"conda=${CONDA_PIN_VERSION}"`,
       `"conda-libmamba-solver>=25.4.0"`,
     ]
 
@@ -282,7 +332,7 @@ report_errors: false`)
         this.kernel.bin.path(CONDA_ROOT_DIR, "python3.exe"),
       )
     }
-    await this.ensureSslCertDirOverride()
+    await this.ensureWindowsOpenSslHooks()
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)

package/kernel/bin/index.js

@@ -448,6 +448,9 @@ class Bin {
           break 
         }
       }
+      if (this.mod && this.mod.conda && this.mod.conda.ensureWindowsOpenSslHooks) {
+        await this.mod.conda.ensureWindowsOpenSslHooks()
+      }
     }
 
     if (this.platform === "darwin") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "7.5.30",
+  "version": "7.5.32",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -6041,6 +6041,13 @@ class Server {
       if (version === this.version.pinokiod) {
         console.log("version up to date")
       } else if (!(await fse.pathExists(path.resolve(home, "bin/miniforge/conda-meta")))) {
+        // if miniconda => miniforge migration hasn't happened yet
+        if (!(await fse.pathExists(path.resolve(home, "bin/miniconda/conda-meta")))) {
+          // if miniconda folder does NOT exist (new user), set version
+          // if miniconda folder exists (existing user), don't set version yet
+          //    => version only set after miniconda => miniforge migration has happened
+          this.kernel.store.set("version", this.version.pinokiod)
+        }
         console.warn("[WARN] Managed home refresh deferred until Miniforge is installed")
       } else {
         // For every update, this gets triggered exactly once.

package/test/conda-bin.test.js

@@ -7,6 +7,7 @@ const test = require('node:test')
 
 const Conda = require('../kernel/bin/conda')
 const {
+  CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedPythonPinned,
@@ -42,7 +43,7 @@ async function writeCondaMeta(root, name, version, build = 'py_0') {
 }
 
 async function writeHealthyCondaMeta(root, platform = 'win32') {
-  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
+  await writeCondaMeta(root, 'conda', CONDA_PIN_VERSION, 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
 }
@@ -78,6 +79,88 @@ function createConda(kernel) {
   return conda
 }
 
+const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
+  [path.join('activate.d', 'openssl_activate-win.bat')]: [
+    '@echo off',
+    'if "%SSL_CERT_FILE%"=="" (',
+    '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+    '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.ps1')]: [
+    'if (-not $Env:SSL_CERT_FILE) {',
+    '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+    '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.sh')]: [
+    'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+    '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+    '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+    'fi',
+    '',
+  ].join('\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.bat')]: [
+    '@echo off',
+    'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+    '    set SSL_CERT_FILE=',
+    '    set __CONDA_OPENSSL_CERT_FILE_SET=',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.ps1')]: [
+    'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+    '    Remove-Item -Path Env:\\SSL_CERT_FILE',
+    '    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.sh')]: [
+    'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+    '    unset SSL_CERT_FILE',
+    '    unset __CONDA_OPENSSL_CERT_FILE_SET',
+    'fi',
+    '',
+  ].join('\n'),
+}
+
+async function seedWindowsOpenSslHooks(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    await fs.mkdir(path.dirname(hookPath), { recursive: true })
+    await fs.writeFile(hookPath, 'upstream hook with SSL_CERT_DIR\n')
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      await fs.writeFile(path.join(condaHookRoot, hookDirName, filename), 'legacy hook\n')
+    }
+  }
+}
+
+async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    assert.equal(await fs.readFile(hookPath, 'utf8'), expectedContent)
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      assert.equal(await pathExists(path.join(condaHookRoot, hookDirName, filename)), false)
+    }
+  }
+}
+
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-config-'))
   const conda = createConda(createKernel(root))
@@ -99,62 +182,30 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
   assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
 })
 
-test('Conda init writes SSL_CERT_DIR neutralizing hooks only after Miniforge exists', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-init-hooks-'))
+test('Conda init patches Windows OpenSSL hooks and removes legacy SSL_CERT_DIR hooks', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-openssl-hooks-'))
   await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniforge')
   const conda = createConda(createKernel(root))
 
   await conda.init()
 
-  const hookRelativePaths = [
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.ps1'),
-    path.join('activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.sh'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.ps1'),
-    path.join('deactivate.d', 'zz_pinokio_unset_ssl_cert_dir-win.sh'),
-  ]
-  for (const hookRelativePath of hookRelativePaths) {
-    assert.equal(
-      await pathExists(path.join(root, 'bin', 'miniforge', 'etc', 'conda', hookRelativePath)),
-      true
-    )
-  }
-
-  const batHook = await fs.readFile(
-    path.join(root, 'bin', 'miniforge', 'etc', 'conda', 'activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat'),
-    'utf8'
-  )
-  assert.match(batHook, /set "SSL_CERT_DIR="/)
-  assert.match(batHook, /set "__CONDA_OPENSSL_CERT_DIR_SET="/)
-  assert.doesNotMatch(batHook, /SSL_CERT_FILE/)
+  await assertWindowsOpenSslHooksPatched(root, 'miniforge')
 })
 
-test('Conda init writes SSL_CERT_DIR neutralizing hooks for legacy Miniconda roots', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-init-hooks-'))
+test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-openssl-hooks-'))
   await fs.mkdir(path.join(root, 'bin', 'miniconda', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniconda')
   const conda = createConda(createKernel(root))
 
   await conda.init()
 
-  const batHookPath = path.join(
-    root,
-    'bin',
-    'miniconda',
-    'etc',
-    'conda',
-    'deactivate.d',
-    'zz_pinokio_unset_ssl_cert_dir-win.bat'
-  )
-  assert.equal(await pathExists(batHookPath), true)
-
-  const batHook = await fs.readFile(batHookPath, 'utf8')
-  assert.match(batHook, /set "SSL_CERT_DIR="/)
-  assert.match(batHook, /set "__CONDA_OPENSSL_CERT_DIR_SET="/)
-  assert.doesNotMatch(batHook, /SSL_CERT_FILE/)
+  await assertWindowsOpenSslHooksPatched(root, 'miniconda')
 })
 
 test('Conda pins Python 3.10.20 consistently across platforms', async () => {
+  assert.equal(CONDA_PIN_VERSION, '26.5.2')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
@@ -188,7 +239,7 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda=26.5.2" "conda-libmamba-solver>=25.4.0"'
   )
 })
 
@@ -216,7 +267,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda=26.5.2" "conda-libmamba-solver>=25.4.0"'
   )
 })
 
@@ -290,6 +341,16 @@ test('Conda check accepts a runnable managed Windows conda executable', async ()
   assert.equal(await createConda(createKernel(root, 'win32')).check(), true)
 })
 
+test('Conda check rejects runnable installs with the wrong Conda version', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-wrong-version-'))
+  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
+  await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
+  await writeCondaMeta(root, 'python', '3.10.20', 'h4de0772_1_cpython')
+  await writeFakeManagedConda(root, 'win32')
+
+  assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
+})
+
 test('Conda install keeps the old runtime when the replacement installer download fails', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-download-fails-'))
   const miniconda = await createLegacyMiniconda(root)