reactor-effect-native 0.0.0-reserved.0 → 0.2.0

package/scripts/build.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$root"
+
+if [ "$(uname -s)" = Linux ]; then
+  cc=${CC:-clang-21}
+  cxx=${CXX:-clang++-21}
+  command -v "$cc" >/dev/null 2>&1 || {
+    echo "native-linux-toolchain-missing: C compiler '$cc' not found; set CC/CXX explicitly or opt in to scripts/install-linux-toolchain.sh in a supported Docker/CI environment" >&2
+    exit 2
+  }
+  command -v "$cxx" >/dev/null 2>&1 || {
+    echo "native-linux-toolchain-missing: C++ compiler '$cxx' not found; set CC/CXX explicitly or opt in to scripts/install-linux-toolchain.sh in a supported Docker/CI environment" >&2
+    exit 2
+  }
+  "$cc" --version >/dev/null 2>&1 || { echo "native-linux-toolchain-invalid: CC '$cc' cannot execute" >&2; exit 2; }
+  "$cxx" --version >/dev/null 2>&1 || { echo "native-linux-toolchain-invalid: CXX '$cxx' cannot execute" >&2; exit 2; }
+  export CC="$cc" CXX="$cxx"
+fi
+
+# Cargo discovers configuration from its working directory, not --manifest-path.
+cargo build --config "$root/rust/.cargo/config.toml" --locked --manifest-path "$root/rust/Cargo.toml" --release
+
+case "$(uname -s)-$(uname -m)" in
+  Darwin-arm64) platform=darwin-arm64; library=libreactor_effect_native.dylib ;;
+  Darwin-x86_64) platform=darwin-x64; library=libreactor_effect_native.dylib ;;
+  Linux-x86_64) platform=linux-x64; library=libreactor_effect_native.so ;;
+  Linux-aarch64|Linux-arm64) platform=linux-arm64; library=libreactor_effect_native.so ;;
+  *) echo "unsupported native build host: $(uname -s)-$(uname -m)" >&2; exit 2 ;;
+esac
+
+target=${CARGO_TARGET_DIR:-$root/rust/target}
+"$root/scripts/stage.sh" "$target/release/$library" "$platform"

package/scripts/install-linux-toolchain.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+set -eu
+
+expected_fingerprint=6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
+key_url=https://apt.llvm.org/llvm-snapshot.gpg.key
+keyring=/usr/share/keyrings/apt.llvm.org.gpg
+source_list=/etc/apt/sources.list.d/apt.llvm.org.list
+
+die() {
+  echo "reactor-native-linux-toolchain: $*" >&2
+  exit 2
+}
+
+[ "$(id -u)" -eq 0 ] || die "must run as root; this installer is opt-in for Docker/CI and never invokes sudo itself"
+[ -r /etc/os-release ] || die "cannot identify Linux distribution: /etc/os-release is unavailable"
+
+# shellcheck disable=SC1091
+. /etc/os-release
+case "${ID:-}:${VERSION_CODENAME:-}" in
+  debian:bookworm) suite=bookworm ;;
+  ubuntu:noble) suite=noble ;;
+  *) die "unsupported distribution ${ID:-unknown}:${VERSION_CODENAME:-unknown}; supported: Debian 12 bookworm, Ubuntu 24.04 noble" ;;
+esac
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get install -y --no-install-recommends ca-certificates curl gnupg
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+curl --fail --silent --show-error --location "$key_url" --output "$tmp/llvm-snapshot.gpg.key"
+
+actual_fingerprint=$(gpg --batch --with-colons --show-keys --fingerprint "$tmp/llvm-snapshot.gpg.key" \
+  | awk -F: '$1 == "fpr" { print toupper($10); exit }')
+[ "$actual_fingerprint" = "$expected_fingerprint" ] \
+  || die "apt.llvm.org signing-key fingerprint mismatch: expected $expected_fingerprint, got ${actual_fingerprint:-missing}"
+
+mkdir -p "$(dirname "$keyring")" "$(dirname "$source_list")"
+gpg --batch --yes --dearmor --output "$keyring" "$tmp/llvm-snapshot.gpg.key"
+chmod 0644 "$keyring"
+printf 'deb [signed-by=%s] https://apt.llvm.org/%s/ llvm-toolchain-%s-21 main\n' "$keyring" "$suite" "$suite" > "$source_list"
+
+apt-get update
+apt-get install -y --no-install-recommends clang-21
+
+clang-21 --version
+clang++-21 --version

package/scripts/stage.mjs

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const prefix = "reactor-effect-native:build-identity:";
+const suffix = ":end\0";
+/** @param {Uint8Array} bytes */
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+/** @param {string} directory @param {string} [prefix] @returns {string[]} */
+const sources = (directory, prefix = "") =>
+  readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const relative = `${prefix}${entry.name}`;
+    return entry.isDirectory()
+      ? sources(join(directory, entry.name), `${relative}/`)
+      : entry.isFile()
+        ? [relative]
+        : [];
+  });
+
+const sourceHash = () => {
+  const native = join(root, "rust");
+  const files = [
+    "Cargo.toml",
+    "Cargo.lock",
+    "build.rs",
+    ".cargo/config.toml",
+    "include/reactor_effect_native.h",
+    ...sources(join(native, "src"), "src/"),
+  ].sort();
+  const hash = createHash("sha256");
+  for (const file of files)
+    hash
+      .update(file)
+      .update("\0")
+      .update(readFileSync(join(native, file)))
+      .update("\0");
+  return hash.digest("hex");
+};
+
+const targets = /** @type {const} */ ({
+  "darwin-arm64": ["aarch64-apple-darwin", "libreactor_effect_native.dylib"],
+  "darwin-x64": ["x86_64-apple-darwin", "libreactor_effect_native.dylib"],
+  "linux-x64": ["x86_64-unknown-linux-gnu", "libreactor_effect_native.so"],
+  "linux-arm64": ["aarch64-unknown-linux-gnu", "libreactor_effect_native.so"],
+  "win32-x64": ["x86_64-pc-windows-msvc", "reactor_effect_native.dll"],
+  "win32-arm64": ["aarch64-pc-windows-msvc", "reactor_effect_native.dll"],
+});
+
+const [input, platform] = process.argv.slice(2);
+if (input === "--source-hash" && platform === undefined) {
+  // CI keys its staged-artifact cache on this identity; a cached library whose
+  // embedded identity differs is rejected by the staging check below.
+  console.log(sourceHash());
+  process.exit(0);
+}
+if (input === undefined || platform === undefined || !(platform in targets)) {
+  throw new Error("usage: scripts/stage.mjs <shared-library> <supported-platform-arch>");
+}
+const [target, library] = targets[/** @type {keyof typeof targets} */ (platform)];
+const source = isAbsolute(input) ? input : resolve(root, input);
+const bytes = readFileSync(source);
+const start = bytes.indexOf(prefix);
+const end = start < 0 ? -1 : bytes.indexOf(suffix, start + prefix.length);
+if (start < 0 || end < 0 || bytes.indexOf(prefix, end + suffix.length) !== -1) {
+  throw new Error(
+    "native staging requires exactly one embedded source/build identity; rebuild the native library",
+  );
+}
+const build = JSON.parse(bytes.subarray(start + prefix.length, end).toString("utf8"));
+if (
+  build.schemaVersion !== 1 ||
+  build.abiVersion !== 2 ||
+  build.profile !== "release" ||
+  build.target !== target
+) {
+  throw new Error(
+    "native artifact ABI, release profile or target does not match the requested package platform",
+  );
+}
+const expected = sourceHash();
+if (build.sourceSha256 !== expected) {
+  throw new Error(
+    `native source identity mismatch: artifact ${build.sourceSha256}; current sources ${expected}; rebuild before staging`,
+  );
+}
+const manifest = { schemaVersion: 1, platform, library, sha256: sha256(bytes), build };
+const destination = join(root, "lib", platform, library);
+mkdirSync(dirname(destination), { recursive: true });
+// Readers verify both files, so an interrupted staging operation fails closed.
+// Rename each complete file rather than exposing a partially copied library.
+const temporary = `${destination}.${process.pid}.stage`;
+writeFileSync(temporary, bytes);
+renameSync(temporary, destination);
+const identity = join(dirname(destination), "native-identity.json");
+writeFileSync(`${identity}.${process.pid}.stage`, `${JSON.stringify(manifest, null, 2)}\n`);
+renameSync(`${identity}.${process.pid}.stage`, identity);
+console.log(
+  JSON.stringify({
+    artifact: destination,
+    identity,
+    sha256: manifest.sha256,
+    sourceSha256: expected,
+  }),
+);

package/scripts/stage.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+source_path=${1:-}
+platform=${2:-}
+
+if [ -z "$source_path" ] || [ -z "$platform" ]; then
+  echo "usage: scripts/stage.sh <shared-library> <platform-arch>" >&2
+  echo "example: scripts/stage.sh rust/target/release/libreactor_effect_native.dylib darwin-arm64" >&2
+  exit 2
+fi
+
+case "$platform" in
+  darwin-*) library=libreactor_effect_native.dylib ;;
+  linux-*) library=libreactor_effect_native.so ;;
+  win32-*) library=reactor_effect_native.dll ;;
+  *) echo "unsupported package platform: $platform" >&2; exit 2 ;;
+esac
+
+case "$source_path" in
+  /*) source=$source_path ;;
+  *) source=$root/$source_path ;;
+esac
+
+if [ ! -f "$source" ]; then
+  echo "native library not found: $source" >&2
+  exit 1
+fi
+
+exec "${NODE_BINARY:-node}" "$root/scripts/stage.mjs" "$source" "$platform"