wyvrnpm 2.3.2 → 2.8.1

package/src/toolchain/presets.js

@@ -4,6 +4,21 @@ const fs   = require('fs');
 const path = require('path');
 
 const VENDOR_KEY = 'wyvrnpm/generated';
+
+// Local copy of the arch→VS-platform mapping. Duplicated here rather than
+// imported from ./index so preset generation can run standalone (keeps
+// the dependency graph simple — presets.js doesn't otherwise need the
+// toolchain generator). Keep in sync with `archToVsPlatform` in index.js.
+const ARCH_VS_PLATFORM = {
+  x86_64: 'x64',
+  x86:    'Win32',
+  armv8:  'ARM64',
+  armv7:  'ARM',
+};
+
+function isVsGenerator(name) {
+  return typeof name === 'string' && /^Visual Studio \d/.test(name);
+}
 const SCHEMA_VERSION = 3;  // requires CMake ≥ 3.21
 
 /**
@@ -52,6 +67,25 @@ function isWyvrnGenerated(presets) {
  *                                             `CMAKE_TOOLCHAIN_FILE`. Usually
  *                                             derived from the project's own
  *                                             `build.configure` -D args.
+ * @param {string|null} [args.profileArch]     Active profile arch — used to pin
+ *                                             `architecture` for VS generators
+ *                                             so `cmake --preset` produces
+ *                                             binaries matching the profile
+ *                                             (VS otherwise defaults to x64).
+ * @param {string[]|null} [args.configs]       Build recipe's `configs` list
+ *                                             (e.g. ['Debug','Release','MinSizeRel']).
+ *                                             When provided, drives
+ *                                             `CMAKE_CONFIGURATION_TYPES` so
+ *                                             multi-config generators (Ninja
+ *                                             Multi-Config, VS) actually
+ *                                             produce every config the recipe
+ *                                             declares. Null/empty → omitted
+ *                                             (let CMake use its generator
+ *                                             default). `extraCacheVariables`
+ *                                             wins on explicit collision so
+ *                                             authors that already bake the
+ *                                             list into `build.configure`
+ *                                             aren't overridden.
  */
 function buildConfigurePreset({
   profileName,
@@ -60,16 +94,21 @@ function buildConfigurePreset({
   generator = null,
   extraCacheVariables = null,
   installDir = null,
+  profileArch = null,
+  configs = null,
 }) {
   const binaryDir = `\${sourceDir}/build/wyvrn-${profileName}`;
-  // Spread `extraCacheVariables` FIRST, then the wyvrn-owned entries. This
-  // means the recipe cannot redirect `CMAKE_TOOLCHAIN_FILE` — our dep
-  // injection is always the authoritative toolchain pointer. A malicious
-  // or sloppy recipe trying to override it is silently ignored, not
-  // quietly obeyed. Same protection applies to `CMAKE_INSTALL_PREFIX`:
-  // if a recipe declares `build.installDir`, we resolve it under the
-  // binary dir; any cacheVariables override is overwritten below.
+  // CMAKE_CONFIGURATION_TYPES is a defensible default from the recipe's
+  // declared `configs` list. Applied FIRST (lowest precedence) so an
+  // explicit `-DCMAKE_CONFIGURATION_TYPES=...` in `build.configure`
+  // still wins — authors who already pin the list shouldn't silently
+  // lose their override. The wyvrn-owned entries (toolchain, install
+  // prefix) still win over both below.
+  const configsDefault = (Array.isArray(configs) && configs.length > 0)
+    ? { CMAKE_CONFIGURATION_TYPES: configs.join(';') }
+    : {};
   const cacheVariables = {
+    ...configsDefault,
     ...(extraCacheVariables ?? {}),
     CMAKE_TOOLCHAIN_FILE: `\${sourceDir}/${toolchainRelPath}`,
   };
@@ -90,31 +129,49 @@ function buildConfigurePreset({
     cacheVariables,
   };
   if (generator) preset.generator = generator;
+
+  // Visual Studio generators default to x64 when `architecture` is
+  // unspecified — which silently overrides the profile arch and makes
+  // find_package() reject 32-bit installed packages with a pointer-size
+  // mismatch. Pin `architecture` from the profile so `cmake --preset`
+  // produces the right artefacts end-to-end.
+  if (isVsGenerator(generator) && profileArch && ARCH_VS_PLATFORM[profileArch]) {
+    preset.architecture = {
+      value:    ARCH_VS_PLATFORM[profileArch],
+      strategy: 'set',
+    };
+  }
+
   return preset;
 }
 
 /**
- * Two build presets per configure preset: Debug and Release.
+ * One build preset per configuration the recipe declares (or the
+ * legacy default pair `Debug` + `Release` when no list is provided).
+ *
+ * The preset name suffix is the configuration name lower-cased — matches
+ * the previous Debug/Release naming for those two, and extends to
+ * `wyvrn-<profile>-relwithdebinfo` / `-minsizerel` for the multi-config
+ * cases. Authors whose recipes include `MinSizeRel` in `build.configs`
+ * can now `cmake --build --preset wyvrn-<profile>-minsizerel` directly.
  *
  * @param {string} profileName
+ * @param {string[]|null} [configs]  Recipe's declared configurations. When
+ *   null/empty, emits the pre-2.8.1 `Debug` + `Release` pair so existing
+ *   CMakePresets.json files remain byte-identical.
  * @returns {Array<object>}
  */
-function buildBuildPresets(profileName) {
-  const config = `wyvrn-${profileName}`;
-  return [
-    {
-      name:            `${config}-debug`,
-      displayName:     `wyvrn ${profileName} (Debug)`,
-      configurePreset: config,
-      configuration:   'Debug',
-    },
-    {
-      name:            `${config}-release`,
-      displayName:     `wyvrn ${profileName} (Release)`,
-      configurePreset: config,
-      configuration:   'Release',
-    },
-  ];
+function buildBuildPresets(profileName, configs = null) {
+  const base = `wyvrn-${profileName}`;
+  const list = (Array.isArray(configs) && configs.length > 0)
+    ? configs
+    : ['Debug', 'Release'];
+  return list.map((cfg) => ({
+    name:            `${base}-${cfg.toLowerCase()}`,
+    displayName:     `wyvrn ${profileName} (${cfg})`,
+    configurePreset: base,
+    configuration:   cfg,
+  }));
 }
 
 /**
@@ -127,6 +184,8 @@ function buildFreshPresetsFile({
   generator = null,
   extraCacheVariables = null,
   installDir = null,
+  profileArch = null,
+  configs = null,
 }) {
   return {
     version: SCHEMA_VERSION,
@@ -138,9 +197,9 @@ function buildFreshPresetsFile({
       },
     },
     configurePresets: [buildConfigurePreset({
-      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir,
+      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
     })],
-    buildPresets: buildBuildPresets(profileName),
+    buildPresets: buildBuildPresets(profileName, configs),
   };
 }
 
@@ -161,18 +220,34 @@ function mergeIntoExisting(existing, {
   generator = null,
   extraCacheVariables = null,
   installDir = null,
+  profileArch = null,
+  configs = null,
 }) {
   const newConfigure = buildConfigurePreset({
-    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir,
+    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
   });
-  const newBuilds    = buildBuildPresets(profileName);
+  const newBuilds    = buildBuildPresets(profileName, configs);
   const newConfigureNames = new Set([newConfigure.name]);
-  const newBuildNames     = new Set(newBuilds.map((b) => b.name));
+  // When replacing THIS profile's build presets, drop every pre-existing
+  // one that targets the same configurePreset — the fresh `newBuilds`
+  // list fully replaces them. Scoping to configurePreset avoids stepping
+  // on presets for OTHER profiles in the same file, which is the whole
+  // point of the merge path.
+  //
+  // Without this, editing `build.configs` from 4 configs down to 2 would
+  // leave orphan build presets pointing at configurations CMake won't
+  // generate.
+  const myBase = `wyvrn-${profileName}`;
+  const isMyBuildPreset = (p) => p && p.configurePreset === myBase;
 
   const configurePresets = (existing.configurePresets ?? []).filter((p) => !newConfigureNames.has(p.name));
   configurePresets.push(newConfigure);
 
-  const buildPresets = (existing.buildPresets ?? []).filter((p) => !newBuildNames.has(p.name));
+  // Drop every pre-existing build preset that targets THIS profile's
+  // configurePreset — the fresh `newBuilds` list (one per current
+  // `configs` entry) fully replaces them. Presets for OTHER profiles
+  // stay untouched so the multi-profile merge story is preserved.
+  const buildPresets = (existing.buildPresets ?? []).filter((p) => !isMyBuildPreset(p));
   buildPresets.push(...newBuilds);
 
   return {
@@ -223,8 +298,10 @@ function generateCMakePresets({
   generator = null,
   extraCacheVariables = null,
   installDir = null,
+  profileArch = null,
+  configs = null,
 }) {
-  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir };
+  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs };
   const candidates = [
     { filePath: path.join(projectRoot, 'CMakePresets.json'),     isUser: false },
     { filePath: path.join(projectRoot, 'CMakeUserPresets.json'), isUser: true  },

package/src/toolchain/template.cmake

@@ -17,6 +17,17 @@ set(WYVRN_PROFILE_NAME             "{{PROFILE_NAME}}")
 set(WYVRN_PROFILE_HASH             "{{PROFILE_HASH}}")
 set(WYVRN_PROFILE_OS               "{{PROFILE_OS}}")
 set(WYVRN_PROFILE_ARCH             "{{PROFILE_ARCH}}")
+
+# "64" for 64-bit arches (x86_64, armv8, …), "32" for 32-bit (x86, armv7, …),
+# empty for arches outside the known mapping. Derived at generation time from
+# the profile so it is valid BEFORE `project()` — unlike CMAKE_SIZEOF_VOID_P,
+# which is only set after the first project() call. Intended for suffixing
+# artefact names (e.g. "String${WYVRN_ARCH_SUFFIX}" → String64 / String32) so
+# x64 and x86 builds can coexist on disk without overwriting each other.
+# Call WYVRN_APPLY_ARCH_SUFFIX(<target>) from macros.cmake for the common
+# per-target shape, or reference the variable directly for other uses.
+set(WYVRN_ARCH_SUFFIX              "{{PROFILE_ARCH_SUFFIX}}")
+
 set(WYVRN_PROFILE_COMPILER         "{{PROFILE_COMPILER}}")
 set(WYVRN_PROFILE_COMPILER_VERSION "{{PROFILE_COMPILER_VERSION}}")
 set(WYVRN_PROFILE_CPPSTD           "{{PROFILE_CPPSTD}}")

package/src/upload-built.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { getProvider }        = require('./providers');
 const { defaultCompatBlock } = require('./compat');
 const { getBuildPaths }      = require('./build/cache');
+const { resolveSourceAuth }  = require('./auth');
 const log                    = require('./logger');
 
 const WYVRNPM_VERSION = require('../package.json').version;
@@ -193,6 +194,7 @@ function resolveUploadDestination(argv, config) {
   let src = argv.uploadSource;
   let awsProfile = argv.awsProfile;
   let token      = argv.token;
+  let sourceEntry = null;
 
   const publishSources = config.publishSources ?? [];
 
@@ -202,17 +204,24 @@ function resolveUploadDestination(argv, config) {
     if (named) {
       src        = named.url;
       awsProfile = awsProfile ?? named.profile;
-      token      = token      ?? named.token;
+      sourceEntry = named;
       log.info(`upload-built: using publish source "${named.name}" from config`);
     }
   } else if (publishSources.length > 0) {
     const first = publishSources[0];
     src        = first.url;
     awsProfile = awsProfile ?? first.profile;
-    token      = token      ?? first.token;
+    sourceEntry = first;
     log.info(`upload-built: using first configured publish source "${first.name}"`);
   }
 
+  // Fall back to the matched source entry's own token / tokenEnv only if
+  // the caller didn't pass one already (argv.token wins). resolveSourceAuth
+  // handles the literal-vs-env-backed precedence per side.
+  if (token === undefined || token === null) {
+    token = resolveSourceAuth({}, sourceEntry).token;
+  }
+
   if (!src) return null;
   return { uploadSource: src, uploadAuth: { awsProfile, token } };
 }

package/src/zip-safe.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/**
+ * Defense-in-depth against Zip Slip (CVE-2018-1002200 family). Both
+ * node-stream-zip and adm-zip claim to handle this upstream, but we
+ * don't want to take the library's word for it on a supply-chain-
+ * critical code path. Pre-scan zip entry names before extraction and
+ * reject anything that could write outside the target directory.
+ *
+ * The ZIP spec uses forward slashes only, but Windows-produced archives
+ * sometimes leak backslashes — normalise both.
+ *
+ * @param {string} entryName   zip-internal path as reported by the zip library
+ * @param {string} [context]   optional archive identifier for the error message
+ * @throws {Error} if the entry name is absolute, contains a path-traversal
+ *                 segment, or starts with a Windows drive-letter prefix.
+ */
+function assertSafeZipEntryName(entryName, context) {
+  const where = context ? ` in ${context}` : '';
+
+  if (/^[A-Za-z]:[\\/]/.test(entryName)) {
+    throw new Error(`unsafe zip entry${where}: drive-letter absolute path ${JSON.stringify(entryName)}`);
+  }
+  if (entryName.startsWith('/') || entryName.startsWith('\\')) {
+    throw new Error(`unsafe zip entry${where}: absolute path ${JSON.stringify(entryName)}`);
+  }
+
+  const segments = entryName.split(/[\\/]+/);
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`unsafe zip entry${where}: path-traversal segment in ${JSON.stringify(entryName)}`);
+    }
+  }
+}
+
+/**
+ * Convenience: validate every name in an iterable. Throws on the first
+ * offender (fail-fast) rather than collecting all violations.
+ *
+ * @param {Iterable<string>} names
+ * @param {string} [context]
+ */
+function assertAllSafeZipEntryNames(names, context) {
+  for (const name of names) {
+    assertSafeZipEntryName(name, context);
+  }
+}
+
+module.exports = {
+  assertSafeZipEntryName,
+  assertAllSafeZipEntryNames,
+};