mirror of
https://github.com/colbymchenry/codegraph.git
synced 2026-10-25 03:49:59 +08:00
Colby MchenryandClaude Opus 5.5
b8c3c032be
Release bundles were set to ship Node 24.21.0. The release workflow runs build-bundle.sh with no version, so the script's default decides the Node every bundle carries, and that default predates Node's October 2026 security release. v24.22.1 (2026-10-20) fixes 8 CVEs, 4 rated High (TLS, DNS, Brotli), and ships OpenSSL 3.5.9. It keeps V8 13.6.233.17, libuv 1.52.1 and module ABI 137, and it carries 24.20.0's fix for the Windows abort at exit (issue #2617). The script also never checked the Node download against the SHA-256 sums nodejs.org publishes. Fix: - The default and the usage example move to v24.22.1. The comment and a new test hold the default at 24.22.1 or later, on 24.x. - Step 1 downloads the release's SHASUMS256.txt and refuses the archive, before unpacking anything, unless its SHA-256 matches the listed one. The zip and tar.gz downloads now share that one code path (sha256sum, or shasum on macOS). - The unreleased CHANGELOG bullet for issue #2617 now names 24.22.1 and the check. BUNDLING.md describes the check. Validation (Windows 11 x64): - bundle-launcher.test.ts: 4 new tests (the version floor; a matching download is unpacked; a mismatched or unlisted one is refused before unpacking). With main's build-bundle.sh all 4 fail; with the fix the file has 7 passed and 3 POSIX-only skipped. - build-bundle.sh win32-x64 with the new default: the check passed (sha256 d2046d28...8b95fa5, as listed). The bundled node.exe is byte-identical to the official v24.22.1 one and prints v24.22.1 (OpenSSL 3.5.9). Its launchers from Git Bash, cmd and PowerShell, with no system Node on PATH, ran --version, init, status, query, callers and sync on a small TypeScript + Python fixture: all exit 0. - Node's own reproducer for the exit abort, 300 runs per mode, 4 at a time: the bundled v24.22.1 exited cleanly 300/300 in all three modes. The official v24.16.0 control aborted 299/300 with 0xC0000409 when the child ran directly. - 13 runtime-facing test files (sqlite, wasm flags, worker and stdin teardown, watcher, launcher, shim) run on the bundled node.exe: 136 passed, 22 skipped, 0 failed. Fixes #2780 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
3.9 KiB
Markdown
79 lines
3.9 KiB
Markdown
# Distribution: self-contained bundles
|
|
|
|
CodeGraph ships a **vendored Node runtime** alongside the app. Because Node 22.5+
|
|
has a built-in real SQLite (`node:sqlite`, with WAL + FTS5), bundling Node means:
|
|
|
|
- **No native build** — `better-sqlite3` is gone, so there are zero native addons
|
|
to compile or rebuild.
|
|
- **No wasm fallback** — and therefore no more `database is locked` (issue #238).
|
|
- **No Node-version dependence** — the app always runs on the bundled Node,
|
|
whatever the user has (or doesn't have) installed.
|
|
|
|
## What's in a bundle
|
|
|
|
Built by [`scripts/build-bundle.sh`](scripts/build-bundle.sh) — one archive per
|
|
platform, identical recipe (only the Node download differs):
|
|
|
|
```
|
|
codegraph-<target>/
|
|
node | node.exe # official Node runtime for <target>
|
|
lib/
|
|
dist/ # compiled app (+ tree-sitter .wasm grammars, schema.sql)
|
|
node_modules/ # production deps only (pure JS / wasm — portable)
|
|
bin/
|
|
codegraph | codegraph.cmd # launcher → runs the bundled Node with the app
|
|
```
|
|
|
|
Targets: `darwin-arm64`, `darwin-x64`, `linux-x64`, `linux-arm64`, `win32-x64`,
|
|
`win32-arm64`. Unix targets produce `.tar.gz` (shell launcher); Windows produces
|
|
`.zip` (`node.exe` + a `.cmd` launcher).
|
|
|
|
```bash
|
|
scripts/build-bundle.sh linux-x64 # -> release/codegraph-linux-x64.tar.gz
|
|
scripts/build-bundle.sh win32-x64 # -> release/codegraph-win32-x64.zip
|
|
```
|
|
|
|
The Node runtime is the official nodejs.org release named by the script's
|
|
default `NODE_VERSION` (or its second argument). The download is refused
|
|
unless it matches the SHA-256 listed in that release's `SHASUMS256.txt`.
|
|
|
|
Because dropping better-sqlite3 left **zero native addons**, building a bundle is
|
|
pure file-packaging — **any** target builds on **any** OS (the whole matrix builds
|
|
on one Linux runner). Cross-compilation isn't a concern; only *run-testing* a
|
|
bundle needs the target platform (or emulation, e.g. `docker run --platform
|
|
linux/amd64`).
|
|
|
|
## Install channels (all deliver the same bundle)
|
|
|
|
1. **`curl | sh`** ([`install.sh`](install.sh)) — no Node required; ideal for a
|
|
fresh Linux VPS over SSH. Detects os/arch, pulls the archive from GitHub
|
|
Releases, symlinks `codegraph` onto PATH. Re-run to upgrade; `--uninstall` to
|
|
remove.
|
|
2. **npm** ([`scripts/npm-shim.js`](scripts/npm-shim.js)) — preserves
|
|
`npm i -g @colbymchenry/codegraph`. The main package is a tiny shim; the
|
|
bundles ship as per-platform `optionalDependencies`
|
|
(`@colbymchenry/codegraph-<target>` with `os`/`cpu`), so npm installs only the
|
|
matching one. The shim — run by the user's Node — execs the bundle, so the
|
|
real work runs on the bundled Node 24. Works even on old Node. On Windows it
|
|
invokes the bundled `node.exe` against the app entry directly (not the `.cmd`
|
|
launcher) — modern Node throws `EINVAL` when asked to spawn a `.cmd`/`.bat`.
|
|
3. **Windows** ([`install.ps1`](install.ps1)) — `irm … | iex`; same flow as
|
|
install.sh (detect arch, pull the `.zip` from Releases, add to PATH).
|
|
4. **Homebrew / Scoop** — TODO (tap + cask pointing at the Release archives).
|
|
|
|
## Release pipeline
|
|
|
|
[`.github/workflows/release.yml`](.github/workflows/release.yml) — manually
|
|
triggered. Reads the version from `package.json`, builds every platform bundle on
|
|
one runner, creates the GitHub Release (notes from `CHANGELOG.md`), and publishes
|
|
the npm shim + per-platform packages. Requires the `NPM_TOKEN` repo secret.
|
|
|
|
Still TODO:
|
|
- **Code signing** — the main gap for "download & run": macOS Gatekeeper needs a
|
|
Developer ID + notarization; Windows needs Authenticode. Homebrew softens the
|
|
macOS case (handles quarantine).
|
|
- Retire the now-vestigial Node-version gate in `src/bin/codegraph.ts` — the
|
|
bundle always runs Node 24, and the npm shim does no tree-sitter work.
|
|
- Re-wire `npm uninstall` cleanup (the agent-config `preuninstall`) through the
|
|
shim — the generated main package doesn't carry it.
|