Skip to content

Commit 583dd8b

Browse files
Ubuntuedvincent
Ubuntu
authored and
edvincent
committed
Generate shrinkwrap file for deterministic dependencies
1 parent 61673b5 commit 583dd8b

File tree

5 files changed

+75
-174
lines changed

5 files changed

+75
-174
lines changed

‎ci/build/build-release.sh

+35-9
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ main() {
1818
VSCODE_SRC_PATH="lib/vscode"
1919
VSCODE_OUT_PATH="$RELEASE_PATH/lib/vscode"
2020

21+
create_shrinkwraps
22+
2123
mkdir -p "$RELEASE_PATH"
2224

2325
bundle_code_server
@@ -55,15 +57,6 @@ bundle_code_server() {
5557
EOF
5658
) > "$RELEASE_PATH/package.json"
5759
rsync yarn.lock "$RELEASE_PATH"
58-
59-
# To ensure deterministic dependency versions (even when code-server is installed with NPM), we seed
60-
# an npm-shrinkwrap file from our yarn lockfile and the current node-modules installed.
61-
synp --source-file yarn.lock
62-
npm shrinkwrap
63-
# HACK@edvincent: The shrinkwrap file will contain the devDependencies, which by default
64-
# are installed if present in a lockfile. To avoid every user having to specify --production
65-
# to skip them, we carefully remove them from the shrinkwrap file.
66-
json -f npm-shrinkwrap.json -I -e "Object.keys(this.dependencies).forEach(dependency => { if (this.dependencies[dependency].dev) { delete this.dependencies[dependency] } } )"
6760
mv npm-shrinkwrap.json "$RELEASE_PATH"
6861

6962
rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh"
@@ -105,11 +98,44 @@ bundle_vscode() {
10598
"$VSCODE_SRC_PATH/package.json" > "$VSCODE_OUT_PATH/package.json"
10699

107100
rsync "$VSCODE_SRC_PATH/remote/yarn.lock" "$VSCODE_OUT_PATH/yarn.lock"
101+
mv "$VSCODE_SRC_PATH/remote/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/npm-shrinkwrap.json"
108102

109103
# Include global extension dependencies as well.
110104
rsync "$VSCODE_SRC_PATH/extensions/package.json" "$VSCODE_OUT_PATH/extensions/package.json"
111105
rsync "$VSCODE_SRC_PATH/extensions/yarn.lock" "$VSCODE_OUT_PATH/extensions/yarn.lock"
106+
mv "$VSCODE_SRC_PATH/extensions/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/extensions/npm-shrinkwrap.json"
112107
rsync "$VSCODE_SRC_PATH/extensions/postinstall.mjs" "$VSCODE_OUT_PATH/extensions/postinstall.mjs"
113108
}
114109

110+
create_shrinkwraps() {
111+
# yarn.lock or package-lock.json files (used to ensure deterministic versions of dependencies) are
112+
# not packaged when publishing to the NPM registry.
113+
# To ensure deterministic dependency versions (even when code-server is installed with NPM), we create
114+
# an npm-shrinkwrap.json file from the currently installed node_modules. This ensures the versions used
115+
# from development (that the yarn.lock guarantees) are also the ones installed by end-users.
116+
# These will include devDependencies, but those will be ignored when installing globally (for code-server), and
117+
# because we use --omit=dev when installing vscode.
118+
119+
# We first generate the shrinkwrap file for code-server itself - which is the current directory
120+
create_shrinkwrap_keeping_yarn_lock
121+
122+
# Then the shrinkwrap files for the bundled VSCode
123+
pushd "$VSCODE_SRC_PATH/remote/"
124+
create_shrinkwrap_keeping_yarn_lock
125+
popd
126+
127+
pushd "$VSCODE_SRC_PATH/extensions/"
128+
create_shrinkwrap_keeping_yarn_lock
129+
popd
130+
}
131+
132+
create_shrinkwrap_keeping_yarn_lock() {
133+
# HACK@edvincent: Generating a shrinkwrap alters the yarn.lock which we don't want (with NPM URLs rather than the Yarn URLs)
134+
# But to generate a valid shrinkwrap, it has to exist... So we copy it to then restore it
135+
cp yarn.lock yarn.lock.temp
136+
npm shrinkwrap
137+
cp yarn.lock.temp yarn.lock
138+
rm yarn.lock.temp
139+
}
140+
115141
main "$@"

‎ci/build/build-standalone-release.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
#!/usr/bin/env bash
2+
#!/usr/bin/env bash
23
set -euo pipefail
34

45
# This is due to an upstream issue with RHEL7/CentOS 7 comptability with node-argon2
@@ -28,7 +29,7 @@ main() {
2829
ln -s "./lib/node" "$RELEASE_PATH/node"
2930

3031
pushd "$RELEASE_PATH"
31-
yarn --production --frozen-lockfile
32+
yarn --frozen-lockfile
3233
popd
3334
}
3435

‎ci/build/npm-postinstall.sh

+35-4
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ main() {
110110
echo "Failed to download cloud agent; --link will not work"
111111
fi
112112

113-
if ! vscode_yarn; then
113+
if ! vscode_install; then
114114
echo "You may not have the required dependencies to build the native modules."
115115
echo "Please see https://github.com/coder/code-server/blob/main/docs/npm.md"
116116
exit 1
@@ -123,17 +123,48 @@ main() {
123123
fi
124124
}
125125

126-
vscode_yarn() {
126+
install_with_yarn_or_npm() {
127+
# NOTE@edvincent: We want to keep using the package manager that the end-user was using to install the package.
128+
# This also ensures that when *we* run `yarn` in the development process, the yarn.lock file is used.
129+
case "${npm_config_user_agent-}" in
130+
yarn*)
131+
if [ -f "yarn.lock" ]; then
132+
if [ -d "extensions" ]; then
133+
yarn --production --frozen-lockfile --no-default-rc
134+
else
135+
yarn --production --frozen-lockfile
136+
fi
137+
else
138+
echo "yarn.lock file not present, not running in development mode. use npm to install code-server!"
139+
exit 1
140+
fi
141+
;;
142+
npm*)
143+
if [ -f "yarn.lock" ]; then
144+
echo "yarn.lock file present, running in development mode. use yarn to install code-server!"
145+
exit 1
146+
else
147+
npm install --omit=dev
148+
fi
149+
;;
150+
*)
151+
echo "Could not determine which package manager is being used to install code-server"
152+
exit 1
153+
;;
154+
esac
155+
}
156+
157+
vscode_install() {
127158
echo 'Installing Code dependencies...'
128159
cd lib/vscode
129-
yarn --production --frozen-lockfile --no-default-rc
160+
install_with_yarn_or_npm
130161

131162
symlink_asar
132163
symlink_bin_script remote-cli code code-server
133164
symlink_bin_script helpers browser browser .sh
134165

135166
cd extensions
136-
yarn --production --frozen-lockfile
167+
install_with_yarn_or_npm
137168
}
138169

139170
main "$@"

‎package.json

+1-4
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,11 @@
5959
"eslint-import-resolver-typescript": "^2.5.0",
6060
"eslint-plugin-import": "^2.18.2",
6161
"eslint-plugin-prettier": "^4.0.0",
62-
"json": "^11.0.0",
6362
"prettier": "^2.2.1",
6463
"prettier-plugin-sh": "^0.12.0",
6564
"shellcheck": "^1.0.0",
6665
"stylelint": "^13.0.0",
6766
"stylelint-config-recommended": "^5.0.0",
68-
"synp": "^1.9.10",
6967
"ts-node": "^10.0.0",
7068
"typescript": "^4.6.2"
7169
},
@@ -108,8 +106,7 @@
108106
"semver": "^7.1.3",
109107
"split2": "^4.0.0",
110108
"ws": "^8.0.0",
111-
"xdg-basedir": "^4.0.0",
112-
"yarn": "^1.22.4"
109+
"xdg-basedir": "^4.0.0"
113110
},
114111
"bin": {
115112
"code-server": "out/node/entry.js"

0 commit comments

Comments
 (0)