Ship binary tarball without source payload
ober
9fe7bdecda5775293979d49e2bec51a01881c1db
--- a/.build.yml +++ b/.build.yml @@ -120,6 +120,10 @@ tasks: # that points the loader at the bundled lib/ (Qt backend + Rust crypto). tar tzf "$tb" | grep -E 'bin/jerboa-browser\.bin$' \ || { echo "native binary missing from tarball"; exit 1; } + if tar tzf "$tb" | grep -E '(^|/)(scheme|support|vendor)/|/(build-binary\.ss|Makefile|\.jerbuild)$|\.(ss|sls)$'; then + echo "source files should not be bundled in the native binary tarball" + exit 1 + fi echo "--- native binary ---" tar xzf "$tb" -O jerboa-browser-0.0.1-linux-x86_64/bin/jerboa-browser.bin \ > /tmp/jb && file /tmp/jb --- a/packaging/README.md +++ b/packaging/README.md @@ -100,16 +100,18 @@ BUNDLE_QT=1 packaging/linux/build-tarball.sh make static-qt # Docker build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz ``` -The tarball bundles the backend `libjerboa_browser.so`, the browser-owned FUSE -vault helper `libjerboa_fuse_mount.so`, the direct-USB YubiKey backend -`libyubikey_native.so`, the Jerboa `scheme/` sources, `vendor/jerboa-fuse/`, -`vendor/jerboa-yubikey/`, the support scripts, and `build-binary.ss` + -`Makefile`. -When the Jerboa toolchain (Chez + Jerboa stdlib) is present on the build host it -also compiles and bundles the self-contained native `bin/jerboa-browser` — a +The tarball always bundles the backend `libjerboa_browser.so`, the +browser-owned FUSE vault helper `libjerboa_fuse_mount.so`, and the direct-USB +YubiKey backend `libyubikey_native.so`. +When the Jerboa toolchain (Chez + Jerboa stdlib) is present on the build host, +it also compiles and bundles the self-contained native `bin/jerboa-browser` — a Jerboa program with the Chez kernel, boot image, and the `(browser)` library all -embedded (built by `make binary`/`jerbuild`, **not** a C/C++ launcher); -otherwise unpack and run `make binary` to produce it. +embedded (built by `make binary`/`jerbuild`, **not** a C/C++ launcher). In that +case, Scheme and vendored source files are not included in the tarball. +If the native binary cannot be built, the tarball falls back to a source package +with `scheme/`, `vendor/jerboa-fuse/`, `vendor/jerboa-yubikey/`, the support +scripts, and `build-binary.ss` + `Makefile`; unpack it and run `make binary` to +produce the executable. With `BUNDLE_QT=1`, the package also stages Qt libraries, platform plugins, `QtWebEngineProcess`, WebEngine `.pak` resources, ICU data, locales, and the --- a/packaging/linux/build-tarball.sh +++ b/packaging/linux/build-tarball.sh @@ -119,6 +119,23 @@ Translations=translations EOF } +stage_source_fallback() { + echo "==> staging source fallback" + ( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' \ + --exclude='scheme/browser/build-vault-secret.ss' -cf - scheme ) | \ + ( cd "$STAGE" && tar -xf - ) + ( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' -cf - vendor/jerboa-fuse ) | \ + ( cd "$STAGE" && tar -xf - ) + ( cd "$REPO" && tar --exclude='.git' --exclude='target' --exclude='*/target' \ + --exclude='*.so' --exclude='*.dylib' --exclude='*.a' --exclude='*.wpo' \ + -cf - vendor/jerboa-yubikey ) | \ + ( cd "$STAGE" && tar -xf - ) + cp -f "$REPO/build-binary.ss" "$REPO/Makefile" "$REPO/.jerbuild" "$STAGE/" + mkdir -p "$STAGE/support" + cp -f "$REPO/support/ensure-vendor.sh" \ + "$REPO/support/README.md" "$STAGE/support/" +} + bundle_qt_runtime() { [ "$HAVE_BIN" = 1 ] || { echo "BUNDLE_QT=1 requires a native bin/jerboa-browser in the package" >&2 @@ -254,26 +271,14 @@ YUBIKEY_NATIVE="$REPO/lib/libyubikey_native.so" echo "==> staging tarball tree at $STAGE" rm -rf "$STAGE" -mkdir -p "$STAGE/lib" "$STAGE/bin" "$STAGE/scheme" "$STAGE/support" +mkdir -p "$STAGE/lib" "$STAGE/bin" cp -f "$LIB" "$STAGE/lib/" cp -f "$FUSE_SHIM" "$STAGE/lib/" cp -f "$YUBIKEY_NATIVE" "$STAGE/lib/" -( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' \ - --exclude='scheme/browser/build-vault-secret.ss' -cf - scheme ) | \ - ( cd "$STAGE" && tar -xf - ) -( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' -cf - vendor/jerboa-fuse ) | \ - ( cd "$STAGE" && tar -xf - ) -( cd "$REPO" && tar --exclude='.git' --exclude='target' --exclude='*/target' \ - --exclude='*.so' --exclude='*.dylib' --exclude='*.a' --exclude='*.wpo' \ - -cf - vendor/jerboa-yubikey ) | \ - ( cd "$STAGE" && tar -xf - ) -cp -f "$REPO/build-binary.ss" "$REPO/Makefile" "$REPO/.jerbuild" "$STAGE/" -cp -f "$REPO/support/ensure-vendor.sh" \ - "$REPO/support/README.md" "$STAGE/support/" # The native binary embeds Chez + the (browser) library; build it when the # Jerboa toolchain is present (e.g. a developer host). CI images without Chez -# skip this — the tarball still carries the sources + build-binary.ss. +# fall back to a source package that can run `make binary` after unpacking. HAVE_BIN=0 HAVE_NATIVE=0 if [ -x "$SCHEME" ]; then @@ -330,7 +335,11 @@ WRAP fi else echo "==> Chez/Jerboa not found at $SCHEME — skipping the native binary" - echo " (unpack, then run 'make binary' with the Jerboa toolchain installed)" + echo " (staging sources; unpack, then run 'make binary' with the Jerboa toolchain installed)" +fi + +if [ "$HAVE_BIN" != 1 ]; then + stage_source_fallback fi if [ "$BUNDLE_QT" = 1 ]; then @@ -368,6 +377,15 @@ native_layout_line="" if [ "$HAVE_NATIVE" = 1 ]; then native_layout_line=" lib/libjerboa_native.so Rust crypto for the secure store" fi +source_layout_text="" +if [ "$HAVE_BIN" != 1 ]; then + source_layout_text="$(printf '%s\n' \ + " scheme/ the (browser) Jerboa module + entry points" \ + " support/ vendor bootstrap helpers" \ + " vendor/jerboa-fuse/ encrypted FUSE vault modules" \ + " vendor/jerboa-yubikey/ YubiKey Scheme + native backend source" \ + " build-binary.ss, Makefile build the native binary: \`make binary\`")" +fi cat > "$STAGE/README.txt" <<EOF Jerboa Browser $VERSION (linux-$ARCH) @@ -404,11 +422,7 @@ $native_layout_line lib/libjerboa_fuse_mount.so browser-owned encrypted vault helper lib/libyubikey_native.so direct USB YubiKey backend $bundle_layout_text - scheme/ the (browser) Jerboa module + entry points - support/ vendor bootstrap helpers - vendor/jerboa-fuse/ encrypted FUSE vault modules - vendor/jerboa-yubikey/ YubiKey Scheme + native backend source - build-binary.ss, Makefile build the native binary: \`make binary\` +$source_layout_text $bin_state_line The native jerboa-browser binary embeds Chez Scheme, the boot image, and the