|
| 1 | +# Imported from npm `vlt` by `pkgmgr import npm` (node build). |
| 2 | +# |
| 3 | +# vlt is a package manager (vlt.sh), shipped as a single dependency-free npm |
| 4 | +# tarball: `npm ci` installs exactly ONE package, pinned by version + integrity |
| 5 | +# in the committed package-lock.json. No transitive tree, no native addons, no |
| 6 | +# compile step — the whole build is an extract. |
| 7 | +# |
| 8 | +# WHY A REGISTRY ARTIFACT AND NOT A SOURCE BUILD — AGENTS.md requires this be |
| 9 | +# called out explicitly, and the reason is not "nobody tried". Source IS |
| 10 | +# published (codeload .../vltpkg/tar.gz/refs/tags/v1.0.1, 200, 7.4 MB, 48 real |
| 11 | +# TypeScript workspaces). It cannot be built with a toolchain we have: |
| 12 | +# |
| 13 | +# - The only lockfile in the repo is `vlt-lock.json` — vlt's own format. |
| 14 | +# There is no pnpm-lock.yaml and no package-lock.json. |
| 15 | +# - Dependency specs use the `catalog:` protocol with the catalog declared in |
| 16 | +# `vlt.json`. Measured against the extracted tarball: |
| 17 | +# npm → EUNSUPPORTEDPROTOCOL: Unsupported URL Type "catalog:" |
| 18 | +# pnpm → ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (pnpm supports |
| 19 | +# catalogs, but reads pnpm-workspace.yaml, not vlt.json) |
| 20 | +# `package.json` has no `workspaces` key at all, so neither tool can even |
| 21 | +# see the monorepo layout. |
| 22 | +# - Upstream CI agrees: `uses: vltpkg/setup-vlt@v1` then `vlt install`. |
| 23 | +# - The published package (`infra/cli/package.json`) declares `bin: null`, |
| 24 | +# `dependencies: {}`, and one script — `prepack: vlt-build-prepack`. The |
| 25 | +# npm tarball is generated wholesale by their internal bundler. |
| 26 | +# |
| 27 | +# So building vlt from source requires vlt: a genuine bootstrap cycle, which is |
| 28 | +# the "required toolchain genuinely isn't packaged yet" case AGENTS.md carves |
| 29 | +# out. Breaking it would mean a two-stage `vlt-bootstrap` → `vlt` pair in the |
| 30 | +# gawk-bootstrap shape; worth doing if vlt becomes load-bearing, not before. |
| 31 | +# |
| 32 | +# `node-lts`, not `node`, for both build and runtime. Two reasons, and the |
| 33 | +# private `usr/libexec/vlt` prefix below is the third leg of the same argument |
| 34 | +# (gominimal/pkgs#370: a global `usr/lib/node_modules` install collides with |
| 35 | +# whichever node variant the user actually has): |
| 36 | +# - vlt's own CI tests Node 22.x only (`node-version: '^22.22.0'`, `[22.x]`) |
| 37 | +# and `engines` says `>=22.22.0`. Our node-lts is 24.14.1, node is 25.8.2 — |
| 38 | +# neither is 22.x, but LTS is two majors closer to what upstream tests. |
| 39 | +# - pnpm, the closest analogue in this repo (also a package manager, also a |
| 40 | +# node CLI), is on node-lts for exactly this reason — see #97/#98: the node |
| 41 | +# most users and hosting providers run is whatever ships with current LTS. |
| 42 | +# |
| 43 | +# Deliberately NO `source_provenance`. vlt's vuln identity is its npm package |
| 44 | +# name, and minimal-supply-chain routes a node-flavored package with no |
| 45 | +# provenance to `pkg:npm/<name>` (scan.rs `npm_purl_for_node_package`) so the |
| 46 | +# OSV/GHSA npm advisories resolve. Declaring `GithubRepo vltpkg/vltpkg` would |
| 47 | +# take it OFF that arm onto the repo-purl arm, where GHSA's npm advisories — |
| 48 | +# which are keyed by package name, not repo — would no longer match. Absent is |
| 49 | +# correct here, not an oversight. |
| 50 | +let { standaloneTest, Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Test, .. } = import "minimal.ncl" in |
| 51 | +let base = import "../base/build.ncl" in |
| 52 | +let node-lts = import "../node-lts/build.ncl" in |
| 53 | +let coreutils = import "../coreutils/build.ncl" in |
| 54 | +let version = "1.0.1" in |
| 55 | +{ |
| 56 | + name = "vlt", |
| 57 | + build_deps = [ |
| 58 | + { file = "build.sh" } | Local, |
| 59 | + { file = "package.json" } | Local, |
| 60 | + { file = "package-lock.json" } | Local, |
| 61 | + base, |
| 62 | + node-lts, |
| 63 | + ], |
| 64 | + runtime_deps = [coreutils, node-lts], |
| 65 | + needs = |
| 66 | + { |
| 67 | + dns = {}, |
| 68 | + internet = {}, |
| 69 | + } | Needs, |
| 70 | + cmd = "./build.sh", |
| 71 | + build_args = { |
| 72 | + include version, |
| 73 | + }, |
| 74 | + outputs = { |
| 75 | + # Enumerated, not `usr/bin/*`: the checker wants each bin named, and the |
| 76 | + # npm registry metadata already lists them exactly, so there is nothing to |
| 77 | + # infer. `vlt` is the CLI; the others are the documented shorthands |
| 78 | + # (`vlr` = `vlt run`, `vlx` = `vlt exec`, plus their variants). |
| 79 | + vlt = { glob = "usr/bin/vlt" } | OutputBin, |
| 80 | + vlr = { glob = "usr/bin/vlr" } | OutputBin, |
| 81 | + vlrx = { glob = "usr/bin/vlrx" } | OutputBin, |
| 82 | + vlx = { glob = "usr/bin/vlx" } | OutputBin, |
| 83 | + vlxl = { glob = "usr/bin/vlxl" } | OutputBin, |
| 84 | + |
| 85 | + libexec = { glob = "usr/libexec/vlt/**", allow_executable = true } | OutputData, |
| 86 | + }, |
| 87 | + attrs = |
| 88 | + { |
| 89 | + upstream_version = version, |
| 90 | + license_spdx = "BSD-2-Clause-Patent", |
| 91 | + } | Attrs, |
| 92 | + |
| 93 | + tests = { |
| 94 | + smoketest = standaloneTest "/bin/vlt --version", |
| 95 | + |
| 96 | + version_is_exact = |
| 97 | + { |
| 98 | + class = 'Standalone, |
| 99 | + test_deps = [base], |
| 100 | + cmds = [ |
| 101 | + # Exact equality, NOT `--version | grep '%{version}'`: vlt's usage |
| 102 | + # banner also carries the version ("next-gen package management |
| 103 | + # v1.0.1"), so a grep would pass on a build where `--version` itself |
| 104 | + # is broken and only usage prints. This asserts the artifact's own |
| 105 | + # version, independent of the build-time lockfile guard in build.sh. |
| 106 | + ["/bin/bash", "-c", "test \"$(/bin/vlt --version)\" = \"%{version}\""], |
| 107 | + ], |
| 108 | + } |
| 109 | + | Test, |
| 110 | + |
| 111 | + companion_bins_work = |
| 112 | + { |
| 113 | + class = 'Standalone, |
| 114 | + test_deps = [base], |
| 115 | + cmds = [ |
| 116 | + # Five bins are declared as outputs; they are PATH symlinks into the |
| 117 | + # private libexec prefix, so a broken relative link fails here and |
| 118 | + # nowhere else. A test that only exercised `vlt` would ship four |
| 119 | + # dead entries in usr/bin. |
| 120 | + ["/bin/bash", "-c", "for b in vlr vlrx vlx vlxl; do test \"$(/bin/$b --version)\" = \"%{version}\" || { echo \"$b failed\" >&2; exit 1; }; done"], |
| 121 | + ], |
| 122 | + } |
| 123 | + | Test, |
| 124 | + |
| 125 | + reads_a_manifest = |
| 126 | + { |
| 127 | + class = 'Standalone, |
| 128 | + test_deps = [base], |
| 129 | + cmds = [ |
| 130 | + # Real work, offline: `vlt pkg get` parses a package.json and returns |
| 131 | + # a field. This exercises the bundled JS beyond argv handling — a |
| 132 | + # truncated or partially-installed tarball prints `--version` fine |
| 133 | + # and fails here. vlt has NO default registry as of 1.0.1, so any |
| 134 | + # network-touching command is not a candidate for a sandbox test. |
| 135 | + ["/bin/bash", "-c", "d=/tmp/vlt-selftest; mkdir -p \"$d\"; cd \"$d\"; printf '{\"name\":\"vlt-selftest-fixture\",\"version\":\"9.9.9\"}' > package.json; test \"$(/bin/vlt pkg get name)\" = '\"vlt-selftest-fixture\"'"], |
| 136 | + ], |
| 137 | + } |
| 138 | + | Test, |
| 139 | + }, |
| 140 | +} | BuildSpec |
0 commit comments