Skip to content

Commit 324291e

Browse files
RomanNikitenkoRomanNikitenko
committed
code clean up
Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>
1 parent c4a830c commit 324291e

7 files changed

Lines changed: 200 additions & 87 deletions

File tree

‎build/dockerfiles/linux-libc-ubi9.Dockerfile‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -80,12 +80,13 @@ RUN NODE_ARCH=$(echo "console.log(process.arch)" | node) \
8080
&& VSCODE_MANGLE_WORKERS=2 NODE_OPTIONS="--max-old-space-size=8192" ./node_modules/.bin/gulp vscode-reh-web-linux-${NODE_ARCH}-min \
8181
&& cp -r ../vscode-reh-web-linux-${NODE_ARCH} /checode \
8282
# cache shared libs from this image to provide them to a user's container
83-
&& mkdir -p /checode/ld_libs \
84-
&& find /usr/lib64 -name 'libbrotli*' 2>/dev/null | xargs -I {} cp -t /checode/ld_libs {} \
85-
&& find /usr/lib64 -name 'libnode.so*' -exec cp -P -t /checode/ld_libs/ {} + \
86-
&& find /usr/lib64 -name 'libz.so*' -exec cp -P -t /checode/ld_libs/ {} + \
87-
&& find /usr/lib64 -name 'libssl.so*' -exec cp -P -t /checode/ld_libs/ {} + \
88-
&& find /usr/lib64 -name 'libcrypto.so*' -exec cp -P -t /checode/ld_libs/ {} +
83+
&& mkdir -p /checode/ld_libs/core /checode/ld_libs/openssl \
84+
&& find /lib /lib64 /usr/lib64 -name 'ld-linux-*.so*' -exec cp -L -t /checode/ld_libs/core/ {} + \
85+
&& find /usr/lib64 -name 'libbrotli*' -exec cp -P -t /checode/ld_libs/core/ {} + \
86+
&& find /usr/lib64 -name 'libnode.so*' -exec cp -P -t /checode/ld_libs/core/ {} + \
87+
&& find /usr/lib64 -name 'libz.so*' -exec cp -P -t /checode/ld_libs/core/ {} + \
88+
&& find /usr/lib64 -name 'libssl.so*' -exec cp -P -t /checode/ld_libs/openssl/ {} + \
89+
&& find /usr/lib64 -name 'libcrypto.so*' -exec cp -P -t /checode/ld_libs/openssl/ {} +
8990

9091
RUN chmod a+x /checode/out/server-main.js \
9192
&& chgrp -R 0 /checode && chmod -R g+rwX /checode

‎build/scripts/entrypoint-volume.sh‎

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ get_openssl_version() {
5050
openssl_version=$(openssl version -v | cut -d' ' -f2 | cut -d'.' -f1)
5151
elif command -v rpm >/dev/null 2>&1; then
5252
echo "[INFO] rpm command is available"
53-
openssl_version=$(rpm -qa | grep openssl-libs | cut -d'-' -f3 | cut -d'.' -f1)
53+
openssl_version=$(rpm -q --qf '%{VERSION}\n' openssl-libs 2>/dev/null | cut -d'.' -f1)
5454
else
5555
echo "[INFO] openssl and rpm commands are not available, trying to detect OpenSSL version..."
5656
get_libssl_version
@@ -73,47 +73,55 @@ ls -la /checode/
7373
export MACHINE_EXEC_PORT=3333
7474
nohup /checode/bin/machine-exec --url "127.0.0.1:${MACHINE_EXEC_PORT}" &
7575

76-
# Start the checode component based on musl or libc
77-
78-
# detect if we're using alpine/musl
79-
libc=$(ldd /bin/ls | grep 'musl' | head -1 | cut -d ' ' -f1)
80-
if [ -n "$libc" ]; then
81-
echo "[INFO] Using linux-musl assembly..."
82-
export LD_LIBRARY_PATH="/checode/checode-linux-musl/ld_libs:${LD_LIBRARY_PATH:-}"
83-
echo "[INFO] LD_LIBRARY_PATH is: $LD_LIBRARY_PATH"
84-
cd /checode/checode-linux-musl || exit
85-
else
76+
runtime_ld_library_path=""
8677

78+
# detect if we're using alpine/musl (avoid grep dependency for micro images)
79+
ldd_output=$(ldd /bin/ls 2>/dev/null || true)
80+
case "$ldd_output" in
81+
*musl*)
82+
echo "[INFO] Using linux-musl assembly..."
83+
runtime_ld_library_path="/checode/checode-linux-musl/ld_libs"
84+
cd /checode/checode-linux-musl || exit
85+
;;
86+
*)
87+
8788
get_openssl_version
8889
echo "[INFO] OpenSSL major version is: $openssl_version."
8990

9091
case "${openssl_version}" in
9192
*"1"*)
92-
export LD_LIBRARY_PATH="/checode/checode-linux-libc/ubi8/ld_libs:${LD_LIBRARY_PATH:-}"
93-
echo "[INFO] LD_LIBRARY_PATH is: $LD_LIBRARY_PATH"
9493
echo "[INFO] Using linux-libc ubi8-based assembly..."
94+
runtime_ld_library_path="/checode/checode-linux-libc/ubi8/ld_libs"
9595
cd /checode/checode-linux-libc/ubi8 || exit
9696
;;
9797
*"3"*)
98-
export LD_LIBRARY_PATH="/checode/checode-linux-libc/ubi9/ld_libs:${LD_LIBRARY_PATH:-}"
99-
echo "[INFO] LD_LIBRARY_PATH is: $LD_LIBRARY_PATH"
10098
echo "[INFO] Using linux-libc ubi9-based assembly..."
99+
runtime_ld_library_path="/checode/checode-linux-libc/ubi9/ld_libs/core"
100+
if [ -d "/checode/checode-linux-libc/ubi9/ld_libs/openssl" ]; then
101+
runtime_ld_library_path="/checode/checode-linux-libc/ubi9/ld_libs/openssl:${runtime_ld_library_path}"
102+
fi
101103
cd /checode/checode-linux-libc/ubi9 || exit
102104
;;
103105
*)
104106
echo "[WARNING] Unsupported OpenSSL major version, linux-libc ubi9-based assembly will be used by default..."
105-
export LD_LIBRARY_PATH="/checode/checode-linux-libc/ubi9/ld_libs:${LD_LIBRARY_PATH:-}"
106-
echo "[INFO] LD_LIBRARY_PATH is: $LD_LIBRARY_PATH"
107+
runtime_ld_library_path="/checode/checode-linux-libc/ubi9/ld_libs/core"
108+
if [ -d "/checode/checode-linux-libc/ubi9/ld_libs/openssl" ]; then
109+
runtime_ld_library_path="/checode/checode-linux-libc/ubi9/ld_libs/openssl:${runtime_ld_library_path}"
110+
fi
107111
cd /checode/checode-linux-libc/ubi9 || exit
108112
;;
109113
esac
114+
;;
115+
esac
116+
117+
if [ -n "$runtime_ld_library_path" ]; then
118+
export LD_LIBRARY_PATH="${runtime_ld_library_path}${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
119+
echo "[INFO] LD_LIBRARY_PATH is: $LD_LIBRARY_PATH"
110120
fi
111121

112122
# Set the default path to the serverDataFolderName
113123
# into a persistent volume
114124
export VSCODE_AGENT_FOLDER=/checode/remote
115-
# Prevent bundled runtime LD_LIBRARY_PATH from leaking into integrated terminal shell env.
116-
export CHECODE_STRIP_LD_LIBRARY_PATH_FOR_SHELL_ENV=1
117125

118126
if [ -z "$VSCODE_NODEJS_RUNTIME_DIR" ]; then
119127
export VSCODE_NODEJS_RUNTIME_DIR="$(pwd)"

‎build/scripts/helper/check-runtime-libs.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,9 @@ TMP_HAVE="$(mktemp)"
3030
TMP_MISS="$(mktemp)"
3131
trap 'rm -f "$TMP_NEEDS" "$TMP_HAVE" "$TMP_MISS"' EXIT
3232

33-
# Collect what we have in ld_libs (basename only).
34-
find "${LIBS_DIR}" -maxdepth 1 -type f -name '*.so*' -exec basename {} \; | sort -u > "${TMP_HAVE}"
33+
# Collect what we have in ld_libs (basename only), including nested dirs
34+
# like ld_libs/core and ld_libs/openssl.
35+
find "${LIBS_DIR}" -type f -name '*.so*' -exec basename {} \; | sort -u > "${TMP_HAVE}"
3536

3637
scan_needed() {
3738
f="$1"

‎code/src/vs/platform/che/utils.ts‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**********************************************************************
2+
* Copyright (c) 2026 Red Hat, Inc.
3+
*
4+
* This program and the accompanying materials are made
5+
* available under the terms of the Eclipse Public License 2.0
6+
* which is available at https://www.eclipse.org/legal/epl-2.0/
7+
*
8+
* SPDX-License-Identifier: EPL-2.0
9+
***********************************************************************/
10+
/* eslint-disable header/header */
11+
12+
/*
13+
* This file was generated using AI assistance (Cursor AI)
14+
* and reviewed by the maintainers.
15+
*/
16+
17+
export type LdSanitizeMode = 'all' | 'openssl' | 'none';
18+
19+
const allLdLibPrefixes = new Set<string>([
20+
'/checode/checode-linux-musl/ld_libs',
21+
'/checode/checode-linux-libc/ubi8/ld_libs',
22+
'/checode/checode-linux-libc/ubi9/ld_libs/core',
23+
'/checode/checode-linux-libc/ubi9/ld_libs/openssl'
24+
]);
25+
26+
const openSSLOnlyPrefixes = new Set<string>([
27+
'/checode/checode-linux-libc/ubi9/ld_libs/openssl'
28+
]);
29+
30+
export function getLdSanitizeMode(): LdSanitizeMode {
31+
const mode = process.env['LD_SANITIZE_MODE'];
32+
if (mode === 'all' || mode === 'openssl' || mode === 'none') {
33+
return mode;
34+
}
35+
return 'all';
36+
}
37+
38+
export function shouldStripLdLibraryPath(): boolean {
39+
return getLdSanitizeMode() !== 'none';
40+
}
41+
42+
export function stripLdLibraryPath(value: string | undefined, mode = getLdSanitizeMode()): string | undefined {
43+
if (!value) {
44+
return undefined;
45+
}
46+
47+
const blockedPrefixes = mode === 'openssl' ? openSSLOnlyPrefixes : allLdLibPrefixes;
48+
const filtered = value
49+
.split(':')
50+
.map(entry => entry.trim())
51+
.filter(entry => entry.length > 0 && !blockedPrefixes.has(entry));
52+
53+
return filtered.length > 0 ? filtered.join(':') : undefined;
54+
}
55+
56+
export function sanitizeLdLibraryPathInEnvironment(environment: NodeJS.ProcessEnv, mode = getLdSanitizeMode()): void {
57+
const sanitizedLdLibraryPath = stripLdLibraryPath(environment['LD_LIBRARY_PATH'], mode);
58+
if (sanitizedLdLibraryPath) {
59+
environment['LD_LIBRARY_PATH'] = sanitizedLdLibraryPath;
60+
} else {
61+
delete environment['LD_LIBRARY_PATH'];
62+
}
63+
}

‎code/src/vs/platform/shell/node/shellEnv.ts‎

Lines changed: 3 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -18,26 +18,9 @@ import { ILogService } from '../../log/common/log.js';
1818
import { Promises } from '../../../base/common/async.js';
1919
import { IConfigurationService } from '../../configuration/common/configuration.js';
2020
import { clamp } from '../../../base/common/numbers.js';
21+
import { sanitizeLdLibraryPathInEnvironment, shouldStripLdLibraryPath } from '../../che/utils.js';
2122

2223
let unixShellEnvPromise: Promise<typeof process.env> | undefined = undefined;
23-
const cheCodeLdLibPrefixes = new Set<string>([
24-
'/checode/checode-linux-libc/ubi8/ld_libs',
25-
'/checode/checode-linux-libc/ubi9/ld_libs',
26-
'/checode/checode-linux-musl/ld_libs'
27-
]);
28-
29-
function stripCheCodeLdLibraryPath(value: string | undefined): string | undefined {
30-
if (!value) {
31-
return undefined;
32-
}
33-
34-
const filtered = value
35-
.split(':')
36-
.map(entry => entry.trim())
37-
.filter(entry => entry.length > 0 && !cheCodeLdLibPrefixes.has(entry));
38-
39-
return filtered.length > 0 ? filtered.join(':') : undefined;
40-
}
4124

4225
/**
4326
* Resolves the shell environment by spawning a shell. This call will cache
@@ -123,7 +106,6 @@ async function doResolveUnixShellEnv(logService: ILogService, token: Cancellatio
123106

124107
const noAttach = process.env['ELECTRON_NO_ATTACH_CONSOLE'];
125108
logService.trace('getUnixShellEnvironment#noAttach', noAttach);
126-
const stripLdLibraryPath = process.env['CHECODE_STRIP_LD_LIBRARY_PATH_FOR_SHELL_ENV'] === '1';
127109

128110
const mark = generateUuid().replace(/-/g, '').substr(0, 12);
129111
const regex = new RegExp(mark + '({.*})' + mark);
@@ -226,18 +208,9 @@ async function doResolveUnixShellEnv(logService: ILogService, token: Cancellatio
226208
}
227209

228210
delete env['VSCODE_RESOLVING_ENVIRONMENT'];
229-
logService.info('++++++ getUnixShellEnvironment', env['LD_LIBRARY_PATH'], 'stripEnabled=', stripLdLibraryPath);
230-
if (stripLdLibraryPath) {
231-
const sanitizedLdLibraryPath = stripCheCodeLdLibraryPath(env['LD_LIBRARY_PATH']);
232-
if (sanitizedLdLibraryPath) {
233-
env['LD_LIBRARY_PATH'] = sanitizedLdLibraryPath;
234-
logService.info('++++++ SANITIZE');
235-
} else {
236-
logService.info('++++++ DELETE');
237-
delete env['LD_LIBRARY_PATH'];
238-
}
211+
if (shouldStripLdLibraryPath()) {
212+
sanitizeLdLibraryPathInEnvironment(env);
239213
}
240-
logService.info('++++++ AFTER', env['LD_LIBRARY_PATH']);
241214

242215
// https://github.com/microsoft/vscode/issues/22593#issuecomment-336050758
243216
delete env['XDG_RUNTIME_DIR'];

‎code/src/vs/server/node/che/utils.ts‎

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**********************************************************************
2-
* Copyright (c) 2024 Red Hat, Inc.
2+
* Copyright (c) 2024-2026 Red Hat, Inc.
33
*
44
* This program and the accompanying materials are made
55
* available under the terms of the Eclipse Public License 2.0
@@ -9,6 +9,7 @@
99
***********************************************************************/
1010
/* eslint-disable header/header */
1111

12+
import { IProcessEnvironment } from '../../../base/common/platform.js';
1213
import { delimiter } from '../../../base/common/path.js';
1314

1415
/**
@@ -36,3 +37,53 @@ export function getResolvedPathEnvVar(currentPath: string, processEnvPath?: stri
3637
}
3738
return currentPath;
3839
}
40+
41+
/*
42+
* The following logic was generated using AI assistance (Cursor AI)
43+
* and reviewed by the maintainers.
44+
*/
45+
46+
export type LdSanitizeMode = 'all' | 'openssl' | 'none';
47+
48+
const allLdLibPrefixes = new Set<string>([
49+
'/checode/checode-linux-musl/ld_libs',
50+
'/checode/checode-linux-libc/ubi8/ld_libs',
51+
'/checode/checode-linux-libc/ubi9/ld_libs/core',
52+
'/checode/checode-linux-libc/ubi9/ld_libs/openssl'
53+
]);
54+
55+
const openSSLOnlyPrefixes = new Set<string>([
56+
'/checode/checode-linux-libc/ubi9/ld_libs/openssl'
57+
]);
58+
59+
export function getLdSanitizeMode(): LdSanitizeMode {
60+
const mode = process.env['LD_SANITIZE_MODE'];
61+
if (mode === 'all' || mode === 'openssl' || mode === 'none') {
62+
return mode;
63+
}
64+
return 'all';
65+
}
66+
67+
export function shouldStripLdLibraryPath(): boolean {
68+
return getLdSanitizeMode() !== 'none';
69+
}
70+
71+
export function stripLdLibraryPath(environment: IProcessEnvironment, mode = getLdSanitizeMode()): void {
72+
const current = environment['LD_LIBRARY_PATH'];
73+
if (!current) {
74+
return;
75+
}
76+
77+
const blockedPrefixes = mode === 'openssl' ? openSSLOnlyPrefixes : allLdLibPrefixes;
78+
const filtered = current
79+
.split(':')
80+
.map(entry => entry.trim())
81+
.filter(entry => !!entry && !blockedPrefixes.has(entry))
82+
.join(':');
83+
84+
if (filtered) {
85+
environment['LD_LIBRARY_PATH'] = filtered;
86+
} else {
87+
delete environment['LD_LIBRARY_PATH'];
88+
}
89+
}

0 commit comments

Comments
 (0)