fix: installer and launcher hardening across platforms#63
Merged
Conversation
- install: move openscience.exe on Windows (the archive entry has the .exe suffix, so the mv could never succeed), add curl --fail plus an explicit empty-download check, guard the version fetch so an unreachable GitHub prints a real error instead of dying silently, and only append to GITHUB_PATH when it is actually set - build: stamp libc on the linux platform packages so npm stops installing all four x64 variants on every linux host - bin wrapper: rank platform-package variants (right libc, exact name first) instead of trusting filesystem enumeration order - launcher: resolve openscience.cmd via the npm prefix on Windows and run it through a shell, skip the bash-installer fallback there, and only treat an atlas binary as ours when @synsci/atlas owns it
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #44. Fixes #45. Fixes #47. Fixes #48. Fixes #49.
One PR for the five installer/launcher defects from the install-flow audit:
install script (both copies kept in sync, verified with diff):
openscience.exe(Bun--compileappends the suffix), but the script moved the extension-less name, so a Git Bash install downloaded ~86 MB and then failed onmv. It now moves the right name per OS (Windows install via the shell script can never succeed: archive contains openscience.exe, script moves openscience #44).--fail, and an explicit empty-download check prints the failing URL instead of a crypticunzip/tarerror (install script error handling: missing curl --fail, silent death when GitHub is unreachable, unbound GITHUB_PATH #45).set -euo pipefail(install script error handling: missing curl --fail, silent death when GitHub is unreachable, unbound GITHUB_PATH #45).GITHUB_PATHappend only runs when the variable is set, soGITHUB_ACTIONS=trueoutside a real runner no longer crashes the script after a successful install (install script error handling: missing curl --fail, silent death when GitHub is unreachable, unbound GITHUB_PATH #45).build script: linux platform packages now declare
libc(glibc/musl), so npm stops installing all four x64 variants (~750 MB) on every linux host (#47).bin wrapper: platform-package selection now ranks candidates (matching libc first, exact name before
-baseline/-muslsuffixes) instead of trustingreaddirSyncenumeration order, which is filesystem-dependent (#47).launcher (
npx synsci):resolveCli()now probes<npm prefix>/openscience.cmdand runs the shim through a shell, so the wizard stops claiming the CLI is missing right after successfully installing it, and the bash-installer fallback (which can't run without bash) is skipped there (npx synsci can't resolve the CLI on native Windows even after installing it #48).atlason PATH is only trusted when the global@synsci/atlaspackage owns it, so Ariga Atlas or the MongoDB Atlas CLI no longer masquerade as an up-to-date install (Launcher treats any atlas binary on PATH as the Atlas CLI #49).Verified:
bash -non both script copies,node --checkon the wrapper and launcher, backend typecheck, and a sandboxed installer run (fake HOME,GITHUB_ACTIONS=truewith noGITHUB_PATH) that previously crashed and now completes.