191 lines
9.4 KiB
JavaScript
191 lines
9.4 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
import { chmod, cp, mkdir, readFile, readdir, rm, symlink, writeFile } from 'node:fs/promises'
|
|
import { join, resolve } from 'node:path'
|
|
import { spawnSync } from 'node:child_process'
|
|
import { buildRuntime } from '../../control-plane/modules/patch-manager/index.mjs'
|
|
import { reconcileSystemPlugins } from '../../control-plane/modules/plugin-manager/system.mjs'
|
|
import { artifactForReference, parseEnvironmentManifest } from '../lib/contracts.mjs'
|
|
import { canonicalJson } from '../lib/canonical-json.mjs'
|
|
import { deriveImageBuildId, deriveRecordId, parseImageInventory } from '../lib/deployment-contracts.mjs'
|
|
import { parseBootstrapVersion } from '../lib/bootstrap-version.mjs'
|
|
import { hashTree } from '../lib/tree-hash.mjs'
|
|
import { verifyImageRelease } from './verify-image-release.mjs'
|
|
import { verifyManagementDependencies } from './verify-management-dependencies.mjs'
|
|
|
|
const [installedArg, outputArg, imageInputArg = '-', platformRevisionArg = 'development'] = process.argv.slice(2)
|
|
if (installedArg === undefined || outputArg === undefined) {
|
|
console.error('usage: build-seed.mjs <installed-dsh-root> <output> [verified-image-input-dir|-] [platform-revision]')
|
|
process.exit(64)
|
|
}
|
|
const installed = resolve(installedArg)
|
|
const output = resolve(outputArg)
|
|
const packageMetadata = JSON.parse(await readFile(join(installed, 'package.json'), 'utf8'))
|
|
if (
|
|
packageMetadata.name !== '@deepseek-ai/dsh'
|
|
|| typeof packageMetadata.version !== 'string'
|
|
|| !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(packageMetadata.version)
|
|
) {
|
|
throw new Error('installed DSH package metadata is invalid')
|
|
}
|
|
const version = packageMetadata.version
|
|
const platformRoot = resolve(new URL('..', import.meta.url).pathname)
|
|
const containerRoot = resolve(platformRoot, '..')
|
|
const imageInput = imageInputArg === '-' ? undefined : resolve(imageInputArg)
|
|
|
|
async function makeFilesReadOnly(root) {
|
|
for (const entry of await readdir(root, { withFileTypes: true })) {
|
|
const path = join(root, entry.name)
|
|
if (entry.isDirectory()) await makeFilesReadOnly(path)
|
|
else if (entry.isFile()) await chmod(path, 0o444)
|
|
}
|
|
}
|
|
|
|
await rm(output, { recursive: true, force: true })
|
|
await mkdir(output, { recursive: true })
|
|
|
|
const bootstrapVersion = parseBootstrapVersion(await readFile(join(platformRoot, 'bootstrap', 'VERSION'), 'utf8'))
|
|
const bootstrapRoot = join(output, 'bootstrap', bootstrapVersion)
|
|
const environmentDefinition = join(containerRoot, 'environment', 'definition.json')
|
|
const environmentVersion = JSON.parse(await readFile(environmentDefinition, 'utf8')).version
|
|
const environmentOutput = join(output, 'environments', environmentVersion)
|
|
let environment
|
|
let authority = 'development'
|
|
let targetSequence = 0
|
|
|
|
if (imageInput !== undefined) {
|
|
const verified = await verifyImageRelease({
|
|
releaseRoot: join(imageInput, 'release'),
|
|
recoveryPublicKeyPath: join(imageInput, 'recovery-root.spki.base64'),
|
|
dshTarballPath: join(imageInput, 'dsh.tgz'),
|
|
supportedTargetPath: join(imageInput, 'supported-target.json'),
|
|
environmentDefinitionPath: join(imageInput, 'environment-definition.json'),
|
|
})
|
|
if (verified.stable.desired.dsh.version !== version) throw new Error('installed DSH differs from signed Stable metadata')
|
|
if (verified.bootstrap.manifest.version !== bootstrapVersion) throw new Error('signed Bootstrap version is unsupported')
|
|
if (verified.environment.manifest.version !== environmentVersion) throw new Error('signed Environment differs from the image definition')
|
|
const archive = verified.bootstrap.paths.get(verified.bootstrap.manifest.artifacts[0]?.id)
|
|
if (verified.bootstrap.manifest.artifacts.length !== 1 || archive === undefined) {
|
|
throw new Error('signed Bootstrap must contain exactly one package')
|
|
}
|
|
const listing = spawnSync('tar', ['-tzf', archive], { encoding: 'utf8' })
|
|
if (listing.status !== 0) throw new Error(listing.stderr || 'Bootstrap archive listing failed')
|
|
const entries = listing.stdout.split('\n').filter(Boolean)
|
|
if (entries.length === 0 || entries.some(name => (
|
|
name.startsWith('/') || name.split('/').includes('..') || !['platform', 'control-plane'].includes(name.split('/')[0])
|
|
))) throw new Error('signed Bootstrap archive contains an unsafe path')
|
|
await mkdir(bootstrapRoot, { recursive: true })
|
|
const extracted = spawnSync('tar', ['-xzf', archive, '--no-same-owner', '--no-same-permissions', '-C', bootstrapRoot], { encoding: 'utf8' })
|
|
if (extracted.status !== 0) throw new Error(extracted.stderr || 'Bootstrap extraction failed')
|
|
await mkdir(join(environmentOutput, 'artifacts'), { recursive: true })
|
|
await writeFile(join(environmentOutput, 'environment.manifest.json'), verified.environment.manifestBytes)
|
|
for (const descriptor of verified.environment.manifest.artifacts) {
|
|
await cp(verified.environment.paths.get(descriptor.id), join(environmentOutput, 'artifacts', descriptor.id))
|
|
}
|
|
environment = verified.environment.manifest
|
|
authority = 'stable'
|
|
targetSequence = verified.stable.targetSequence
|
|
} else {
|
|
for (const directory of ['bootstrap', 'lib']) {
|
|
await cp(join(platformRoot, directory), join(bootstrapRoot, 'platform', directory), { recursive: true })
|
|
}
|
|
for (const directory of ['file-manager', 'log-manager', 'patch-manager', 'plugin-manager', 'skill-manager', 'updater']) {
|
|
await cp(
|
|
join(containerRoot, 'control-plane', 'modules', directory),
|
|
join(bootstrapRoot, 'control-plane', 'modules', directory),
|
|
{ recursive: true },
|
|
)
|
|
}
|
|
for (const directory of ['management', 'gateway', 'access-manager', 'outbound-proxy']) {
|
|
await cp(
|
|
join(containerRoot, 'control-plane', 'services', directory),
|
|
join(bootstrapRoot, 'control-plane', 'services', directory),
|
|
{ recursive: true },
|
|
)
|
|
}
|
|
await cp(join(containerRoot, 'control-plane', 'hooks'), join(bootstrapRoot, 'control-plane', 'hooks'), { recursive: true })
|
|
await cp(join(containerRoot, 'control-plane', 'definition.json'), join(bootstrapRoot, 'control-plane', 'definition.json'))
|
|
const packaged = spawnSync(process.execPath, [
|
|
join(platformRoot, 'tools', 'package-environment.mjs'),
|
|
environmentDefinition,
|
|
environmentOutput,
|
|
], { encoding: 'utf8' })
|
|
if (packaged.status !== 0) throw new Error(packaged.stderr || 'Environment packaging failed')
|
|
environment = parseEnvironmentManifest(await readFile(join(environmentOutput, 'environment.manifest.json')))
|
|
}
|
|
await verifyManagementDependencies(join(bootstrapRoot, 'control-plane', 'services', 'management'))
|
|
await writeFile(join(output, 'bootstrap', 'VERSION'), `${bootstrapVersion}\n`)
|
|
await writeFile(join(output, 'environments', 'VERSION'), `${environmentVersion}\n`)
|
|
await symlink('environments', join(output, 'environment'), 'dir')
|
|
|
|
await cp(installed, join(output, 'pristine', version), { recursive: true, verbatimSymlinks: true })
|
|
await buildRuntime({
|
|
pristineRoot: installed,
|
|
versionsRoot: join(output, 'runtimes'),
|
|
runtimeId: version,
|
|
patchPaths: environment.patches.map(reference => (
|
|
join(environmentOutput, 'artifacts', artifactForReference(environment, reference).id)
|
|
)),
|
|
})
|
|
await writeFile(join(output, 'runtimes', 'VERSION'), `${version}\n`)
|
|
await symlink('runtimes', join(output, 'runtime'), 'dir')
|
|
|
|
const pluginRoot = join(output, 'system-plugins', environmentVersion)
|
|
const pluginBuildRoot = join(output, '.system-plugin-build')
|
|
await reconcileSystemPlugins({
|
|
root: pluginBuildRoot,
|
|
environmentVersion,
|
|
plugins: environment.systemPlugins,
|
|
artifactPath: reference => join(environmentOutput, 'artifacts', artifactForReference(environment, reference).id),
|
|
})
|
|
await cp(join(pluginBuildRoot, 'versions', environmentVersion), pluginRoot, { recursive: true })
|
|
await rm(pluginBuildRoot, { recursive: true, force: true })
|
|
await makeFilesReadOnly(environmentOutput)
|
|
|
|
if (imageInput === undefined) {
|
|
await cp(join(platformRoot, 'seed', 'trust'), join(output, 'trust'), { recursive: true })
|
|
} else {
|
|
const trustOutput = join(output, 'trust')
|
|
await mkdir(trustOutput, { recursive: true })
|
|
await cp(join(imageInput, 'recovery-root.spki.base64'), join(trustOutput, 'recovery-root.spki.base64'))
|
|
await cp(join(imageInput, 'release', 'keyring.json'), join(trustOutput, 'keyring.json'))
|
|
await cp(join(imageInput, 'release', 'keyring.sig.json'), join(trustOutput, 'keyring.sig.json'))
|
|
}
|
|
|
|
const bootstrapSha256 = await hashTree(bootstrapRoot)
|
|
const environmentSha256 = await hashTree(environmentOutput)
|
|
const pristineSha256 = await hashTree(join(output, 'pristine', version))
|
|
const runtimeSha256 = await hashTree(join(output, 'runtimes', version))
|
|
const systemPluginsSha256 = await hashTree(pluginRoot)
|
|
const deploymentIdentity = {
|
|
authority,
|
|
targetSequence,
|
|
dshVersion: version,
|
|
environmentVersion,
|
|
environmentSha256,
|
|
pristineSha256,
|
|
runtimeSha256,
|
|
systemPluginsSha256,
|
|
}
|
|
const inventoryContent = {
|
|
schema: 1,
|
|
authority,
|
|
platformRevision: platformRevisionArg,
|
|
targetSequence,
|
|
bootstrapApi: 1,
|
|
updateApi: 1,
|
|
bootstrap: { version: bootstrapVersion, id: bootstrapVersion, sha256: bootstrapSha256 },
|
|
deployment: {
|
|
id: deriveRecordId('image-deployment', deploymentIdentity),
|
|
dshVersion: version,
|
|
environmentVersion,
|
|
environment: { id: environmentVersion, sha256: environmentSha256 },
|
|
pristine: { id: version, sha256: pristineSha256 },
|
|
runtime: { id: version, sha256: runtimeSha256 },
|
|
systemPlugins: { id: environmentVersion, sha256: systemPluginsSha256 },
|
|
},
|
|
}
|
|
const inventory = { ...inventoryContent, imageBuildId: deriveImageBuildId(inventoryContent) }
|
|
parseImageInventory(inventory)
|
|
await writeFile(join(output, 'inventory.json'), canonicalJson(inventory))
|