Commit 9b849a7
tools: use latest upstream commit for zlib updates
Zlib rarely gets new tags or releases, so now we use the latest commit
on the upstream default branch to check if an update is available.
Refs: nodejs/security-wg#973
PR-URL: #48054
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>1 parent e4a5d62 commit 9b849a7
1 file changed
Lines changed: 29 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,23 +1,46 @@ | |||
| 1 | 1 | #!/bin/sh | |
| 2 | 2 | set -e | |
| 3 | - # Shell script to update zlib in the source tree to a specific version | ||
| 3 | + # Shell script to update zlib in the source tree to the most recent version. | ||
| 4 | + # Zlib rarely creates tags or releases, so we use the latest commit on the main branch. | ||
| 5 | + # See: https://github.com/nodejs/node/pull/47417 | ||
| 4 | 6 | ||
| 5 | 7 | BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd) | |
| 6 | 8 | DEPS_DIR="$BASE_DIR/deps" | |
| 7 | 9 | ||
| 8 | - CURRENT_VERSION=$(grep "#define ZLIB_VERSION" "$DEPS_DIR/zlib/zlib.h" | sed -n "s/^.*VERSION \"\(.*\)\"/\1/p") | ||
| 10 | + echo "Comparing latest upstream with current revision" | ||
| 9 | 11 | ||
| 10 | - NEW_VERSION_ZLIB_H=$(curl -s "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/third_party/zlib/zlib.h?format=TEXT" | base64 --decode) | ||
| 12 | + git fetch https://chromium.googlesource.com/chromium/src/third_party/zlib.git HEAD | ||
| 11 | 13 | ||
| 12 | - NEW_VERSION=$(printf '%s' "$NEW_VERSION_ZLIB_H" | grep "#define ZLIB_VERSION" | sed -n "s/^.*VERSION \"\(.*\)\"/\1/p") | ||
| 14 | + # Revert zconf.h changes before checking diff | ||
| 15 | + perl -i -pe 's|^//#include "chromeconf.h"|#include "chromeconf.h"|' "$DEPS_DIR/zlib/zconf.h" | ||
| 16 | + git stash -- "$DEPS_DIR/zlib/zconf.h" | ||
| 13 | 17 | ||
| 14 | - echo "Comparing $NEW_VERSION with $CURRENT_VERSION" | ||
| 18 | + DIFF_TREE=$(git diff --diff-filter=d 'stash@{0}:deps/zlib' FETCH_HEAD) | ||
| 15 | 19 | ||
| 16 | - if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then | ||
| 20 | + git stash drop | ||
| 21 | + | ||
| 22 | + if [ -z "$DIFF_TREE" ]; then | ||
| 17 | 23 | echo "Skipped because zlib is on the latest version." | |
| 18 | 24 | exit 0 | |
| 19 | 25 | fi | |
| 20 | 26 | ||
| 27 | + # This is a rather arbitrary restriction. This script is assumed to run on | ||
| 28 | + # Sunday, shortly after midnight UTC. This check thus prevents pulling in the | ||
| 29 | + # most recent commits if any changes were made on Friday or Saturday (UTC). | ||
| 30 | + # We don't want to pull in a commit that was just pushed, and instead rather | ||
| 31 | + # wait for the next week's update. If no commits have been pushed in the last | ||
| 32 | + # two days, we assume that the most recent commit is stable enough to be | ||
| 33 | + # pulled in. | ||
| 34 | + LAST_CHANGE_DATE=$(git log -1 --format=%ct FETCH_HEAD) | ||
| 35 | + TWO_DAYS_AGO=$(date -d 'now - 2 days' '+%s') | ||
| 36 | + | ||
| 37 | + if [ "$LAST_CHANGE_DATE" -gt "$TWO_DAYS_AGO" ]; then | ||
| 38 | + echo "Skipped because the latest version is too recent." | ||
| 39 | + exit 0 | ||
| 40 | + fi | ||
| 41 | + | ||
| 42 | + NEW_VERSION=$(git rev-parse --short=7 FETCH_HEAD) | ||
| 43 | + | ||
| 21 | 44 | echo "Making temporary workspace..." | |
| 22 | 45 | ||
| 23 | 46 | WORKSPACE=$(mktemp -d 2> /dev/null || mktemp -d -t 'tmp') | |
0 commit comments