| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
|
What's the reason for banning bash? |
Sorry, something went wrong.
TBH that because it makes #36099 a bit simpler. I don't think we need bash (we should prefer JS or Python when possible), and I agree with this StackOverflow answer on why sh should be use instead of bash:
|
Sorry, something went wrong.
|
@nodejs/releasers can you review this please? All changes here looks relatively safe, and this is blocking #36099. |
Sorry, something went wrong.
|
/cc @nodejs/build |
Sorry, something went wrong.
|
I don't know shell scripting languages good enough to review this, sorry. |
Sorry, something went wrong.
|
|
||
| if [ "X$SIGN" == "X" ]; then | ||
| echo "No SIGN environment var. Skipping codesign." >&2 | ||
| # shellcheck disable=SC2154 |
There was a problem hiding this comment.
I don't think this disable directive is necessary?
Sorry, something went wrong.
There was a problem hiding this comment.
I'm getting this warning when I remove this line:
$ shellcheck --shell=sh --severity=info --enable=all tools/osx-codesign.sh
In tools/osx-codesign.sh line 6:
[ -z "$SIGN" ] && \
^---^ SC2154: SIGN is referenced but not assigned.
Sorry, something went wrong.
There was a problem hiding this comment.
I'm using ShellCheck 0.7.1 btw, that may be a version-specific behavior.
Sorry, something went wrong.
| # hardened runtime enabled. | ||
| # See https://github.com/nodejs/node/pull/31459 | ||
|
|
||
| # shellcheck disable=SC2154 |
There was a problem hiding this comment.
Rather than this disable directive, would it be better to add a -z "$PKGDIR" check similar to that on line 7 for $SIGN? Both are supplied by the Makefile and guaranteed to be not-empty. So it would seem to me that we should either check for both or assume non-empty for both. But we seem to check for only one. Check for both?
Or is that a modification outside the scope of this PR and should be done later?
Sorry, something went wrong.
|
|
||
| if [ "X$NOTARIZATION_ID" == "X" ]; then | ||
| echo "No NOTARIZATION_ID environment var. Skipping notarization." | ||
| # shellcheck disable=SC2154 |
There was a problem hiding this comment.
I don't think this directive is necessary?
Sorry, something went wrong.
|
|
||
| if [ "X$SIGN" == "X" ]; then | ||
| echo "No SIGN environment var. Skipping codesign." >&2 | ||
| # shellcheck disable=SC2154 |
There was a problem hiding this comment.
I don't think this directive is necessary?
Sorry, something went wrong.
| # shellcheck disable=SC2154 | ||
| productsign --sign "$SIGN" "$PKG" "$PKG"-SIGNED | ||
| # shellcheck disable=SC2154 |
There was a problem hiding this comment.
Instead of these two disable directives, would it make sense to add a -z "$PKG" check similar to the one for $SIGN on line 7? Both are guaranteed by the Makefile so it would seem that we should either check for both or assume both, but we are checking for just one and assuming the other. Or is that outside the scope of this PR?
Sorry, something went wrong.
There was a problem hiding this comment.
LGTM with or without my comments addressed.
Sorry, something went wrong.
Sorry, something went wrong.
|
Has this been tested to ensure the signing still works? |
Sorry, something went wrong.
$ /bin/sh --version GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin19) Copyright (C) 2007 Free Software Foundation, Inc. $ /bin/bash --version GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin19) Copyright (C) 2007 Free Software Foundation, Inc. is this really necessary? seems like needless churn to me |
Sorry, something went wrong.
|
test build running, should come out @ https://nodejs.org/download/test/v16.0.0-test202012024dc74c4fbb/ shortly, someone can test that if you really want to merge this and need it verified. The .pkg should get full coverage of these changes I think - signing, notarization, etc. |
Sorry, something went wrong.
|
https://nodejs.org/download/test/v16.0.0-test202012024dc74c4fbb/node-v16.0.0-test202012024dc74c4fbb.pkg there's yer pkg to test, it got built without error at least. |
Sorry, something went wrong.
On my macOS Catalina machine, I got the same output as you for --version. But that doesn't mean the two executables are the same. If you take a look at the file size, you can see they are quite different: $ ls -lh /bin/bash /bin/sh
-r-xr-xr-x 1 root wheel 609K Sep 22 02:30 /bin/bash
-rwxr-xr-x 1 root wheel 31K Sep 22 02:30 /bin/sh
I tried to install it, and the installation went smoothly. Can I take the notorization works? |
Sorry, something went wrong.
Sorry, something went wrong.
I believe because on macOS sh is a simple executable redirect to bash. This isn't a Dash vs Bash situation, it's both the same Bash.
yep, and I can see a notarization email for it too: Your Mac software has been notarized. You can now export this software and distribute it directly to users. Bundle Identifier: org.nodejs.pkg.v16.0.0-test202012024dc74c4fbb Request Identifier: d3ff1b52-4705-4b14-824a-32bf16def8c8 |
Sorry, something went wrong.
PR-URL: #36121 Reviewed-By: Rich Trott <rtrott@gmail.com>
PR-URL: #36121 Reviewed-By: Rich Trott <rtrott@gmail.com>
PR-URL: #36121 Reviewed-By: Rich Trott <rtrott@gmail.com>
| Back | FazBrowse Home | New Git URL |
In preparation for #36099.
Checklist