fix: support native package verifier scratch

2026-10-09 18:05:04 -05:00
parent c5a6cdaf6a
commit 4be046c8d0
12 changed files with 330 additions and 13 deletions
@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// Builds the repository's real sharp proof as a native Module Package for the hardened verifier
+// container test. Run inside deploy/Dockerfile's build stage, where the workspace is already built
+// and has exactly the locked dependencies the runtime image was built against.
+
+import { cp, mkdir, mkdtemp, readFile, realpath, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { packModule } from "@ekklesia/module-pack";
+
+const repositoryRoot = path.resolve(import.meta.dirname, "..", "..", "..", "..");
+const outDirectory = process.argv[2];
+if (outDirectory === undefined || !path.isAbsolute(outDirectory)) {
+  throw new Error("An absolute output directory is required.");
+}
+
+const temporaryRoot = await mkdtemp(path.join(tmpdir(), "ekklesia-native-verifier-proof-"));
+try {
+  const moduleDirectory = path.join(temporaryRoot, "native-proof");
+  await cp(
+    path.join(repositoryRoot, "packages", "module-pack", "tests", "fixtures", "native-module"),
+    moduleDirectory,
+    { recursive: true },
+  );
+  const packageFile = path.join(moduleDirectory, "package.json");
+  const packageJson = JSON.parse(await readFile(packageFile, "utf8"));
+  packageJson.engines = { node: ">=24.11.0 <25" };
+  await writeFile(packageFile, `${JSON.stringify(packageJson, null, 2)}\n`);
+
+  const modulesDirectory = path.join(moduleDirectory, "node_modules");
+  await mkdir(path.join(modulesDirectory, "@ekklesia"), { recursive: true });
+  await symlink(
+    await realpath(path.join(repositoryRoot, "packages", "module-pack", "node_modules", "sharp")),
+    path.join(modulesDirectory, "sharp"),
+  );
+  await symlink(
+    await realpath(
+      path.join(
+        repositoryRoot,
+        "packages",
+        "module-pack",
+        "node_modules",
+        "@ekklesia",
+        "module-sdk",
+      ),
+    ),
+    path.join(modulesDirectory, "@ekklesia", "module-sdk"),
+  );
+
+  const result = await packModule({
+    licenseFile: path.join(repositoryRoot, "LICENSE"),
+    moduleDirectory,
+    outDirectory,
+    sourceRevision: "0".repeat(40),
+    target: "linux-x64-glibc",
+  });
+  process.stdout.write(`${path.basename(result.archivePath)}\n`);
+} finally {
+  await rm(temporaryRoot, { force: true, recursive: true });
+}