node/test/common/sea.js

'use strict';

const common = require('../common');
const fixtures = require('../common/fixtures');
const tmpdir = require('../common/tmpdir');
const { inspect } = require('util');
const fs = require('fs');
const path = require('path');
const assert = require('assert');

const { readFileSync, copyFileSync, statSync } = require('fs');
const {
  spawnSyncAndExitWithoutError,
  spawnSyncAndAssert,
} = require('../common/child_process');

function skipIfBuildSEAIsNotSupported() {
  if (!process.config.variables.node_use_lief)
    common.skip('Node.js was not built with LIEF support.');
  skipIfSingleExecutableIsNotSupported();
}

function skipIfSingleExecutableIsNotSupported() {
  if (!process.config.variables.single_executable_application)
    common.skip('Single Executable Application support has been disabled.');

  if (!['darwin', 'win32', 'linux'].includes(process.platform))
    common.skip(`Unsupported platform ${process.platform}.`);

  if (process.platform === 'linux' && process.config.variables.is_debug === 1)
    common.skip('Running the resultant binary fails with `Couldn\'t read target executable"`.');

  if (process.config.variables.node_shared)
    common.skip('Running the resultant binary fails with ' +
      '`/home/iojs/node-tmp/.tmp.2366/sea: error while loading shared libraries: ' +
      'libnode.so.112: cannot open shared object file: No such file or directory`.');

  if (process.config.variables.icu_gyp_path === 'tools/icu/icu-system.gyp')
    common.skip('Running the resultant binary fails with ' +
      '`/home/iojs/node-tmp/.tmp.2379/sea: error while loading shared libraries: ' +
      'libicui18n.so.71: cannot open shared object file: No such file or directory`.');

  if (!process.config.variables.node_use_openssl || process.config.variables.node_shared_openssl)
    common.skip('Running the resultant binary fails with `Node.js is not compiled with OpenSSL crypto support`.');

  if (process.config.variables.want_separate_host_toolset !== 0)
    common.skip('Running the resultant binary fails with `Segmentation fault (core dumped)`.');

  if (process.platform === 'linux') {
    const osReleaseText = readFileSync('/etc/os-release', { encoding: 'utf-8' });
    const isAlpine = /^NAME="Alpine Linux"/m.test(osReleaseText);
    if (isAlpine) common.skip('Alpine Linux is not supported.');

    if (process.arch === 's390x') {
      common.skip('On s390x, postject fails with `memory access out of bounds`.');
    }
  }

  if (process.config.variables.ubsan) {
    common.skip('UndefinedBehavior Sanitizer is not supported');
  }

  try {
    readFileSync(process.execPath);
  } catch (e) {
    if (e.code === 'ERR_FS_FILE_TOO_LARGE') {
      common.skip('The Node.js binary is too large to be supported by postject');
    }
  }

  tmpdir.refresh();

  // The SEA tests involve making a copy of the executable and writing some fixtures
  // to the tmpdir. To be safe, ensure that the disk space has at least a copy of the
  // executable and some extra space for blobs and configs is available.
  const stat = statSync(process.execPath);
  const expectedSpace = stat.size + 10 * 1024 * 1024;
  if (!tmpdir.hasEnoughSpace(expectedSpace)) {
    common.skip(`Available disk space < ${Math.floor(expectedSpace / 1024 / 1024)} MB`);
  }
}

function buildSEA(fixtureDir, options = {}) {
  const {
    workingDir = tmpdir.path,
    configPath = 'sea-config.json',
    verifyWorkflow = false,
    failure,
  } = options;

  // Copy fixture files to working directory if they are different.
  if (fixtureDir !== workingDir) {
    fs.cpSync(fixtureDir, workingDir, { recursive: true });
  }

  // Parse the config to get the output file path, if on Windows, ensure it ends with .exe
  const config = JSON.parse(fs.readFileSync(path.resolve(workingDir, configPath)));
  assert.strictEqual(typeof config.output, 'string');
  if (process.platform === 'win32') {
    if (!config.output.endsWith('.exe')) {
      config.output += '.exe';
    }
    if (config.executable && !config.executable.endsWith('.exe')) {
      config.executable += '.exe';
    }
    fs.writeFileSync(path.resolve(workingDir, configPath), JSON.stringify(config, null, 2));
  }

  // Build the SEA.
  const child = spawnSyncAndAssert(process.execPath, ['--build-sea', configPath], {
    cwd: workingDir,
    env: {
      NODE_DEBUG_NATIVE: 'SEA',
      ...process.env,
    },
  }, failure === undefined ? {
    status: 0,
    signal: null,
  } : {
    stderr: failure,
    status: 1,
  });

  if (failure !== undefined) {
    // Log more information, otherwise it's hard to debug failures from CI.
    console.log(child.stderr.toString());
    return child;
  }

  const outputFile = path.resolve(workingDir, config.output);
  assert(fs.existsSync(outputFile), `Expected SEA output file ${outputFile} to exist`);
  signSEA(outputFile, verifyWorkflow);
  return outputFile;
}

function generateSEA(fixtureDir, options = {}) {
  const {
    workingDir = tmpdir.path,
    configPath = 'sea-config.json',
    verifyWorkflow = false,
  } = options;
  // Copy fixture files to working directory if they are different.
  if (fixtureDir !== workingDir) {
    fs.cpSync(fixtureDir, workingDir, { recursive: true });
  }

  // Determine the output executable path.
  const outputFile = path.resolve(workingDir, process.platform === 'win32' ? 'sea.exe' : 'sea');

  try {
    // Copy the executable.
    copyFileSync(process.execPath, outputFile);
    console.log(`Copied ${process.execPath} to ${outputFile}`);
  } catch (e) {
    const message = `Cannot copy ${process.execPath} to ${outputFile}: ${inspect(e)}`;
    if (verifyWorkflow) {
      throw new Error(message, { cause: e });
    }
    common.skip(message);
  }

  // Generate the blob using --experimental-sea-config.
  spawnSyncAndExitWithoutError(
    process.execPath,
    ['--experimental-sea-config', configPath],
    {
      cwd: workingDir,
      env: {
        NODE_DEBUG_NATIVE: 'SEA',
        ...process.env,
      },
    },
  );

  // Parse the config to get the output file path.
  const config = JSON.parse(fs.readFileSync(path.resolve(workingDir, configPath)));
  assert.strictEqual(typeof config.output, 'string');
  const seaPrepBlob = path.resolve(workingDir, config.output);
  assert(fs.existsSync(seaPrepBlob), `Expected SEA blob ${seaPrepBlob} to exist`);

  // Use postject to inject the blob.
  const postjectFile = fixtures.path('postject-copy', 'node_modules', 'postject', 'dist', 'cli.js');
  try {
    spawnSyncAndExitWithoutError(process.execPath, [
      postjectFile,
      outputFile,
      'NODE_SEA_BLOB',
      seaPrepBlob,
      '--sentinel-fuse', 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
      ...process.platform === 'darwin' ? [ '--macho-segment-name', 'NODE_SEA' ] : [],
    ]);
  } catch (e) {
    const message = `Cannot inject ${seaPrepBlob} into ${outputFile}: ${inspect(e)}`;
    if (verifyWorkflow) {
      throw new Error(message, { cause: e });
    }
    common.skip(message);
  }
  console.log(`Injected ${seaPrepBlob} into ${outputFile}`);

  signSEA(outputFile, verifyWorkflow);
  return outputFile;
}

function signSEA(targetExecutable, verifyWorkflow = false) {
  if (process.platform === 'darwin') {
    try {
      spawnSyncAndExitWithoutError('codesign', [ '--sign', '-', targetExecutable ]);
      spawnSyncAndExitWithoutError('codesign', [ '--verify', targetExecutable ]);
    } catch (e) {
      const message = `Cannot sign ${targetExecutable}: ${inspect(e)}`;
      if (verifyWorkflow) {
        throw new Error(message, { cause: e });
      }
      common.skip(message);
    }
    console.log(`Signed ${targetExecutable}`);
  } else if (process.platform === 'win32') {
    try {
      spawnSyncAndExitWithoutError('where', [ 'signtool' ]);
    } catch (e) {
      const message = `Cannot find signtool: ${inspect(e)}`;
      if (verifyWorkflow) {
        throw new Error(message, { cause: e });
      }
      common.skip(message);
    }
    let stderr;
    try {
      ({ stderr } = spawnSyncAndExitWithoutError('signtool', [ 'sign', '/fd', 'SHA256', targetExecutable ]));
      spawnSyncAndExitWithoutError('signtool', ['verify', '/pa', 'SHA256', targetExecutable]);
    } catch (e) {
      const message = `Cannot sign ${targetExecutable}: ${inspect(e)}\n${stderr}`;
      if (verifyWorkflow) {
        throw new Error(message, { cause: e });
      }
      common.skip(message);
    }
    console.log(`Signed ${targetExecutable}`);
  }
}

module.exports = {
  skipIfBuildSEAIsNotSupported,
  skipIfSingleExecutableIsNotSupported,
  generateSEA,
  signSEA,
  buildSEA,
};