284dbaf537
Activation reaches plugin discovery before the application dependencies exist. Give PM its own locked Python project and runtime so it can install or repair the application without importing that dependency tree. Keep PM outside the application workspace. A shared uv workspace resolves the application graph and cannot provide this isolation. Route mutations through an isolated worker and preserve transaction callbacks, cancellation, custom package registrations, and correlated receipts. Use the same runtime builder for source installs and packaged payloads. Keep offline wheelhouse support in that builder. Nix builds the independent PM lock as a separate derivation. Refuse lazy-disabled bootstrap before installing tools or dependencies. Move first-party YAML readers and writers to ruamel. Keep the application lock's transitive PyYAML requirements for third-party packages. Verification: - Focused canonical Python suite: 177 passed, 1 host-gated skip. - Electron backend probes: 12 passed. Electron typecheck passed. - Both uv locks, scoped lint, Bash syntax, and whitespace checks passed. - Cold activation, corrupt-app repair, offline staging, and relocation ran. - Built and exercised the Nix PM runtime and standalone YAML merge script. Six broader caller test files retain the same 24 failing test IDs as an archive of HEAD. The existing real-home guard blocks those tests before they can exercise the affected paths. No full-suite pass is claimed. Native Windows signing and full Bionic package execution remain unverified.
54 lines
2.1 KiB
Bash
Executable File
54 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Stage the pinned bionic python/node .debs into the payload, via pm.
|
|
#
|
|
# pm owns everything here: the lock rows (pm/lock.json, linux-arm64-bionic
|
|
# targets of the python/node packages), the digest-verified download, the
|
|
# hardened ar+tar extraction (DebPackage.unpack), and the file-evidence
|
|
# verify (the staged binaries are bionic and cannot exec on the staging
|
|
# host). stage_only() publishes the store entry WITHOUT touching this
|
|
# host's installed facts -- the payload copy below is a pure consumer.
|
|
#
|
|
# Usage: termux_pkg_build.sh <package> <subdir> <payload-dir>
|
|
# <package> pm package name: python | node
|
|
# <subdir> payload subdir the staged tree lands in: python | node
|
|
# <payload-dir> payload root
|
|
set -euo pipefail
|
|
|
|
PKG="$1"
|
|
SUBDIR="$2"
|
|
mkdir -p "$3"
|
|
PAYLOAD="$(cd "$3" && pwd)"
|
|
STAGED="$PAYLOAD/$SUBDIR"
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_ROOT="$(cd "$HERE/../.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
TARGET="linux-arm64-bionic"
|
|
|
|
# Stage (idempotent: an already-published verifying entry is a no-op) and
|
|
# print the entry path -- pm's own resolvers, no layout guessing here.
|
|
# Resolve a real interpreter: some hosts alias python3 to a Store stub
|
|
# (Windows App Execution Aliases). The stdlib client bootstraps PM's separate
|
|
# locked runtime; staging never imports PM's dependencies into this process.
|
|
PM_PY="$(command -v python3 || true)"
|
|
if [ -n "$PM_PY" ] && "$PM_PY" -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
|
|
:
|
|
else
|
|
PM_PY="$(command -v python || true)"
|
|
fi
|
|
[ -n "$PM_PY" ] || { echo "termux_pkg_build: no usable python found" >&2; exit 1; }
|
|
ENTRY_DIR="$("$PM_PY" - "$PKG" "$TARGET" <<'PYEOF'
|
|
import sys
|
|
sys.path.insert(0, ".")
|
|
from pm.client import stage_only
|
|
# stage_only already returns the published entry path -- no re-derivation.
|
|
print(stage_only(sys.argv[1], sys.argv[2]))
|
|
PYEOF
|
|
)" || { echo "termux_pkg_build: pm stage failed" >&2; exit 1; }
|
|
[ -n "$ENTRY_DIR" ] && [ -d "$ENTRY_DIR" ] || { echo "termux_pkg_build: staged entry missing: $ENTRY_DIR" >&2; exit 1; }
|
|
|
|
rm -rf "$STAGED"
|
|
cp -a "$ENTRY_DIR" "$STAGED"
|
|
echo "termux_pkg_build($PKG): pm entry staged -> $STAGED"
|