diff --git a/.gitignore b/.gitignore index 0034e17..dd034c4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,21 +2,3 @@ /bash-language-server-1.17.0.tar.gz /bash-language-server-2.0.0.tar.gz /bash-language-server-2.0.0-vendor.tar.xz -/bash-language-server-3.0.5.tar.gz -/bash-language-server-3.0.5-vendor.tar.xz -/bash-language-server-3.2.0.tar.gz -/bash-language-server-3.2.0-vendor.tar.xz -/bash-language-server-4.6.1.tar.gz -/bash-language-server-4.6.1-vendor.tar.xz -/bash-language-server-4.10.0-vendor.tar.xz -/bash-language-server-4.10.0.tar.gz -/bash-language-server-5.1.1.tar.gz -/bash-language-server-5.1.1-vendor.tar.zst -/bash-language-server-5.2.0.tar.gz -/bash-language-server-5.2.0-vendor.tar.zst -/bash-language-server-5.4.0.tar.gz -/bash-language-server-5.4.0-vendor.tar.zst -/bash-language-server-5.4.3.tar.gz -/bash-language-server-5.4.3-vendor.tar.zst -/bash-language-server-5.6.0.tar.gz -/bash-language-server-5.6.0-vendor.tar.zst diff --git a/bash-language-server-bundled-licenses.txt b/bash-language-server-bundled-licenses.txt deleted file mode 100644 index 10776d2..0000000 --- a/bash-language-server-bundled-licenses.txt +++ /dev/null @@ -1,3 +0,0 @@ -"BSD-2-Clause" -"ISC" -"MIT" diff --git a/bashls-fix-CVE-2022-0613.patch b/bashls-fix-CVE-2022-0613.patch new file mode 100644 index 0000000..ae09185 --- /dev/null +++ b/bashls-fix-CVE-2022-0613.patch @@ -0,0 +1,55 @@ +Index: bash-language-server-server-2.0.0/server/package.json +=================================================================== +--- bash-language-server-server-2.0.0.orig/server/package.json ++++ bash-language-server-server-2.0.0/server/package.json +@@ -23,7 +23,7 @@ + "request": "^2.83.0", + "request-promise-native": "^1.0.5", + "turndown": "^4.0.2", +- "urijs": "^1.19.1", ++ "urijs": "^1.19.8", + "vscode-languageserver": "^6.1.1", + "vscode-languageserver-textdocument": "^1.0.1", + "web-tree-sitter": "^0.19.4" +@@ -36,6 +36,6 @@ + "@types/glob": "^7.1.1", + "@types/request-promise-native": "^1.0.17", + "@types/turndown": "^5.0.0", +- "@types/urijs": "^1.19.4" ++ "@types/urijs": "^1.19.8" + } + } +Index: bash-language-server-server-2.0.0/server/yarn.lock +=================================================================== +--- bash-language-server-server-2.0.0.orig/server/yarn.lock ++++ bash-language-server-server-2.0.0/server/yarn.lock +@@ -63,10 +63,10 @@ + resolved "https://registry.yarnpkg.com/@types/turndown/-/turndown-5.0.0.tgz#2b763b36f783e4e237cea62cdc8f8592b72b9285" + integrity sha512-Y7KZn6SfSv1vzjByJGijrM9w99HoUbLiAgYwe+sGH6RYi5diIGLYOcr4Z1YqR2biFs9K5PnxKv/Fbkmh57pvzg== + +-"@types/urijs@^1.19.4": +- version "1.19.4" +- resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.4.tgz#29c4a694d4842d7f95e359a26223fc1865f1ab13" +- integrity sha512-uHUvuLfy4YkRHL4UH8J8oRsINhdEHd9ymag7KJZVT94CjAmY1njoUzhazJsZjwfy+IpWKQKGVyXCwzhZvg73Fg== ++"@types/urijs@^1.19.8": ++ version "1.19.18" ++ resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.18.tgz#bf92d5b7c32bf41fc161c3660b8e3a78a9a4333e" ++ integrity sha512-tjftsOLuIWFLJxcpgFeehNnMhpMIv0ELJl0/i31jiV3au1GQpnd3/pTTDQg2zO5cSGJxtrDzMgebOH7+cqh3Vg== + + abab@^1.0.4: + version "1.0.4" +@@ -721,10 +721,10 @@ type-check@~0.3.2: + dependencies: + prelude-ls "~1.1.2" + +-urijs@^1.19.1: +- version "1.19.7" +- resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.7.tgz#4f594e59113928fea63c00ce688fb395b1168ab9" +- integrity sha512-Id+IKjdU0Hx+7Zx717jwLPsPeUqz7rAtuVBRLLs+qn+J2nf9NGITWVCxcijgYxBqe83C7sqsQPs6H1pyz3x9gA== ++urijs@^1.19.8: ++ version "1.19.8" ++ resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.8.tgz#ee0407a18528934d3c383e691912f47043a58feb" ++ integrity sha512-iIXHrjomQ0ZCuDRy44wRbyTZVnfVNLVo3Ksz1yxNyE5wV1IDZW2S5Jszy45DTlw/UdsnRT7DyDhIz7Gy+vJumw== + + uuid@^3.1.0: + version "3.2.1" diff --git a/changelog b/changelog deleted file mode 100644 index b09f9ab..0000000 --- a/changelog +++ /dev/null @@ -1,52 +0,0 @@ -* Thu Jan 25 2024 Fedora Release Engineering - 5.1.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 5.1.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Tue Jan 02 2024 Andreas Schneider - 5.1.1-1 -- Update to version 5.1.1 - * https://github.com/bash-lsp/bash-language-server/blob/server-5.1.1/server/CHANGELOG.md - -* Thu Jul 20 2023 Fedora Release Engineering - 4.10.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Mon Jun 12 2023 Pavel Filipenský - 4.6.10-1 -- Update to version 4.10.0 - https://github.com/bash-lsp/bash-language-server/blob/server-4.10.0/server/CHANGELOG.md - -* Thu Feb 02 2023 Pavel Filipenský - 4.6.1-2 -- Fix /usr/bin/bash-language-server - -* Mon Jan 30 2023 Pavel Filipenský - 4.6.1-1 -- Update to version 4.6.1 - * https://github.com/bash-lsp/bash-language-server/blob/server-4.6.1/server/CHANGELOG.md - -* Sun Jan 29 2023 Jonathan Lebon - 3.2.0-3 -- Don't own /usr/lib/node_modules - -* Thu Jan 19 2023 Fedora Release Engineering - 3.2.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Fri Aug 19 2022 Pavel Filipenský - 3.0.5-1 -- Update to version 3.0.5 - * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md -- Linting based on shellcheck -- Update bashls-fix-CVE-2022-0613.patch with content of https://patch-diff.githubusercontent.com/raw/bash-lsp/bash-language-server/pull/489.patch - -* Fri Jul 22 2022 Fedora Release Engineering - 2.0.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Feb 17 2022 Pavel Filipenský - 2.0.0-3 -- resolves: #2055544 - Fix CVE-2022-0613 - -* Thu Jan 20 2022 Fedora Release Engineering - 2.0.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Aug 26 2021 Pavel Filipenský - 2.0.0-1 -- Update to version 2.0.0 - * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md -- Fixed indentation for node shebang loop - -* Thu Aug 05 2021 Andreas Schneider - 1.17.0-1 -- Initial package - diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 67f9f5d..5022757 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -3,25 +3,24 @@ %define pkg_name bash-language-server Name: nodejs-bash-language-server -Version: 5.6.0 -Release: %autorelease +Version: 2.0.0 +Release: 2%{?dist} Summary: A language server for Bash License: MIT Url: https://github.com/bash-lsp/bash-language-server Source0: %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz # Create with `bash prepare_vendor.sh` -Source1: %{pkg_name}-%{version}-vendor.tar.zst -# Create with: nodejs-packaging-bundler bash-language-server 5.1.1 -Source2: bash-language-server-bundled-licenses.txt +Source1: %{pkg_name}-%{version}-vendor.tar.xz +Patch0: bashls-fix-CVE-2022-0613.patch BuildRequires: fdupes -BuildRequires: npm(typescript) +BuildRequires: nodejs-typescript BuildRequires: nodejs-packaging -BuildRequires: nodejs-npm +BuildRequires: npm BuildRequires: perl-interpreter -BuildRequires: pnpm +BuildRequires: rsync +BuildRequires: yarnpkg BuildArch: noarch ExclusiveArch: %{nodejs_arches} noarch -Recommends: ShellCheck %description Bash language server implementation based on Tree Sitter and its grammar for @@ -30,20 +29,21 @@ Bash with explainshell integration. %prep %autosetup -n %{pkg_name}-server-%{version} -a1 -p1 -cp %{SOURCE2} . - %build -pnpm install --offline --frozen-lockfile --store-dir="$(pwd)/.pnpm-store" +export YARN_CACHE_FOLDER="$(pwd)/.package-cache" +yarn install --offline --frozen-lockfile npm run compile %install +export YARN_CACHE_FOLDER="$(pwd)/.package-cache" + # Only install production dependencies in node_modules -rm -rf node_modules/ -pnpm install --production --offline --frozen-lockfile --package-import-method copy --store-dir="$(pwd)/.pnpm-store" +yarn install --production --offline --frozen-lockfile for S in $(grep -l '#!.*node' \ - server/out/cli.js \ + server/bin/* \ + server/node_modules/acorn/bin/* \ server/node_modules/ajv/scripts/* \ server/node_modules/escodegen/bin/* \ server/node_modules/esprima/bin/* \ @@ -53,51 +53,43 @@ for S in $(grep -l '#!.*node' \ server/node_modules/uuid/bin/* \ server/node_modules/vscode-languageserver/bin/* \ ) ; do - SB="${S}.backup" - cp ${S} ${SB} - perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S - diff -urN ${SB} ${S} || : - rm ${SB} + SB="${S}.backup" + cp ${S} ${SB} + perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S + diff -urN ${SB} ${S} || : + rm ${SB} done -install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ - -cp -av server %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ -cp -av node_modules %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ - install -d -m 0755 %{buildroot}%{_bindir} -cat << EOF > %{buildroot}%{_bindir}/%{pkg_name} -#!/bin/sh -export NODE_ENV=production +ln -s %{nodejs_sitelib}/%{pkg_name}/bin/main.js %{buildroot}%{_bindir}/%{pkg_name} -exec /usr/bin/node %{nodejs_sitelib}/%{pkg_name}/server/out/cli.js "\$@" -EOF -chmod +x %{buildroot}%{_bindir}/%{pkg_name} +install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ +rsync -av server/ %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ + +rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/performance-now/test/ +chmod 0644 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/tree-sitter-bash.wasm \ + %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/web-tree-sitter/tree-sitter.wasm find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -name "*.bak" -delete find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete -find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type d -name "\.bin" -print0 | xargs -0 rm -rf -find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type d -name "\.github" -print0 | xargs -0 rm -rf - -rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/ajv/scripts/ -rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/dashdash/etc/ -rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/performance-now/test/ - -rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/src/get-options.sh - -# dangling symlinks -rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/fuzzy-search -rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/node-fetch -rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/turndown -rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/urijs %fdupes %{buildroot}%{nodejs_sitelib}/%{pkg_name} %files -%license LICENSE bash-language-server-bundled-licenses.txt +%license LICENSE %doc README.md %{_bindir}/%{pkg_name} +%dir %{nodejs_sitelib} %{nodejs_sitelib}/%{pkg_name}/ %changelog -%autochangelog +* Thu Feb 17 2022 Pavel Filipenský - 2.0.0-2 +- resolves: #2055544 - Fix CVE-2022-0613 + +* Thu Aug 26 2021 Pavel Filipenský - 2.0.0-1 +- Update to version 2.0.0 + * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md +- Fixed indentation for node shebang loop + +* Thu Aug 05 2021 Andreas Schneider - 1.17.0-1 +- Initial package diff --git a/prepare_vendor.sh b/prepare_vendor.sh index 4795776..8a02610 100644 --- a/prepare_vendor.sh +++ b/prepare_vendor.sh @@ -1,23 +1,22 @@ #!/bin/bash -# shellcheck disable=2181 -BASHLS_URL="$(rpmspec -P ./*.spec | grep Source0 | sed -e 's/Source0:[ ]*//g')" -BASHLS_TARBALL="$(basename "${BASHLS_URL}")" -BASHLS_PKGVERSION="$(rpmspec -P ./*.spec | grep ^Version | sed -e 's/Version:[ ]*//g')" +BASHLS_URL=$(rpmspec -P *.spec | grep Source0 | sed -e 's/Source0:[ ]*//g') +BASHLS_TARBALL=$(basename $BASHLS_URL) +BASHLS_PKGVERSION=$(rpmspec -P *.spec | grep ^Version | sed -e 's/Version:[ ]*//g') BASHLS_PKGNAME="bash-language-server" BASHLS_PKGDIR="$(pwd)" -BASHLS_TMPDIR="$(mktemp --tmpdir -d bashls-XXXXXXXX)" -BASHLS_PATH="${BASHLS_TMPDIR}/${BASHLS_PKGNAME}-server-${BASHLS_PKGVERSION}" +BASHLS_TMPDIR=$(mktemp --tmpdir -d bashls-XXXXXXXX) +BASHLS_PATH="$BASHLS_TMPDIR/$BASHLS_PKGNAME-server-$BASHLS_PKGVERSION" -echo "URL: ${BASHLS_URL}" -echo "TARBALL: ${BASHLS_TARBALL}" -echo "NAME: ${BASHLS_PKGNAME}" -echo "VERSION: ${BASHLS_PKGVERSION}" -echo "PATH: ${BASHLS_PATH}" +echo "URL: $BASHLS_URL" +echo "TARBALL: $BASHLS_TARBALL" +echo "NAME: $BASHLS_PKGNAME" +echo "VERSION: $BASHLS_PKGVERSION" +echo "PATH: $BASHLS_PATH" cleanup_tmpdir() { - popd 2>/dev/null || true - rm -rf "${BASHLS_TMPDIR}" + popd 2>/dev/null + rm -rf $BASHLS_TMPDIR } trap cleanup_tmpdir SIGINT @@ -30,56 +29,59 @@ cleanup_and_exit() { fi } -if [ ! -w "${BASHLS_TARBALL}" ]; then +if [ ! -w "$BASHLS_TARBALL" ]; then wget "$BASHLS_URL" fi -tar -xf "${BASHLS_TARBALL}" -C "${BASHLS_TMPDIR}" +tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR -pushd "${BASHLS_PATH}" || cleanup_and_exit 1 +pushd $BASHLS_PATH || cleanup_and_exit 1 -PNPM_STORE_DIR="$(pwd)/.pnpm-store" +# TEMPORARY: Fix CVE-2022-0613 +patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch" + +export YARN_CACHE_FOLDER="$(pwd)/.package-cache" echo ">>>>>> Install npm modules" -pnpm install --store-dir="${PNPM_STORE_DIR}" +yarn install --frozen-lockfile if [ $? -ne 0 ]; then echo "ERROR: yarn install failed" cleanup_and_exit 1 fi echo ">>>>>> Cleanup object dirs" -find "${PNPM_STORE_DIR}/" -type d -name "__pycache__" -print0 | xargs -0 rm -rf -find "${PNPM_STORE_DIR}/" -type d -name "*.o.d" -print0 | xargs -0 rm -rf +find ${YARN_CACHE_FOLDER}/ -type d -name "*.o.d" | xargs rm -rf +find ${YARN_CACHE_FOLDER}/ -type d -name "__pycache__" | xargs rm -rf echo ">>>>>> Cleanup object files" -find "${PNPM_STORE_DIR}/" -name "*.node" -print0 | xargs -0 rm -rf +find ${YARN_CACHE_FOLDER}/ -name "*.node" | xargs rm -rf -find "${PNPM_STORE_DIR}/" -name "*.dll" | grep -v signal-client | xargs rm -f -find "${PNPM_STORE_DIR}/" -name "*.dylib" -delete -find "${PNPM_STORE_DIR}/" -name "*.so" -delete -find "${PNPM_STORE_DIR}/" -name "*.o" -delete -find "${PNPM_STORE_DIR}/" -name "*.a" -delete -find "${PNPM_STORE_DIR}/" -name "*.snyk-*.flag" -delete -find "${PNPM_STORE_DIR}/" -name "builderror.log" -delete -find "${PNPM_STORE_DIR}/" -name ".deps" -type d -print0 | xargs -0 rm -rf +find ${YARN_CACHE_FOLDER}/ -name "*.dll" | grep -v signal-client | xargs rm -f +find ${YARN_CACHE_FOLDER}/ -name "*.dylib" -delete +find ${YARN_CACHE_FOLDER}/ -name "*.so" -delete +find ${YARN_CACHE_FOLDER}/ -name "*.o" -delete +find ${YARN_CACHE_FOLDER}/ -name "*.a" -delete +find ${YARN_CACHE_FOLDER}/ -name "*.snyk-*.flag" -delete +find ${YARN_CACHE_FOLDER}/ -name "builderror.log" -delete +find ${YARN_CACHE_FOLDER}/ -name ".deps" -type d | xargs rm -rf echo ">>>>>> Cleanup build info" -find "${PNPM_STORE_DIR}/" -name "Makefile" -delete -find "${PNPM_STORE_DIR}/" -name "*.target.mk" -delete -find "${PNPM_STORE_DIR}/" -name "config.gypi" -delete -find "${PNPM_STORE_DIR}/" -name "package.json" -exec sed -i "s#${BASHLS_PATH}#/tmp#g" {} \; +find ${YARN_CACHE_FOLDER}/ -name "Makefile" -delete +find ${YARN_CACHE_FOLDER}/ -name "*.target.mk" -delete +find ${YARN_CACHE_FOLDER}/ -name "config.gypi" -delete +find ${YARN_CACHE_FOLDER}/ -name "package.json" -exec sed -i "s#$BASHLS_PATH#/tmp#g" {} \; echo ">>>>>> Package vendor files" -rm -f "${BASHLS_PKGDIR}/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.zst" -XZ_OPT="-T$(nproc)" tar --zstd -cf "${BASHLS_PKGDIR}/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.zst" .pnpm-store +rm -f $BASHLS_PKGDIR/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.xz +XZ_OPT="-T$(nproc)" tar cJf $BASHLS_PKGDIR/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.xz .package-cache if [ $? -ne 0 ]; then cleanup_and_exit 1 fi -popd || cleanup_and_exit 1 +popd cleanup_and_exit 0 diff --git a/sources b/sources index 86fe2b4..8851f0f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bash-language-server-5.6.0.tar.gz) = 0c99d34ca0e92a4e5719e8c8ca99faad5effe5d6d45f72cdaa05f70df521cf0830e3f81acf700d172496afa721881c2f1df4faf280e897809ce55757d5039796 -SHA512 (bash-language-server-5.6.0-vendor.tar.zst) = ea90b1ea6fd23bbd18ff1346f3b22813a0c5a38c0f3c36b58dbebe64d2dd1f449ae9e1ea5ca516124d8a7bf7f327d2062cbf7fb17ccdf424489a29eb14a71560 +SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9 +SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 14384d60661fb4973b22e18998a9b966aba9a9c252d9c2b139996ec8f208d9db54065f278f216c381f60e76b6fdc70979793d444b56016661bc8f6d4b76172e8