Update to version 3.0.5

resolves: #2055544

.gitignore

@@ -4,19 +4,3 @@
 /bash-language-server-2.0.0-vendor.tar.xz
 /bash-language-server-3.0.5.tar.gz
 /bash-language-server-3.0.5-vendor.tar.xz
-/bash-language-server-3.2.0.tar.gz
-/bash-language-server-3.2.0-vendor.tar.xz
-/bash-language-server-4.6.1.tar.gz
-/bash-language-server-4.6.1-vendor.tar.xz
-/bash-language-server-4.10.0-vendor.tar.xz
-/bash-language-server-4.10.0.tar.gz
-/bash-language-server-5.1.1.tar.gz
-/bash-language-server-5.1.1-vendor.tar.zst
-/bash-language-server-5.2.0.tar.gz
-/bash-language-server-5.2.0-vendor.tar.zst
-/bash-language-server-5.4.0.tar.gz
-/bash-language-server-5.4.0-vendor.tar.zst
-/bash-language-server-5.4.3.tar.gz
-/bash-language-server-5.4.3-vendor.tar.zst
-/bash-language-server-5.6.0.tar.gz
-/bash-language-server-5.6.0-vendor.tar.zst

bash-language-server-bundled-licenses.txt

@@ -1,3 +0,0 @@
-"BSD-2-Clause"
-"ISC"
-"MIT"

bashls-fix-CVE-2022-0613.patch

@@ -0,0 +1,38 @@
+From 5a4920cf4f49c29aade36682a17a38cb979bdfd1 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Fri, 19 Aug 2022 10:10:31 +0200
+Subject: [PATCH] CVE-2022-0613: Update urijs to v1.19.11
+
+There is a Authorization Bypass Through User-Controlled Key in NPM
+urijs prior to 1.19.8.
+---
+ server/package.json | 2 +-
+ server/yarn.lock    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/server/package.json b/server/package.json
+index 51f565a4..5f3ba0fb 100644
+--- a/server/package.json
++++ b/server/package.json
+@@ -23,7 +23,7 @@
+     "request": "^2.83.0",
+     "request-promise-native": "^1.0.5",
+     "turndown": "^7.0.0",
+-    "urijs": "^1.19.1",
++    "urijs": "^1.19.11",
+     "vscode-languageserver": "^6.1.1",
+     "vscode-languageserver-textdocument": "^1.0.1",
+     "web-tree-sitter": "^0.20.5"
+diff --git a/server/yarn.lock b/server/yarn.lock
+index 0071aad2..7c752cf2 100644
+--- a/server/yarn.lock
++++ b/server/yarn.lock
+@@ -489,7 +489,7 @@ tweetnacl@^0.14.3, tweetnacl@~0.14.0:
+   resolved "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz#5ae68177f192d4456269d108afa93ff8743f4f64"
+   integrity sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q=
+ 
+-urijs@^1.19.1:
++urijs@^1.19.11:
+   version "1.19.11"
+   resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.11.tgz#204b0d6b605ae80bea54bea39280cdb7c9f923cc"
+   integrity sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==

changelog

@@ -1,52 +0,0 @@
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Jan 02 2024 Andreas Schneider <asn@redhat.com> - 5.1.1-1
-- Update to version 5.1.1
-  * https://github.com/bash-lsp/bash-language-server/blob/server-5.1.1/server/CHANGELOG.md
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.10.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Mon Jun 12 2023 Pavel Filipenský <pfilipen@redhat.com> - 4.6.10-1
-- Update to version 4.10.0 - https://github.com/bash-lsp/bash-language-server/blob/server-4.10.0/server/CHANGELOG.md
-
-* Thu Feb 02 2023 Pavel Filipenský <pfilipen@redhat.com> - 4.6.1-2
-- Fix /usr/bin/bash-language-server
-
-* Mon Jan 30 2023 Pavel Filipenský <pfilipen@redhat.com> - 4.6.1-1
-- Update to version 4.6.1
-  * https://github.com/bash-lsp/bash-language-server/blob/server-4.6.1/server/CHANGELOG.md
-
-* Sun Jan 29 2023 Jonathan Lebon <jonathan@jlebon.com> - 3.2.0-3
-- Don't own /usr/lib/node_modules
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Aug 19 2022 Pavel Filipenský <pfilipen@redhat.com> - 3.0.5-1
-- Update to version 3.0.5
-  * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md
-- Linting based on shellcheck
-- Update bashls-fix-CVE-2022-0613.patch with content of https://patch-diff.githubusercontent.com/raw/bash-lsp/bash-language-server/pull/489.patch
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-3
-- resolves: #2055544 - Fix CVE-2022-0613
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Thu Aug 26 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-1
-- Update to version 2.0.0
-  * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md
-- Fixed indentation for node shebang loop
-
-* Thu Aug 05 2021 Andreas Schneider <asn@redhat.com> - 1.17.0-1
-- Initial package
-

nodejs-bash-language-server.spec

@@ -3,22 +3,22 @@
 %define pkg_name bash-language-server
 
 Name:           nodejs-bash-language-server
-Version:        5.6.0
+Version:        3.0.5
-Release:        %autorelease
+Release:        1%{?dist}
 Summary:        A language server for Bash
 License:        MIT
 Url:            https://github.com/bash-lsp/bash-language-server
 Source0:        %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz
 # Create with `bash prepare_vendor.sh`
-Source1:        %{pkg_name}-%{version}-vendor.tar.zst
+Source1:        %{pkg_name}-%{version}-vendor.tar.xz
-# Create with: nodejs-packaging-bundler bash-language-server 5.1.1
+Patch0:         bashls-fix-CVE-2022-0613.patch
-Source2:        bash-language-server-bundled-licenses.txt
 BuildRequires:  fdupes
-BuildRequires:  npm(typescript)
+BuildRequires:  nodejs-typescript
 BuildRequires:  nodejs-packaging
-BuildRequires:  nodejs-npm
+BuildRequires:  npm
 BuildRequires:  perl-interpreter
-BuildRequires:  pnpm
+BuildRequires:  rsync
+BuildRequires:  yarnpkg
 BuildArch:      noarch
 ExclusiveArch: %{nodejs_arches} noarch
 Recommends:     ShellCheck
@@ -30,20 +30,21 @@ Bash with explainshell integration.
 %prep
 %autosetup -n %{pkg_name}-server-%{version} -a1 -p1
 
-cp %{SOURCE2} .
-
 %build
-pnpm install --offline --frozen-lockfile --store-dir="$(pwd)/.pnpm-store"
+export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
+yarn install --offline --frozen-lockfile
 
 npm run compile
 
 %install
+export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
+
 # Only install production dependencies in node_modules
-rm -rf node_modules/
+yarn install --production --offline --frozen-lockfile
-pnpm install --production --offline --frozen-lockfile --package-import-method copy --store-dir="$(pwd)/.pnpm-store"
 
 for S in $(grep -l '#!.*node' \
-    server/out/cli.js \
+    server/bin/* \
+    server/node_modules/acorn/bin/* \
     server/node_modules/ajv/scripts/* \
     server/node_modules/escodegen/bin/* \
     server/node_modules/esprima/bin/* \
@@ -53,51 +54,52 @@ for S in $(grep -l '#!.*node' \
     server/node_modules/uuid/bin/* \
     server/node_modules/vscode-languageserver/bin/* \
     ) ; do
-    SB="${S}.backup"
+        SB="${S}.backup"
-    cp ${S} ${SB}
+        cp ${S} ${SB}
-    perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S
+        perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S
-    diff -urN ${SB} ${S} || :
+        diff -urN ${SB} ${S} || :
-    rm ${SB}
+        rm ${SB}
 done
 
-install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
-
-cp -av server %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
-cp -av node_modules %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
-
 install -d -m 0755 %{buildroot}%{_bindir}
-cat << EOF > %{buildroot}%{_bindir}/%{pkg_name}
+ln -s %{nodejs_sitelib}/%{pkg_name}/bin/main.js %{buildroot}%{_bindir}/%{pkg_name}
-#!/bin/sh
-export NODE_ENV=production
 
-exec /usr/bin/node %{nodejs_sitelib}/%{pkg_name}/server/out/cli.js "\$@"
+install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
-EOF
+rsync -av server/ %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
-chmod +x %{buildroot}%{_bindir}/%{pkg_name}
+
+rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/performance-now/test/
+chmod 0644 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/tree-sitter-bash.wasm \
+    %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/web-tree-sitter/tree-sitter.wasm
 
 find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -name "*.bak" -delete
 find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
-find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type d -name "\.bin" -print0 | xargs -0 rm -rf
-find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type d -name "\.github" -print0 | xargs -0 rm -rf
-
-rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/ajv/scripts/
-rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/dashdash/etc/
-rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/performance-now/test/
-
-rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/src/get-options.sh
-
-# dangling symlinks
-rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/fuzzy-search
-rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/node-fetch
-rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/turndown
-rm %{buildroot}%{nodejs_sitelib}/%{pkg_name}/server/node_modules/@types/urijs
 
 %fdupes %{buildroot}%{nodejs_sitelib}/%{pkg_name}
 
 %files
-%license LICENSE bash-language-server-bundled-licenses.txt
+%license LICENSE
 %doc README.md
 %{_bindir}/%{pkg_name}
+%dir %{nodejs_sitelib}
 %{nodejs_sitelib}/%{pkg_name}/
 
 %changelog
-%autochangelog
+* Fri Aug 19 2022 Pavel Filipenský <pfilipen@redhat.com> - 3.0.5-1
+- Update to version 3.0.5
+  * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md
+- Linting based on shellcheck
+- Update bashls-fix-CVE-2022-0613.patch with content of https://patch-diff.githubusercontent.com/raw/bash-lsp/bash-language-server/pull/489.patch
+
+* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-3
+- resolves: #2055544 - Fix CVE-2022-0613
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Aug 26 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-1
+- Update to version 2.0.0
+  * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md
+- Fixed indentation for node shebang loop
+
+* Thu Aug 05 2021 Andreas Schneider <asn@redhat.com> - 1.17.0-1
+- Initial package

prepare_vendor.sh

@@ -1,23 +1,22 @@
 #!/bin/bash
-# shellcheck disable=2181
 
-BASHLS_URL="$(rpmspec -P ./*.spec | grep Source0 | sed -e 's/Source0:[ ]*//g')"
+BASHLS_URL=$(rpmspec -P *.spec | grep Source0 | sed -e 's/Source0:[ ]*//g')
-BASHLS_TARBALL="$(basename "${BASHLS_URL}")"
+BASHLS_TARBALL=$(basename $BASHLS_URL)
-BASHLS_PKGVERSION="$(rpmspec -P ./*.spec | grep ^Version | sed -e 's/Version:[ ]*//g')"
+BASHLS_PKGVERSION=$(rpmspec -P *.spec | grep ^Version | sed -e 's/Version:[ ]*//g')
 BASHLS_PKGNAME="bash-language-server"
 BASHLS_PKGDIR="$(pwd)"
-BASHLS_TMPDIR="$(mktemp --tmpdir -d bashls-XXXXXXXX)"
+BASHLS_TMPDIR=$(mktemp --tmpdir -d bashls-XXXXXXXX)
-BASHLS_PATH="${BASHLS_TMPDIR}/${BASHLS_PKGNAME}-server-${BASHLS_PKGVERSION}"
+BASHLS_PATH="$BASHLS_TMPDIR/$BASHLS_PKGNAME-server-$BASHLS_PKGVERSION"
 
-echo "URL:     ${BASHLS_URL}"
+echo "URL:     $BASHLS_URL"
-echo "TARBALL: ${BASHLS_TARBALL}"
+echo "TARBALL: $BASHLS_TARBALL"
-echo "NAME:    ${BASHLS_PKGNAME}"
+echo "NAME:    $BASHLS_PKGNAME"
-echo "VERSION: ${BASHLS_PKGVERSION}"
+echo "VERSION: $BASHLS_PKGVERSION"
-echo "PATH:    ${BASHLS_PATH}"
+echo "PATH:    $BASHLS_PATH"
 
 cleanup_tmpdir() {
-    popd 2>/dev/null || true
+    popd 2>/dev/null
-    rm -rf "${BASHLS_TMPDIR}"
+    rm -rf $BASHLS_TMPDIR
 }
 trap cleanup_tmpdir SIGINT
 
@@ -30,56 +29,59 @@ cleanup_and_exit() {
     fi
 }
 
-if [ ! -w "${BASHLS_TARBALL}" ]; then
+if [ ! -w "$BASHLS_TARBALL" ]; then
     wget "$BASHLS_URL"
 fi
 
 
-tar -xf "${BASHLS_TARBALL}" -C "${BASHLS_TMPDIR}"
+tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR
 
 
-pushd "${BASHLS_PATH}" || cleanup_and_exit 1
+pushd $BASHLS_PATH || cleanup_and_exit 1
 
-PNPM_STORE_DIR="$(pwd)/.pnpm-store"
+# TEMPORARY: Fix CVE-2022-0613
+patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch"
+
+export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 echo ">>>>>> Install npm modules"
-pnpm install --store-dir="${PNPM_STORE_DIR}"
+yarn install --frozen-lockfile
 if [ $? -ne 0 ]; then
     echo "ERROR: yarn install failed"
     cleanup_and_exit 1
 fi
 
 echo ">>>>>> Cleanup object dirs"
-find "${PNPM_STORE_DIR}/" -type d -name "__pycache__" -print0 | xargs -0 rm -rf
+find ${YARN_CACHE_FOLDER}/ -type d -name "*.o.d" | xargs rm -rf
-find "${PNPM_STORE_DIR}/" -type d -name "*.o.d" -print0 | xargs -0 rm -rf
+find ${YARN_CACHE_FOLDER}/ -type d -name "__pycache__" | xargs rm -rf
 
 
 echo ">>>>>> Cleanup object files"
-find "${PNPM_STORE_DIR}/" -name "*.node" -print0 | xargs -0 rm -rf
+find ${YARN_CACHE_FOLDER}/ -name "*.node" | xargs rm -rf
 
-find "${PNPM_STORE_DIR}/" -name "*.dll" | grep -v signal-client | xargs rm -f
+find ${YARN_CACHE_FOLDER}/ -name "*.dll" | grep -v signal-client | xargs rm -f
-find "${PNPM_STORE_DIR}/" -name "*.dylib" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.dylib" -delete
-find "${PNPM_STORE_DIR}/" -name "*.so" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.so" -delete
-find "${PNPM_STORE_DIR}/" -name "*.o" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.o" -delete
-find "${PNPM_STORE_DIR}/" -name "*.a" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.a" -delete
-find "${PNPM_STORE_DIR}/" -name "*.snyk-*.flag" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.snyk-*.flag" -delete
-find "${PNPM_STORE_DIR}/" -name "builderror.log" -delete
+find ${YARN_CACHE_FOLDER}/ -name "builderror.log" -delete
-find "${PNPM_STORE_DIR}/" -name ".deps" -type d -print0 | xargs -0 rm -rf
+find ${YARN_CACHE_FOLDER}/ -name ".deps" -type d | xargs rm -rf
 
 
 echo ">>>>>> Cleanup build info"
-find "${PNPM_STORE_DIR}/" -name "Makefile" -delete
+find ${YARN_CACHE_FOLDER}/ -name "Makefile" -delete
-find "${PNPM_STORE_DIR}/" -name "*.target.mk" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.target.mk" -delete
-find "${PNPM_STORE_DIR}/" -name "config.gypi" -delete
+find ${YARN_CACHE_FOLDER}/ -name "config.gypi" -delete
-find "${PNPM_STORE_DIR}/" -name "package.json" -exec sed -i "s#${BASHLS_PATH}#/tmp#g" {} \;
+find ${YARN_CACHE_FOLDER}/ -name "package.json" -exec sed -i "s#$BASHLS_PATH#/tmp#g" {} \;
 
 
 echo ">>>>>> Package vendor files"
-rm -f "${BASHLS_PKGDIR}/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.zst"
+rm -f $BASHLS_PKGDIR/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.xz
-XZ_OPT="-T$(nproc)" tar --zstd -cf "${BASHLS_PKGDIR}/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.zst" .pnpm-store
+XZ_OPT="-T$(nproc)" tar cJf $BASHLS_PKGDIR/${BASHLS_PKGNAME}-${BASHLS_PKGVERSION}-vendor.tar.xz .package-cache
 if [ $? -ne 0 ]; then
     cleanup_and_exit 1
 fi
 
-popd || cleanup_and_exit 1
+popd
 
 cleanup_and_exit 0

sources

@@ -1,2 +1,2 @@
-SHA512 (bash-language-server-5.6.0.tar.gz) = 0c99d34ca0e92a4e5719e8c8ca99faad5effe5d6d45f72cdaa05f70df521cf0830e3f81acf700d172496afa721881c2f1df4faf280e897809ce55757d5039796
+SHA512 (bash-language-server-3.0.5.tar.gz) = fc0a92b905efcec22f4a7c7ee2f1318d56b2392851bffff67451d084ac784363c16cbef19fd17ffd5f54fb11d254a99f7ca3e62ff73ae98cb15d37b6b17325ed
-SHA512 (bash-language-server-5.6.0-vendor.tar.zst) = ea90b1ea6fd23bbd18ff1346f3b22813a0c5a38c0f3c36b58dbebe64d2dd1f449ae9e1ea5ca516124d8a7bf7f327d2062cbf7fb17ccdf424489a29eb14a71560
+SHA512 (bash-language-server-3.0.5-vendor.tar.xz) = 2017892eed1f0fab6ac1af110dc38ee995915f627c1e01a5f9f61be3ede90281172da041be3dd7131452234580119ba1d6545f828539e59411b80bb2a010343d