Patch-only build and multi-platform packaging for
MongoDB Shell. It follows the newest
commit of upstream main, applies checksum-verified patches from dist/, builds
one architecture-independent production bundle, and combines it with the
matching ready-made Node.js runtime from
wekan/node-patches releases.
Node.js and V8 are never rebuilt here.
Bundle builds use Node.js 26 and npm 12.0.2. Packages accept only a published
Node.js 26.x release from node-patches, with a matching binary and checksum.
dist/all/remove-telemetry.patch applies to every target. It removes the HTTP
telemetry client, event collectors, queues, throttle persistence, machine/OS
fingerprinting and agent detection. Telemetry configuration cannot enable them.
The historical enableTelemetry() and disableTelemetry() commands remain
inert and report that telemetry has been removed. Automatic upstream update and
marketing requests are removed too.
Source preparation and building check an inventory of reviewed source and dependency hashes. A changed hash is reported, not fatal: upstream changes every day. What stops the build is new evidence of reporting - a new URL literal, a suspicious keyword or a known telemetry hash - wherever it appears, under any name (see the best-effort policy in the audit). The bundle builder runs network-guarded CLI smoke tests; building and packaging scan the artifact for removed telemetry implementations. See the audit and review procedure.
Normal diagnostic logs, shell history, database/authentication traffic and snippet
downloads remain. Snippet-index retrieval can happen at interactive startup;
snippetIndexSourceURLs: "" disables that feature. Remaining shell HTTP requests
have no device ID or OS fingerprint in the added User-Agent.
The same patch also fixes mongosh's config/history file handling in a
container that runs as a user with no home directory entry: os.homedir()
then resolves to an unwritable path like /nonexistent, which previously
produced a startup EACCES ... mkdir '/nonexistent' warning and a "Could
not open history file" error on every session. Config/log/history storage
now falls back to a writable directory under the OS temp dir when the home
directory is not writable.
Each build resolves upstream main once, fetches that exact full commit, and
names the release/tag main-<12-character-hash> (for example,
main-79267331504d). A mongosh-source.json records the full SHA in the release
and inside every package. The executable reports the upstream semantic version
with -main.<hash> appended, such as 2.10.0-main.79267331504d.
Release All Missing accepts the existing main-HASH name and rebuilds that exact
source even after upstream main advances; it never silently switches commits.
Release assets are mongosh-<target>.tgz or .zip, each with a
.sha256sum. The target registry includes: amd64, arm64, armhf, armv6, armv7, i386, ppc64le,
s390x, riscv64, loong64, win64, win-arm64, win32, mac-amd64,
mac-arm64 and freebsd-x64.
Both workflows and build.sh all intersect this registry with the runtime AND
checksum assets in one selected node-patches release before scheduling packages.
Unavailable targets are reported in the job log and workflow summary; they are
not built or published. Release All Missing checks them again on its next run.
No older runtime, differently named architecture, or unverified binary is used as
a fallback. Since node-patches v26.12.0 publishes all sixteen runtimes, every
target is built; main-e9818a9250ab carries all sixteen packages.
./build.sh bundle
./build.sh arm64
./build.sh all
./tests/workflow-logic.shThe repository build files are MIT licensed. Upstream mongosh and its bundled
notices retain their own Apache-2.0 and dependency licenses in release packages.
Maintainer/contributor and never-push rules come from WeKan's root AGENTS.md.