Repository navigation
Expand file tree
/
Copy pathbuild.ncl
More file actions
81 lines (71 loc) · 2.55 KB
/
Copy pathbuild.ncl
File metadata and controls
81 lines (71 loc) · 2.55 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
let { standaloneTest, subsetOf, BuildSpec, Local, OutputBin, Source, Test, .. } = import "minimal.ncl" in
let base = import "../base/build.ncl" in
let bash-bootstrap = import "../bash-bootstrap/build.ncl" in
let patch = import "../patch/build.ncl" in
let make = import "../make/build.ncl" in
let rust = import "../rust/build.ncl" in
let toolchain = import "../toolchain/build.ncl" in
let gcc = import "../gcc/build.ncl" in
let glibc = import "../glibc/build.ncl" in
let version = "2.6.7" in
{
name = "biome",
build_deps = [
{ file = "build.sh" } | Local,
# CVE-2026-111943 (eMudhra intermediate key compromise): upstream 2.6.2's
# Cargo.lock already has rustls-webpki 0.103.16 and webpki-roots 1.0.10; this
# moves the one crate still below the floor, webpki-root-certs 1.0.9 -> 1.0.10
# (RUSTSEC-2026-0383). Generated by `cargo update -p webpki-root-certs@1.0.9
# --precise 1.0.10` on the pristine source and checked with `cargo metadata
# --locked`. Drop on the first release whose lock has webpki-root-certs 1.0.10.
{ file = "cve-2026-111943-webpki-lock.patch" } | Local,
{
url = "https://github.com/biomejs/biome/archive/refs/tags/@biomejs/biome@%{version}.tar.gz",
sha256 = "4a17edfe38a4437040d1f12ebd41a78bebec056522351c446c451b856b7e9cf4",
extract = true,
strip_prefix = "biome--biomejs-biome-%{version}",
} | Source,
base,
patch,
make,
rust,
toolchain,
],
runtime_deps = [
glibc,
subsetOf gcc ["libgcc"],
],
cmd = "./build.sh",
build_args = { include version },
outputs = {
bins = { glob = "usr/bin/biome" } | OutputBin,
},
needs = {
internet = {},
},
attrs = {
upstream_version = version,
license_spdx = "MIT OR Apache-2.0",
source_provenance = {
category = 'GithubRepo,
owner = "biomejs",
repo = "biome",
},
},
tests = {
smoketest = standaloneTest "/usr/bin/biome --version",
# Regression test for gominimal/pkgs#637. biome_cli's Cargo version is
# literally "0.0.0" — upstream stamps the real one through BIOME_VERSION at
# compile time — so an unstamped build reports 0.0.0 and biome then warns
# that every `$schema` in a config "does not match the CLI version". Assert
# the exact string: a substring match would still pass on "0.0.0".
version_is_stamped =
{
class = 'Standalone,
test_deps = [bash-bootstrap],
cmds = [
["/bin/bash", "-c", "test \"$(/usr/bin/biome --version)\" = 'Version: %{version}'"],
],
} | Test,
},
} | BuildSpec