@@ -1,6 +1,6 @@
11{ lib, stdenv, fetchFromGitHub, buildGoModule, makeWrapper, runCommand
2−, moreutils, jq, git, zip, rsync, pkg-config, yarn, python3
3−, nodejs-14_x, libsecret, xorg, ripgrep
2+, moreutils, jq, git, cacert, zip, rsync, pkg-config, yarn, python3
3+, esbuild, nodejs-14_x, libsecret, xorg, ripgrep
44, AppKit, Cocoa, Security, cctools }:
55
66let
@@ -13,25 +13,25 @@ let
1313
1414in stdenv.mkDerivation rec {
1515 pname = "code-server";
16− version = "3.9.0";
17− commit = "fc6d123da59a4e5a675ac8e080f66e032ba01a1b";
16+ version = "3.12.0";
17+ commit = "798dc0baf284416dbbf951e4ef596beeab6cb6c4";
1818
1919 src = fetchFromGitHub {
2020 owner = "cdr";
2121 repo = "code-server";
2222 rev = "v${version}";
23− sha256 = "0jgmf8d7hki1iv6yy1z0s5qjyxchxnwj8kv53jrwkllim08swbi3";
23+ sha256 = "17v3sz0wjrmikmzyh9xswr4kf1vcj9njlibqb4wwj0pq0d72wdvl";
2424 };
2525
2626 cloudAgent = buildGoModule rec {
2727 pname = "cloud-agent";
28− version = "0.2.1";
28+ version = "0.2.3";
2929
3030 src = fetchFromGitHub {
3131 owner = "cdr";
3232 repo = "cloud-agent";
3333 rev = "v${version}";
34− sha256 = "06fpiwxjz2cgzw4ks9sk3376rprkd02khfnb10hg7dhn3y9gp7x8";
34+ sha256 = "14i1qq273f0yn5v52ryiqwj7izkd1yd212di4gh4bqypmmzhw3jj";
3535 };
3636
3737 vendorSha256 = "0k9v10wkzx53r5syf6bmm81gr4s5dalyaa07y9zvx6vv5r2h0661";
@@ -46,9 +46,12 @@ in stdenv.mkDerivation rec {
4646 yarnCache = stdenv.mkDerivation {
4747 name = "${pname}-${version}-${system}-yarn-cache";
4848 inherit src;
49− nativeBuildInputs = [ yarn' git ];
49+ nativeBuildInputs = [ yarn' git cacert ];
5050 buildPhase = ''
5151 export HOME=$PWD
52+ export GIT_SSL_CAINFO="${cacert}/etc/ssl/certs/ca-bundle.crt"
53+
54+ yarn --cwd "./vendor" install --modules-folder modules --ignore-scripts --frozen-lockfile
5255
5356 yarn config set yarn-offline-mirror $out
5457 find "$PWD" -name "yarn.lock" -printf "%h\n" | \
@@ -61,9 +64,9 @@ in stdenv.mkDerivation rec {
6164
6265 # to get hash values use nix-build -A code-server.prefetchYarnCache
6366 outputHash = {
64− x86_64-linux = "01nkqcfvx2qw9g60h8k9x221ibv3j58vdkjzcjnj7ph54a33ifih";
65− aarch64-linux = "01nkqcfvx2qw9g60h8k9x221ibv3j58vdkjzcjnj7ph54a33ifih";
66− x86_64-darwin = "01nkqcfvx2qw9g60h8k9x221ibv3j58vdkjzcjnj7ph54a33ifih";
67+ x86_64-linux = "1clfdl9hy5j2dj6jj6a9vgq0wzllfj0h2hbb73959k3w85y4ad2w";
68+ aarch64-linux = "1clfdl9hy5j2dj6jj6a9vgq0wzllfj0h2hbb73959k3w85y4ad2w";
69+ x86_64-darwin = "1clfdl9hy5j2dj6jj6a9vgq0wzllfj0h2hbb73959k3w85y4ad2w";
6770 }.${system} or (throw "Unsupported system ${system}");
6871 };
6972
@@ -93,38 +96,9 @@ in stdenv.mkDerivation rec {
9396
9497 patchShebangs ./ci
9598
96− # remove unnecessary git config command
97− substituteInPlace lib/vscode/build/npm/postinstall.js \
98− --replace "cp.execSync('git config pull.rebase true');" ""
99−
100− # allow offline install for postinstall scripts in extensions
101− grep -rl "yarn install" --include package.json lib/vscode/extensions \
102− | xargs sed -i 's/yarn install/yarn install --offline/g'
103−
104− substituteInPlace ci/dev/postinstall.sh \
105− --replace 'yarn' 'yarn --ignore-scripts'
106−
107− # use offline cache when installing release packages
108− substituteInPlace ci/build/npm-postinstall.sh \
109− --replace 'yarn --production' 'yarn --production --offline'
110−
111− # disable automatic updates
112− sed -i '/update.mode/,/\}/{s/default:.*/default: "none",/g}' \
113− lib/vscode/src/vs/platform/update/common/update.config.contribution.ts
114−
11599 # inject git commit
116100 substituteInPlace ci/build/build-release.sh \
117101 --replace '$(git rev-parse HEAD)' "$commit"
118−
119− # remove all built-in extensions, as these are 3rd party extensions that
120− # gets downloaded from vscode marketplace
121− jq --slurp '.[0] * .[1]' "lib/vscode/product.json" <(
122− cat << EOF
123− {
124− "builtInExtensions": []
125− }
126− EOF
127− ) | sponge lib/vscode/product.json
128102 '';
129103
130104 configurePhase = ''
@@ -140,6 +114,7 @@ in stdenv.mkDerivation rec {
140114 yarn --offline config set yarn-offline-mirror "${yarnCache}"
141115
142116 # link coder-cloud agent from nix store
117+ mkdir -p lib
143118 ln -s "${cloudAgent}/bin/cloud-agent" ./lib/coder-cloud-agent
144119
145120 # skip unnecessary electron download
@@ -151,40 +126,80 @@ in stdenv.mkDerivation rec {
151126
152127 buildPhase = ''
153128 # install code-server dependencies
154− yarn --offline
129+ yarn --offline --ignore-scripts
155130
156− # install vscode dependencies without running script for all vscode packages
157− # that require patching for postinstall scripts to succeed
158− for d in lib/vscode lib/vscode/build; do
159− yarn --offline --cwd $d --offline --ignore-scripts
160− done
131+ # patch shebangs of everything to allow binary packages to build
132+ patchShebangs .
133+
134+ # Skip shellcheck download
135+ jq "del(.scripts.preinstall)" node_modules/shellcheck/package.json | sponge node_modules/shellcheck/package.json
136+
137+ # rebuild binary packages now that scripts have been patched
138+ npm rebuild
139+
140+ # Replicate ci/dev/postinstall.sh
141+ echo "----- Replicate ci/dev/postinstall.sh"
142+ yarn --cwd "./vendor" install --modules-folder modules --offline --ignore-scripts --frozen-lockfile
143+
144+ # Replicate vendor/postinstall.sh
145+ echo " ----- Replicate vendor/postinstall.sh"
146+ yarn --cwd "./vendor/modules/code-oss-dev" --offline --frozen-lockfile --ignore-scripts install
147+
148+ # remove all built-in extensions, as these are 3rd party extensions that
149+ # get downloaded from vscode marketplace
150+ jq --slurp '.[0] * .[1]' "vendor/modules/code-oss-dev/product.json" <(
151+ cat << EOF
152+ {
153+ "builtInExtensions": []
154+ }
155+ EOF
156+ ) | sponge vendor/modules/code-oss-dev/product.json
157+
158+ # disable automatic updates
159+ sed -i '/update.mode/,/\}/{s/default:.*/default: "none",/g}' \
160+ vendor/modules/code-oss-dev/src/vs/platform/update/common/update.config.contribution.ts
161161
162162 # put ripgrep binary into bin, so postinstall does not try to download it
163163 find -name vscode-ripgrep -type d \
164164 -execdir mkdir -p {}/bin \; \
165165 -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
166166
167− # patch shebangs of everything, also cached files, as otherwise postinstall
168− # will not be able to find /usr/bin/env, as it does not exist in sandbox
169− patchShebangs .
170−
171167 # Playwright is only needed for tests, we can disable it for builds.
172168 # There's an environment variable to disable downloads, but the package makes a breaking call to
173169 # sw_vers before that variable is checked.
174170 patch -p1 -i ${./playwright.patch}
175− '' + lib.optionalString stdenv.isDarwin ''
176− # fsevents build fails on Darwin. It's an optional package that's only installed as part of Darwin
177− # builds, so the patch will fail if run on non-Darwin systems.
178− patch -p1 -i ${./darwin-fsevents.patch}
179− '' + ''
171+
172+ # Replicate install vscode dependencies without running script for all vscode packages
173+ # that require patching for postinstall scripts to succeed
174+ find ./vendor/modules/code-oss-dev -path "*node_modules" -prune -o \
175+ -path "./*/*/*/*/*" -name "yarn.lock" -printf "%h\n" | \
176+ xargs -I {} yarn --cwd {} \
177+ --frozen-lockfile --offline --ignore-scripts --ignore-engines
178+
179+ # patch shebangs of everything to allow binary packages to build
180+ patchShebangs .
181+
182+ # patch build esbuild
183+ mkdir -p vendor/modules/code-oss-dev/build/node_modules/esbuild/bin
184+ jq "del(.scripts.postinstall)" vendor/modules/code-oss-dev/build/node_modules/esbuild/package.json | sponge vendor/modules/code-oss-dev/build/node_modules/esbuild/package.json
185+ sed -i 's/0.12.6/${esbuild.version}/g' vendor/modules/code-oss-dev/build/node_modules/esbuild/lib/main.js
186+ ln -s -f ${esbuild}/bin/esbuild vendor/modules/code-oss-dev/build/node_modules/esbuild/bin/esbuild
187+
188+ # patch extensions esbuild
189+ mkdir -p vendor/modules/code-oss-dev/extensions/node_modules/esbuild/bin
190+ jq "del(.scripts.postinstall)" vendor/modules/code-oss-dev/extensions/node_modules/esbuild/package.json | sponge vendor/modules/code-oss-dev/extensions/node_modules/esbuild/package.json
191+ sed -i 's/0.11.12/${esbuild.version}/g' vendor/modules/code-oss-dev/extensions/node_modules/esbuild/lib/main.js
192+ ln -s -f ${esbuild}/bin/esbuild vendor/modules/code-oss-dev/extensions/node_modules/esbuild/bin/esbuild
193+
180194 # rebuild binaries, we use npm here, as yarn does not provide an alternative
181195 # that would not attempt to try to reinstall everything and break our
182196 # patching attempts
183− npm rebuild --prefix lib/vscode --update-binary
197+ npm rebuild --prefix vendor/modules/code-oss-dev --update-binary
184198
185− # run postinstall scripts, which eventually do yarn install on all
186− # additional requirements
187− yarn --cwd lib/vscode postinstall --frozen-lockfile --offline
199+ # run postinstall scripts after patching
200+ find ./vendor/modules/code-oss-dev -path "*node_modules" -prune -o \
201+ -path "./*/*/*/*/*" -name "yarn.lock" -printf "%h\n" | \
202+ xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
188203
189204 # build code-server
190205 yarn build
@@ -206,6 +221,7 @@ in stdenv.mkDerivation rec {
206221 yarn --offline --cwd "$out/libexec/code-server" --production
207222
208223 # link coder-cloud agent from nix store
224+ mkdir -p $out/libexec/code-server/lib
209225 ln -s "${cloudAgent}/bin/cloud-agent" $out/libexec/code-server/lib/coder-cloud-agent
210226
211227 # create wrapper