Skip to contentSkip to conversation

package/forge: new package

PATCH Superseded Johan Oudinet 4 participants 10 messages Mar 22, 2022 – Sep 24, 2022

lore
Share & tools
lore

Johan Oudinet

author
#0 lore raw

PATCH 1/1 package/forge: new package

A native implementation of TLS (and various other cryptographic tools) in JavaScript.

Signed-off-by Johan Oudinet <[email protected]>
---
 DEVELOPERS               |  1 +
 package/Config.in        |  1 +
 package/forge/Config.in  |  7 +++++++
 package/forge/forge.hash |  3 +++
 package/forge/forge.mk   | 23 +++++++++++++++++++++++
 5 files changed, 35 insertions(+)
 create mode 100644 package/forge/Config.in
 create mode 100644 package/forge/forge.hash
 create mode 100644 package/forge/forge.mk
DEVELOPERS +1 -0
index 942bb8fe9c..5830b45018 100644
@@ -1475,6 +1475,7 @@ F:	package/erlang-p1-xmpp/
 F:	package/erlang-p1-yaml/
 F:	package/erlang-p1-yconf/
 F:	package/erlang-p1-zlib/
+F:	package/forge/
 F:	package/nginx-dav-ext/
 F:	package/vuejs/
package/Config.in +1 -0
index 0d5d763180..f2587b5c66 100644
@@ -1653,6 +1653,7 @@ endif
 	source "package/duktape/Config.in"
 	source "package/explorercanvas/Config.in"
 	source "package/flot/Config.in"
+	source "package/forge/Config.in"
 	source "package/jquery/Config.in"
 if BR2_PACKAGE_JQUERY
 menu "External jQuery plugins"
package/forge/Config.in new file +7 -0
new file mode 100644
index 0000000000..86d4832101
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_FORGE
+	bool "forge"
+	help
+	  A native implementation of TLS (and various other
+	  cryptographic tools) in JavaScript.
+
+	  https://github.com/digitalbazaar/forge
package/forge/forge.hash new file +3 -0
new file mode 100644
index 0000000000..256ac5b451
@@ -0,0 +1,3 @@
+# Locally computed
+sha256  97f0276c32b39411ad85c5762bf546ca281451eeaa93bdd383ff082e8e0181b4  node-forge-1.3.0.tgz
+sha256  f63ff0e4e239244aa79280da2dd4811a0469e5e201caf5cbc0d97c3a1dff8e82  LICENSE
package/forge/forge.mk new file +23 -0
new file mode 100644
index 0000000000..1872cb4e70
@@ -0,0 +1,23 @@
+################################################################################
+#
+# forge
+#
+################################################################################
+
+FORGE_VERSION = 1.3.0
+FORGE_SOURCE = node-forge-$(FORGE_VERSION).tgz
+FORGE_SITE = https://registry.npmjs.org/node-forge/-
+FORGE_LICENSE = BSD-3-Clause, GPL-2.0
+FORGE_LICENSE_FILES = LICENSE
+
+# Install .min.js as .js
+define FORGE_INSTALL_TARGET_CMDS
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.all.min.js \
+		$(TARGET_DIR)/var/www/forge.all.js
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.min.js \
+		$(TARGET_DIR)/var/www/forge.js
+	$(INSTALL) -m 644 -D $(@D)/dist/prime.worker.min.js \
+		$(TARGET_DIR)/var/www/prime.worker.js
+endef
+
+$(eval $(generic-package))
Signature · 6 lines
2.32.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#1 lore raw

Johan, All,

Sorry for the late review...

On 2022-03-22 17:07 +0100, Johan Oudinet spake thusly:

Quoted 2 lines

A native implementation of TLS (and various other cryptographic tools) in JavaScript.

I see that you used the npm registry as the source for this package. So, I'd expect it to be an nodejs package, right? If so, then it should probably depend on nodejs being enabled.

Also, why do we need to get the package from the npm registry, instead of from the upstream git tree?

Quoted 1 line
Signed-off-by Johan Oudinet <[email protected]>

[--SNIP--]

package/forge/Config.in line 2

Quoted 8 lines
package/forge/Config.in new file +2 -0
new file mode 100644
index 0000000000..86d4832101
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_FORGE
+	bool "forge"

Here, I would have expected:

depends on BR2_PACKAGE_NODEJS

package/forge/Config.in line 7

Quoted 5 lines
package/forge/Config.in new file +5 -0
+	help
+	  A native implementation of TLS (and various other
+	  cryptographic tools) in JavaScript.
+
+	  https://github.com/digitalbazaar/forge

[--SNIP--]

Quoted 17 lines
package/forge/forge.mk new file +11 -0
new file mode 100644
index 0000000000..1872cb4e70
@@ -0,0 +1,23 @@
+################################################################################
+#
+# forge
+#
+################################################################################
+
+FORGE_VERSION = 1.3.0
+FORGE_SOURCE = node-forge-$(FORGE_VERSION).tgz
+FORGE_SITE = https://registry.npmjs.org/node-forge/-
+FORGE_LICENSE = BSD-3-Clause, GPL-2.0
+FORGE_LICENSE_FILES = LICENSE

package/forge/forge.mk line 21

Quoted 10 lines
package/forge/forge.mk new file +10 -0
+
+# Install .min.js as .js
+define FORGE_INSTALL_TARGET_CMDS
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.all.min.js \
+		$(TARGET_DIR)/var/www/forge.all.js
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.min.js \
+		$(TARGET_DIR)/var/www/forge.js
+	$(INSTALL) -m 644 -D $(@D)/dist/prime.worker.min.js \
+		$(TARGET_DIR)/var/www/prime.worker.js
+endef

So, I think I now see why you grabbed the package from the npm registry:
the package has been built and the minified files generated.

I'm afraid that I do not like that very much.

Instead, you should grab the sources from th github repo, have the package depend on host-nodejes, and build the pacakge with $(NPM) build.

Regards,
Yann E. MORIN.

Quoted 8 lines
package/forge/forge.mk new file +1 -0
+$(eval $(generic-package))
Signature · 6 lines
2.32.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
author
#2 lore raw

Hi Yann, All,

Quoted 7 lines · Yann E. MORIN

I see that you used the npm registry as the source for this package. So, I'd expect it to be an nodejs package, right? If so, then it should probably depend on nodejs being enabled.

Here, I would have expected:

depends on BR2_PACKAGE_NODEJS

No, it is not a nodejs package. It also works on the browser, so it does not depend on having nodejs in the target.

Quoted 8 lines

So, I think I now see why you grabbed the package from the npm registry:
the package has been built and the minified files generated.

I'm afraid that I do not like that very much.

Instead, you should grab the sources from th github repo, have the package depend on host-nodejes, and build the pacakge with $(NPM) build.

Thanks for the suggestion. I didn't know we could do that in recent versions of buildroot.
It is indeed a much cleaner way to handle npm packages, even though I don't like the BUILD commands to download the dependencies. I've uploaded a new version with your suggestions.

Best regards,

Signature · 5 lines
Johan
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#3 lore raw

Johan, All,

On 2022-08-26 16:11 +0200, Johan Oudinet spake thusly:

Quoted 8 lines · Yann E. MORIN
Quoted 2 lines

Instead, you should grab the sources from th github repo, have the package depend on host-nodejes, and build the pacakge with $(NPM) build.

Thanks for the suggestion. I didn't know we could do that in recent versions of buildroot.
It is indeed a much cleaner way to handle npm packages, even though I don't like the BUILD commands to download the dependencies.

Yeah, this is indeed not nice, but there is nt much we can do for now.

If we get a good nderstanding of how npm-based pacages work, then we can look into introducing a download post-processing script, like we have for go and cargo, where the vendoring is done as part of the download step.

But I don't think I could spot a similar (mis)feature in npm...

Regards,
Yann E. MORIN.

Quoted 9 lines

I've uploaded a new version with your suggestions.

Best regards,

Signature · 5 lines
Johan
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
author
#4 lore raw

PATCH v2 1/1 package/forge: new package

In reply to Johan Oudinet

A native implementation of TLS (and various other cryptographic tools) in JavaScript.

Signed-off-by Johan Oudinet <[email protected]>

---
Changes v1 -> v2:
- build with npm (suggested by Yann E. Morin)

---
 DEVELOPERS               |  1 +
 package/Config.in        |  1 +
 package/forge/Config.in  | 10 ++++++++++
 package/forge/forge.hash |  3 +++
 package/forge/forge.mk   | 28 ++++++++++++++++++++++++++++
 5 files changed, 43 insertions(+)
 create mode 100644 package/forge/Config.in
 create mode 100644 package/forge/forge.hash
 create mode 100644 package/forge/forge.mk
DEVELOPERS +1 -0
index d2bd0d809a..c7e6407cdc 100644
@@ -1530,6 +1530,7 @@ F:	package/erlang-p1-xmpp/
 F:	package/erlang-p1-yaml/
 F:	package/erlang-p1-yconf/
 F:	package/erlang-p1-zlib/
+F:	package/forge/
 F:	package/nginx-dav-ext/
 F:	package/vis-network/
 F:	package/vuejs/
package/Config.in +1 -0
index d1c098c48f..c073c82611 100644
@@ -1687,6 +1687,7 @@ endif
 	source "package/duktape/Config.in"
 	source "package/explorercanvas/Config.in"
 	source "package/flot/Config.in"
+	source "package/forge/Config.in"
 	source "package/jquery/Config.in"
 if BR2_PACKAGE_JQUERY
 menu "External jQuery plugins"
package/forge/Config.in new file +10 -0
new file mode 100644
index 0000000000..87a3fcb3e0
@@ -0,0 +1,10 @@
+config BR2_PACKAGE_FORGE
+	bool "forge"
+	depends on BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS # host-nodejs
+	depends on BR2_HOST_GCC_AT_LEAST_8 # host-nodejs
+	select BR2_PACKAGE_HOST_NODEJS
+	help
+	  A native implementation of TLS (and various other
+	  cryptographic tools) in JavaScript.
+
+	  https://github.com/digitalbazaar/forge
package/forge/forge.hash new file +3 -0
new file mode 100644
index 0000000000..3f73d3e050
@@ -0,0 +1,3 @@
+# Locally computed
+sha256  b330b05ef109a00fc96ae188a3a9ac6c9053a511957a5c9534f7635fefee45a2  forge-1.3.1.tar.gz
+sha256  f63ff0e4e239244aa79280da2dd4811a0469e5e201caf5cbc0d97c3a1dff8e82  LICENSE
package/forge/forge.mk new file +28 -0
new file mode 100644
index 0000000000..c26f550c83
@@ -0,0 +1,28 @@
+################################################################################
+#
+# forge
+#
+################################################################################
+
+FORGE_VERSION = 1.3.1
+FORGE_SITE = $(call github,digitalbazaar,forge,v$(FORGE_VERSION))
+FORGE_LICENSE = BSD-3-Clause, GPL-2.0
+FORGE_LICENSE_FILES = LICENSE
+
+FORGE_DEPENDENCIES = host-nodejs
+
+define FORGE_BUILD_CMDS
+	cd $(@D) && $(NPM) install && $(NPM) run build
+endef
+
+# Install .min.js as .js
+define FORGE_INSTALL_TARGET_CMDS
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.all.min.js \
+		$(TARGET_DIR)/var/www/forge.all.js
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.min.js \
+		$(TARGET_DIR)/var/www/forge.js
+	$(INSTALL) -m 644 -D $(@D)/dist/prime.worker.min.js \
+		$(TARGET_DIR)/var/www/prime.worker.js
+endef
+
+$(eval $(generic-package))
Signature · 6 lines
2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#5 lore raw

Johan, All,

On 2022-08-26 15:08 +0200, Johan Oudinet spake thusly:

Quoted 4 lines

A native implementation of TLS (and various other cryptographic tools) in JavaScript.

Signed-off-by Johan Oudinet <[email protected]>

[--SNIP--]

Quoted 11 lines
package/forge/forge.mk new file +5 -0
new file mode 100644
index 0000000000..c26f550c83
@@ -0,0 +1,28 @@
+################################################################################
+#
+# forge
+#
+################################################################################

package/forge/forge.mk line 15

Quoted 10 lines
package/forge/forge.mk new file +10 -0
+
+FORGE_VERSION = 1.3.1
+FORGE_SITE = $(call github,digitalbazaar,forge,v$(FORGE_VERSION))
+FORGE_LICENSE = BSD-3-Clause, GPL-2.0
+FORGE_LICENSE_FILES = LICENSE
+
+FORGE_DEPENDENCIES = host-nodejs
+
+define FORGE_BUILD_CMDS
+	cd $(@D) && $(NPM) install && $(NPM) run build

So we have to install before we can build? I would have expected the other way around... I have (almost) zero experience with npm, so I am not sure about the semantics of 'install' vs. 'build'.

Also, where does 'install' installs things?

Regards,
Yann E. MORIN.

Quoted 20 lines
package/forge/forge.mk new file +13 -0
+endef
+
+# Install .min.js as .js
+define FORGE_INSTALL_TARGET_CMDS
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.all.min.js \
+		$(TARGET_DIR)/var/www/forge.all.js
+	$(INSTALL) -m 644 -D $(@D)/dist/forge.min.js \
+		$(TARGET_DIR)/var/www/forge.js
+	$(INSTALL) -m 644 -D $(@D)/dist/prime.worker.min.js \
+		$(TARGET_DIR)/var/www/prime.worker.js
+endef
+
+$(eval $(generic-package))
Signature · 6 lines
2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#6 lore raw

Hello,

Quoted 14 lines · On Sat, 27 Aug 2022 10:47:32 +0200 "Yann E. MORIN" <[email protected]>…

package/forge/forge.mk line 15

Quoted 9 lines
package/forge/forge.mk new file +9 -0
+FORGE_VERSION = 1.3.1
+FORGE_SITE = $(call github,digitalbazaar,forge,v$(FORGE_VERSION))
+FORGE_LICENSE = BSD-3-Clause, GPL-2.0
+FORGE_LICENSE_FILES = LICENSE
+
+FORGE_DEPENDENCIES = host-nodejs
+
+define FORGE_BUILD_CMDS
+	cd $(@D) && $(NPM) install && $(NPM) run build

So we have to install before we can build? I would have expected the other way around... I have (almost) zero experience with npm, so I am not sure about the semantics of 'install' vs. 'build'.

Quoted 1 line

Also, where does 'install' installs things?

And side questions are:

- Does this $(NPM) install step downloads stuff? If it does, then it's wrong, because it works around Buildroot's download infrastructure.

- Does this $(NPM) install step installs extra stuff? If it does, are these extra things accounted for from a legal information perspective?

Yeah, I know, annoying questions :-)

Thanks!

Thomas

Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#7 lore raw

Thomas, All,

On 2022-08-28 10:06 +0200, Thomas Petazzoni spake thusly:

Quoted 2 lines

On Sat, 27 Aug 2022 10:47:32 +0200
"Yann E. MORIN" <[email protected]> wrote:

[--SNIP--]

Quoted 2 lines
Quoted 2 lines

package/forge/forge.mk line 15

Quoted 2 lines
package/forge/forge.mk new file +2 -0
+define FORGE_BUILD_CMDS
+	cd $(@D) && $(NPM) install && $(NPM) run build

[--SNIP--]

Quoted 3 lines

And side questions are:
- Does this $(NPM) install step downloads stuff? If it does, then it's wrong, because it works around Buildroot's download infrastructure.

Yes, as far as I understand, that's where the vendoring step happens. Unless we have a download post-process step like we have for go and cargo, there is not much we can do about that. See also my further reply on the previous iteration [0].

Also that install-then-build sequence seems to be canon, see [1].

But before we introduce either a download prost-process and/or an npm-package infrastructure, it would be better [2] to have more than two data-points.

[0] https://lore.kernel.org/buildroot/20220826210712.GE37358@scaer/
[1] https://lore.kernel.org/buildroot/20220827093603.GT37358@scaer/
[2] I said "better", not "nice", on purpose. ;-]

Quoted 3 lines

- Does this $(NPM) install step installs extra stuff? If it does, are these extra things accounted for from a legal information perspective?

Yeah, it does install the vendored stuff. And of course it is not accounted for, what did you hope? ;-)

So, yes, FORGE_LICENSE should include something like:

, vendored dependencies licenses probably not listed

Quoted 1 line

Yeah, I know, annoying questions :-)

Hehe... :-]

Regards,
Yann E. MORIN.

Signature · 10 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
author
#8 lore raw

Yann, Thomas, All,

Quoted 18 lines · Yann E. MORIN

On 2022-08-28 10:06 +0200, Thomas Petazzoni spake thusly:

Quoted 2 lines

On Sat, 27 Aug 2022 10:47:32 +0200
"Yann E. MORIN" <[email protected]> wrote:

[--SNIP--]

Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

+define FORGE_BUILD_CMDS
+ cd $(@D) && $(NPM) install && $(NPM) run build

[--SNIP--]

Quoted 3 lines

And side questions are:
- Does this $(NPM) install step downloads stuff? If it does, then it's wrong, because it works around Buildroot's download infrastructure.

Yes, as far as I understand, that's where the vendoring step happens. Unless we have a download post-process step like we have for go and cargo, there is not much we can do about that. See also my further reply on the previous iteration [0].

Also that install-then-build sequence seems to be canon, see [1].

Quoted 7 lines

But before we introduce either a download prost-process and/or an npm-package infrastructure, it would be better [2] to have more than two data-points.

[0] https://lore.kernel.org/buildroot/20220826210712.GE37358@scaer/
[1] https://lore.kernel.org/buildroot/20220827093603.GT37358@scaer/
[2] I said "better", not "nice", on purpose. ;-]

This is exactly that.

Quoted 11 lines
Quoted 3 lines

- Does this $(NPM) install step installs extra stuff? If it does, are these extra things accounted for from a legal information perspective?

Yeah, it does install the vendored stuff. And of course it is not accounted for, what did you hope? ;-)

So, yes, FORGE_LICENSE should include something like:

, vendored dependencies licenses probably not listed

Ok, do I propose a v3 with the suggested sentence to FORGE_LICENSE or should I do something else?

Signature · 5 lines
Johan
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#9 lore raw
In reply to Johan Oudinet

Hello Johan,

Quoted 7 lines · On Fri, 26 Aug 2022 15:08:43 +0200 Johan Oudinet <[email protected]>…

A native implementation of TLS (and various other cryptographic tools) in JavaScript.

Signed-off-by Johan Oudinet <[email protected]>

---
Changes v1 -> v2:
- build with npm (suggested by Yann E. Morin)

Quoted 10 lines
---
 DEVELOPERS               |  1 +
 package/Config.in        |  1 +
 package/forge/Config.in  | 10 ++++++++++
 package/forge/forge.hash |  3 +++
 package/forge/forge.mk   | 28 ++++++++++++++++++++++++++++
 5 files changed, 43 insertions(+)
 create mode 100644 package/forge/Config.in
 create mode 100644 package/forge/forge.hash
 create mode 100644 package/forge/forge.mk

I have applied, but after changing the patch to do like we did for
chartjs: use pre-compiled JS files. Indeed, having a dependency on host-nodejs is really heavy, and the fact that we don't have vendoring support yet makes using npm during the build not very nice. So for the time being, we'll use pre-generated JS files.

See:

https://gitlab.com/buildroot.org/buildroot/-/commit/d1938358ec119869a63af7622391f6a8de1fbb16

Thanks a lot!

Thomas

Signature · 7 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot