sneak
f727c1ed3e
script/lib/icons.js draws the mark from geometry read back out of the committed PNGs, since the coordinates were never recorded, and writes each PNG with node's own zlib; `make icons` runs it. tests/icons.test.js compares what it draws with icons/ byte for byte. That test is red on purpose. Every pixel matches at all four sizes, but node 22's bundled zlib compresses at level 9 differently from the stock zlib 1.3.1 that made the committed files, so the IDAT bytes differ. How to settle that is the owner's call, asked on the issue. TODO.md is updated with the landing commit. build.js copies the manifests from MANIFEST_SOURCES instead of naming the two paths a second time. Model: opus-5-5
127 lines
4.6 KiB
Makefile
127 lines
4.6 KiB
Makefile
.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
|
|
|
|
# Standard targets are thin shims; the implementations live in script/
|
|
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
|
# of README.md).
|
|
|
|
bootstrap:
|
|
@script/bootstrap
|
|
|
|
setup:
|
|
@script/setup
|
|
|
|
install:
|
|
@yarn install --frozen-lockfile
|
|
|
|
test:
|
|
@script/test
|
|
|
|
# Browser end-to-end suites. Both require docker; neither is part of check.
|
|
test-e2e:
|
|
@script/test-e2e
|
|
|
|
test-e2e-firefox:
|
|
@script/test-e2e-firefox
|
|
|
|
lint:
|
|
@script/lint
|
|
|
|
fmt:
|
|
@script/fmt
|
|
|
|
fmt-check:
|
|
@script/fmt-check
|
|
|
|
check:
|
|
@script/check
|
|
|
|
# Assert that the competitor name appears nowhere but its documented
|
|
# exceptions. Part of check, and re-run against dist/ at the end of a build;
|
|
# separate target for re-running it alone.
|
|
check-censored:
|
|
@script/check-censored
|
|
|
|
package:
|
|
@script/package
|
|
|
|
docker:
|
|
@script/docker
|
|
|
|
hooks:
|
|
@script/install-precommit
|
|
|
|
# build.js writes a receipt of everything it emitted — every path, its sha256,
|
|
# and whether it is a bundle containing constants.js — and script/verify-build
|
|
# checks dist/ against that. The receipt is made here, fresh per invocation,
|
|
# outside the repo, and deleted again: a standing file inside dist/ would be
|
|
# rewritten by whoever rewrote dist/, which is what made the old check
|
|
# satisfiable by a hand-written tree.
|
|
#
|
|
# The expected mode is an explicit argument and AUTISTMASK_DEBUG is scrubbed
|
|
# from the verifier's environment. The script no longer reads it at all; env -u
|
|
# is here so that stays true of anything it calls. It is deliberately NOT
|
|
# scrubbed from the build itself: with AUTISTMASK_DEBUG=1 exported, this target
|
|
# compiles a debug bundle and then fails on it, loudly, rather than quietly
|
|
# handing back something other than the release build that was asked for.
|
|
#
|
|
# Every step of this target is wrapped in script/discard-dist-on-failure, so a
|
|
# release build that fails removes dist/ instead of leaving a complete, loadable
|
|
# debug bundle there for whoever runs the build, sees it fail, and loads
|
|
# dist/chrome/ anyway. A step that succeeds removes nothing, and build-debug is
|
|
# deliberately not wrapped.
|
|
build:
|
|
@echo "Building extension..."
|
|
@set -eu; \
|
|
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
|
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
|
script/discard-dist-on-failure \
|
|
env AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
|
script/discard-dist-on-failure \
|
|
env -u AUTISTMASK_DEBUG script/verify-build --expect release \
|
|
--receipt "$$receipt"
|
|
@script/discard-dist-on-failure script/check-censored --require-dist
|
|
|
|
# Development-only build: enables the red DEBUG / INSECURE banner and makes
|
|
# the hardcoded test recovery phrase the output of wallet creation. Never
|
|
# distribute the artifacts this produces.
|
|
#
|
|
# No discard-dist-on-failure here, on purpose: a debug build that fails is not
|
|
# producing an artifact anyone could mistake for a release one, and its dist/ is
|
|
# the evidence of what went wrong.
|
|
build-debug:
|
|
@echo "Building extension (DEBUG)..."
|
|
@set -eu; \
|
|
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
|
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
|
AUTISTMASK_DEBUG=1 AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
|
env -u AUTISTMASK_DEBUG script/verify-build --expect debug \
|
|
--receipt "$$receipt"
|
|
@script/check-censored --require-dist
|
|
|
|
# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
|
|
# Run deliberately, land the diff: the extension does no runtime fetching, so
|
|
# the shipped list is as fresh as the last vendoring run that was released.
|
|
vendor-blocklist:
|
|
@script/vendor-blocklist
|
|
|
|
# Redraw the toolbar icons in icons/ from script/lib/icons.js, at every size
|
|
# manifest/chrome.json declares. Commit the result with the drawing:
|
|
# tests/icons.test.js fails while the two disagree.
|
|
icons:
|
|
@node script/lib/icons.js
|
|
|
|
clean:
|
|
@rm -rf dist/ release/
|
|
|
|
# Run the build make build runs, without the checks that follow it, then run it
|
|
# again after every change to a file under src/, manifest/ or icons/, until
|
|
# interrupted. A failed build is reported, may leave dist/ partly written, and
|
|
# watching carries on. It writes no build receipt, so nothing can verify what it
|
|
# leaves in dist/: anything handed on comes from make build. A release build
|
|
# unless AUTISTMASK_DEBUG=1 is exported. A change anywhere else, package.json
|
|
# and build.js included, starts no build, and a directory created while it runs
|
|
# is not watched; restart it after either.
|
|
dev:
|
|
@echo "Building in watch mode..."
|
|
@yarn run build --watch 2>&1
|