Install node, yarn and python from the distribution (closes #146)

Follows sneak's ruling at
#146 (comment). Runtimes
and the installer tools bundled with python come from the distribution,
with no version and no hash. Third-party packages stay pinned by hash.

script/bootstrap drops nvm and corepack, installs node and yarn from the
package manager, and stops when yarn's major version is not 1. This
repository's Dockerfile starts from Alpine 3.24. The Python example starts
from debian:trixie-slim and sets PIP_ONLY_BINARY=:all:, so pip downloads no
build tools without a hash check.

Model: opus-5-5

Dockerfile

@@ -2,11 +2,15 @@
 # lint` or `script/lint`, which are themselves a docker build and would
 # recurse into a daemon that does not exist in a build step.
 #
-# Every stage declares ARG CACHEBUST first: script/ passes a new value on
+# In every stage, ARG CACHEBUST comes right after the step that installs
-# every build, which reruns every RUN step after it.
+# system packages: script/ passes a new value on every build, which
+# reruns every RUN step after it and keeps that step's layer. node and
+# yarn come from the distribution, which is trusted, so they need no
+# version and no hash.
 #
-# node 22-alpine, 2026-02-22
+# alpine 3.24.3, 2026-11-04
-FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS lint
+FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS lint
+RUN apk add --no-cache git make nodejs yarn
 ARG CACHEBUST
 
 WORKDIR /app
@@ -21,8 +25,9 @@ RUN yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 
 # Test phase, same shape and for the same reason.
 #
-# node 22-alpine, 2026-02-22
+# alpine 3.24.3, 2026-11-04
-FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS test
+FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS test
+RUN apk add --no-cache git make nodejs yarn
 ARG CACHEBUST
 
 WORKDIR /app
@@ -41,8 +46,9 @@ RUN echo "No tests defined."
 # this image cannot be produced unless lint and test passed. A stage
 # appended after this one would drop all three out of a plain build.
 #
-# node 22-alpine, 2026-02-22
+# alpine 3.24.3, 2026-11-04
-FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34
+FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
+RUN apk add --no-cache git make nodejs yarn
 ARG CACHEBUST
 
 WORKDIR /app
@@ -50,8 +56,8 @@ WORKDIR /app
 COPY --from=lint /app/package.json /dev/null
 COPY --from=test /app/package.json /dev/null
 
-# script/bootstrap installs all prerequisites. Manifests are copied
+# script/bootstrap finds the system packages above and installs the node
-# first so that layer stays cached until dependencies change.
+# packages.
 COPY script/ script/
 COPY package.json yarn.lock ./
 RUN script/bootstrap

README.md

@@ -156,9 +156,9 @@ A stage with none of these steps declares `ARG CACHEBUST` right after `FROM`.
 The `script/` builds pass a new `CACHEBUST` value on every build, which reruns
 every `RUN` step after that line and leaves the layers above it and the cache
 mounts in place; `--no-cache` would build those layers again and empty the
-mounts. This repo's own `Dockerfile` declares `ARG CACHEBUST` right after `FROM`
+mounts. This repo's own `Dockerfile` installs git, make, node and yarn right
-in every stage: each stage installs system packages and node packages together
+after `FROM` in every stage, above `ARG CACHEBUST`. `script/bootstrap` installs
-in one `script/bootstrap` step, and check builds may keep system packages but
+the node packages below that line, because check builds keep system packages but
 not node packages.
 
 ## Rationale

TODO.md

@@ -21,6 +21,19 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-11-04: node, yarn, npm, python, pip and venv now come from the
+  distribution with no version and no hash
+  (https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at
+  https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033. Third-party
+  packages stay pinned by hash. These changed:
+    - `script/bootstrap` no longer uses nvm or corepack, and stops when yarn's
+      major version is not 1.
+    - `script/bootstrap`, `script/fmt` and `script/fmt-check` run `yarn` or
+      `yarnpkg`, whichever is present.
+    - This repository's `Dockerfile` starts from Alpine 3.24.
+    - The Python `test` phase example starts from `debian:trixie-slim`.
+    - `PIP_ONLY_BINARY=:all:` stops a package with no wheel, so pip downloads no
+      build tools without a hash check.
 - 2026-11-04: Rewrote `prompts/REPO_POLICIES.md` sentence by sentence
   (https://git.eeqj.de/sneak/prompts/issues/136), on sneak's yes at
   https://git.eeqj.de/sneak/prompts/issues/136#issuecomment-165193. Every rule

prompts/EXISTING_REPO_CHECKLIST.md

@@ -84,8 +84,10 @@ with your task.
     It installs pipenv and its dependencies by hash, with
     `pip install --require-hashes`. It installs the packages from `Pipfile.lock`
     with `pipenv install --deploy`, plus `--dev` when the tests need the
-    development packages. It installs no Python there, because the tests use the
+    development packages. It sets `PIP_ONLY_BINARY=:all:` for both installs, so
-    base image's. The tests run after `ARG CACHEBUST`, and every other stage
+    a package with no wheel for the image stops the install. It installs no
+    Python there, because the tests use the distribution's, which a step above
+    it installs. The tests run after `ARG CACHEBUST`, and every other stage
     installs its Python packages after it, as in the Python `test` phase example
     in `REPO_POLICIES.md`
 
@@ -196,13 +198,11 @@ with your task.
       `docker build` in `script/`. Without the bootstrap the CI run dies in
       `script/fmt-check`, which runs the formatter on the host and finds nothing
       installed.
-- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
+- [ ] `script/bootstrap` installs node and yarn from the distribution when they
-      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
+      are missing, and stops with a one-line message when yarn's major version
-      the pinned major version, and otherwise yarn under the pinned node, with
+      is not 1.
-      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
+- [ ] `script/bootstrap`, `script/fmt` and `script/fmt-check` run yarn by
-      and yarn it installs under nvm off the `PATH` of the shell that called it,
+      whichever name is present: `yarn`, or `yarnpkg` on Debian and Ubuntu.
-      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
-      git, or runs under another node.
 - [ ] `script/bootstrap` installs no linter of its own — delete the block, its
       version variables and its call site. A JS repo's `yarn install` stays; it
       brings a linter along with every other dependency, and no verdict is taken
@@ -230,8 +230,12 @@ with your task.
       is a package from the distribution's own package index, which needs no
       version and no hash. Pulling that index is also allowed. In a
       `Dockerfile`, the distribution is the pinned base image's. On a host, it
-      is the host's. A package source that a `Dockerfile` adds itself does not
+      is the host's, and the host's package manager stands for it, nix and brew
-      get this exception
+      included. A package source that a `Dockerfile` adds itself does not get
+      this exception
+- [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
+      possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
+      distribution's version is too old, use a newer distribution
 - [ ] Using `yarn`, not `npm` (JS projects)
 
 # Directory Structure
@@ -262,10 +266,10 @@ with your task.
 - [ ] `make check` passes
 - [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
       (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
-      git and node 24, with no yarn on `PATH`), and demonstrably executed the
+      git and node 24), with any yarn first taken off `PATH`, and demonstrably
-      checks — a sub-second build, or `CACHED` on a step that lints or tests,
+      executed the checks — a sub-second build, or `CACHED` on a step that lints
-      one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran. Above
+      or tests, one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran.
-      that line, these steps are expected to show `CACHED`:
+      Above that line, these steps are expected to show `CACHED`:
     - the steps that install system packages
     - the steps that download Go's modules
     - the step that runs `script/bootstrap` to install a Python `test` phase's

prompts/NEW_REPO_CHECKLIST.md

@@ -151,8 +151,10 @@ Template files can be fetched from:
         It installs pipenv and its dependencies by hash, with
         `pip install --require-hashes`. It installs the packages from
         `Pipfile.lock` with `pipenv install --deploy`, plus `--dev` when the
-        tests need the development packages. It installs no Python there,
+        tests need the development packages. It sets `PIP_ONLY_BINARY=:all:` for
-        because the tests use the base image's. The tests run after
+        both installs, so a package with no wheel for the image stops the
+        install. It installs no Python there, because the tests use the
+        distribution's, which a step above it installs. The tests run after
         `ARG CACHEBUST`, and every other stage installs its Python packages
         after it, as in the Python `test` phase example in `REPO_POLICIES.md`
 
@@ -185,12 +187,11 @@ are thin shims calling them. Model scripts:
       alpine images without bash
 - [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
       idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
-      node used if its major version is the pinned one, else pinned version via
+      node and yarn from that package manager when they are missing; a one-line
-      nvm from a hash-verified archive, with yarn and the packages installed
+      message and a stop when yarn's major version is not 1); a non-server
-      under it; pinned yarn via corepack); a non-server repo's development
+      repo's development environment stage runs it, with only system packages
-      environment stage runs it instead of inline installs; a gate phase or the
+      installed inline above it; a gate phase or the build stage installs what
-      build stage installs what its base image lacks either inline or by running
+      its base image lacks either inline or by running it
-      it
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
 - [ ] `script/test` / `make test` —
@@ -220,13 +221,8 @@ are thin shims calling them. Model scripts:
       from `script/projectname`, each assigned on its own line before the build.
       The bootstrap is required: CI checks out and runs this alone, and
       `script/fmt-check` runs the formatter on the host.
-- [ ] `script/fmt` and `script/fmt-check` pick their `yarn` with the same test
+- [ ] `script/bootstrap`, `script/fmt` and `script/fmt-check` run yarn by
-      as `script/bootstrap`: the `yarn` on `PATH` when the node on `PATH` has
+      whichever name is present: `yarn`, or `yarnpkg` on Debian and Ubuntu.
-      the pinned major version, and otherwise yarn under the pinned node, with
-      nvm loaded through `$HOME/.nvm/nvm.sh`. `script/bootstrap` leaves the node
-      and yarn it installs under nvm off the `PATH` of the shell that called it,
-      so a bare `yarn` exits 127 on a runner carrying nothing but docker and
-      git, or runs under another node.
 - [ ] No `docker build` in `script/` leaves a dangling image behind:
       `script/lint` and `script/test` write no image, and `script/docker` and
       `script/cibuild` tag theirs
@@ -243,10 +239,10 @@ are thin shims calling them. Model scripts:
 - [ ] `make docker` succeeds
 - [ ] `script/cibuild` succeeds in a fresh clone on a host carrying what CI has
       (the runner image `docker.gitea.com/runner-images:ubuntu-latest`: docker,
-      git and node 24, with no yarn on `PATH`), and demonstrably executed the
+      git and node 24), with any yarn first taken off `PATH`, and demonstrably
-      checks — a sub-second build, or `CACHED` on a step that lints or tests,
+      executed the checks — a sub-second build, or `CACHED` on a step that lints
-      one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran. Above
+      or tests, one of the `RUN` steps below `ARG CACHEBUST`, means nothing ran.
-      that line, these steps are expected to show `CACHED`:
+      Above that line, these steps are expected to show `CACHED`:
     - the steps that install system packages
     - the steps that download Go's modules
     - the step that runs `script/bootstrap` to install a Python `test` phase's
@@ -259,8 +255,12 @@ are thin shims calling them. Model scripts:
 - [ ] No mutable image/package references. The one exception is a package from
       the distribution's own package index, which needs no version and no hash.
       Pulling that index is also allowed. In a `Dockerfile`, the distribution is
-      the pinned base image's. On a host, it is the host's. A package source
+      the pinned base image's. On a host, it is the host's, and the host's
+      package manager stands for it, nix and brew included. A package source
       that a `Dockerfile` adds itself does not get this exception
+- [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
+      possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
+      distribution's version is too old, use a newer distribution
 - [ ] No unnecessary files in repo root
 - [ ] All dates written as YYYY-MM-DD
 

prompts/REPO_POLICIES.md

@@ -25,6 +25,7 @@ style conventions are in separate documents:
   a remote source, including:
     - Docker base images
     - Go modules
+    - Python packages
     - npm packages
     - GitHub Actions
 
@@ -33,29 +34,45 @@ style conventions are in separate documents:
     dependency by its content hash:
     - Docker: `@sha256:...`
     - Go: the module hash in `go.sum`
+    - Python: the package hash in `Pipfile.lock`
     - npm: the integrity hash in the lockfile
     - GitHub Actions: `@<commit-sha>`
 
-    This also means never `curl | bash` to install tools like pyenv, nvm,
+    This also means never `curl | bash` to install a tool such as rustup.
-    rustup, etc. Instead, download a specific release archive from GitHub,
+    Instead, download a specific release archive from GitHub, verify its hash,
-    verify its hash, and only then install. The hash is hardcoded in the
+    and only then install. The hash is hardcoded in the Dockerfile or script.
-    Dockerfile or script. Unverified install scripts are arbitrary remote code
+    Unverified install scripts are arbitrary remote code execution. Double-check
-    execution. Double-check every external reference in every file before
+    every external reference in every file before committing.
-    committing.
 
     There is one exception: a package from the distribution's own package index
     needs no version and no hash. Pulling that index is also allowed. The
     distribution is trusted. In a `Dockerfile`, it is the pinned base image's
-    distribution. On a host, it is the host's. These commands are examples:
+    distribution. On a host, it is the host's. The host's package manager stands
+    for its distribution, and that includes nix and brew. These commands are
+    examples:
     - `apt-get update`
     - `apt-get install`
     - `apk update`
     - `apk add`
 
+    These come from the distribution wherever possible:
+    - node
+    - yarn
+    - npm
+    - python
+    - pip and venv, the installer tools bundled with python
+
+    If the distribution's version is too old, use a newer distribution, never a
+    download. That rules out all of these:
+    - nvm
+    - pyenv
+    - corepack
+    - `npm install -g yarn`
+
     These are not trusted, so everything from them stays pinned by hash:
     - Docker Hub
     - PyPI
-    - npm
+    - the npm registry
     - `go get`
 
     A package source that a `Dockerfile` adds itself is not the distribution's
@@ -99,18 +116,20 @@ style conventions are in separate documents:
     initialization.
 
     `script/bootstrap` installs all dependencies idempotently and assumes
-    nothing is present. Base tools come from nix, apt, brew, or apk, detected in
+    nothing is present. Base tools, node and yarn come from nix, apt, brew, or
-    that order; apt runs noninteractive. For node it uses the installed node
+    apk, detected in that order; apt runs noninteractive. Each one is installed
-    only when its major version is the pinned one. When node is missing or has
+    only when it is missing. A tool from outside the distribution is never
-    another major, it installs the PINNED node version via nvm, and installs
+    installed as "latest" or "lts"; it is always an exact version.
-    yarn and the packages under it. The CI runner image ships node 24, for
+
-    example. nvm itself is installed first if missing, from a hash-verified
+    Debian and Ubuntu name the yarn command `yarnpkg`. `script/bootstrap`,
-    GitHub release archive, never `curl | sh`. bash is installed as an explicit
+    `script/fmt` and `script/fmt-check` each carry the same small function that
-    prerequisite, since nvm requires bash. Only the major version is compared
+    runs whichever name is present.
-    because the `Dockerfile` stages start from a node image whose exact version
+
-    is not the pin, and nvm cannot install a prebuilt node on alpine. yarn is
+    `script/bootstrap` stops with a one-line message when yarn's major version
-    pinned via `corepack prepare yarn@<version> --activate`. Never install
+    is not 1, before it installs any node packages. Debian 13 and Ubuntu 26.04
-    "latest" or "lts"; always exact versions.
+    package yarn 4. With `--frozen-lockfile`, yarn 4 refuses a yarn 1
+    `yarn.lock`. Without that flag, it rewrites the file and drops the hashes.
+    Alpine and Ubuntu 24.04 package yarn 1, so use one of those.
 
     `script/cibuild` runs the CI build, and the Gitea workflow calls it. The
     script changes to the repo root, runs `script/bootstrap`, runs
@@ -118,15 +137,7 @@ style conventions are in separate documents:
     runs `script/bootstrap` first**, because the workflow checks out the repo
     and runs nothing else, while `script/fmt-check` runs the formatter on the
     host. On a pristine checkout with nothing installed, the run dies there,
-    after the containerised gates have passed. **The bootstrap alone is not
+    after the containerised gates have passed.
-    enough.** When `script/bootstrap` installs node and yarn under nvm, it
-    leaves neither on the `PATH` of the shell that called it. A bare `yarn` then
-    either exits 127 or runs under another node. The host entrypoints that need
-    yarn, `script/fmt` and `script/fmt-check`, therefore use the same test as
-    `script/bootstrap`. When the node on `PATH` has the pinned major version,
-    they run the `yarn` on `PATH`. Otherwise they load nvm through
-    `$HOME/.nvm/nvm.sh` and run yarn under the pinned node. A runner carrying
-    nothing but docker and git then gets through `script/check`.
 
     Four further scripts are our own extensions to the standard:
     - `script/check` runs `script/test`, `script/lint` and `script/fmt-check`.
@@ -175,10 +186,11 @@ style conventions are in separate documents:
       does for its yarn packages
 
     The development environment stage installs development prerequisites by
-    running `script/bootstrap` rather than duplicating its installs inline. A
+    running `script/bootstrap`. Only system packages may be installed inline
-    stage that runs `script/bootstrap` COPYs `script/` and the dependency
+    above it, so that check builds keep them; the `prompts` repo's own
-    manifests (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before
+    `Dockerfile` does this. A stage that runs `script/bootstrap` COPYs `script/`
-    running it.
+    and the dependency manifests (`package.json` + `yarn.lock`, `go.mod` +
+    `go.sum`, etc.) before running it.
 
 - **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
   no separate lint file. `script/lint` and `script/test` each build one phase
@@ -491,9 +503,9 @@ style conventions are in separate documents:
         - pipenv and its dependencies
         - the packages from `Pipfile.lock`
 
-        `script/bootstrap` installs no Python there: the tests use the base
+        `script/bootstrap` installs no Python there: the tests use the
-        image's Python, which the image's hash pins. If it installs anything
+        distribution's Python, which a step above it installs. If it installs
-        else there, the step goes after `ARG CACHEBUST`.
+        anything else there, the step goes after `ARG CACHEBUST`.
 
     - PyPI is not trusted, so `script/bootstrap` installs pipenv and its
       dependencies by hash. It does so with `pip install --require-hashes -r`
@@ -504,37 +516,46 @@ style conventions are in separate documents:
         - installs only what `Pipfile.lock` names
         - checks every package against the lockfile's hashes
         - fails when the lockfile is out of date with `Pipfile`
+    - `script/bootstrap` sets `PIP_ONLY_BINARY=:all:` for both installs, and
+      pipenv passes it on to pip. A package with no ready-built wheel for the
+      image then stops the install. Without the setting, pip builds that package
+      from source and downloads the build tools without a hash check.
     - A kept layer holds nothing a new install would refuse: pip checked the
       hashes of pipenv and its dependencies, and pipenv checked the hashes of
       the lockfile's packages. pipenv creates its virtual environment with the
       `virtualenv` package. The packages that `virtualenv` adds come from wheels
-      inside that package, so the hash pip checked for it covers them. Two
+      inside that package, so the hash pip checked for it covers them. System
-      things in the layer are not fixed by a hash:
+      packages, Python among them, are not fixed by a hash. They keep the
-        - A package with no ready-built wheel for the image is built from
+      versions the package manager gave when the layer was built; a new install
-          source. pip downloads the build tools without a hash check, so a kept
+      may get newer ones.
-          layer's build of such a package may differ from a new one.
-        - System packages keep the versions the package manager gave when the
-          layer was built; a new install may get newer ones.
     - As with Go's modules, the packages are kept in a layer, not a cache mount.
       A cache mount is shared by every build on the host, and nothing checks its
       files again.
 
     In the example below, `script/bootstrap` does all of these:
     - finds `make` and `git` already installed
+    - sets `PIP_ONLY_BINARY=:all:`
     - installs pipenv and its dependencies by hash
     - runs `pipenv install --dev --deploy`
 
     ```dockerfile
     # Test phase. Both pytest runs share one 90-second timeout, so a hang
     # uses it once and gets no rerun.
-    # python:3.x-slim, YYYY-MM-DD
+    # debian:trixie-slim, YYYY-MM-DD
-    FROM python@sha256:... AS test
+    FROM debian@sha256:... AS test
-    # make and git are base tools that script/bootstrap installs when they
+    # Python, pip and venv come from the distribution, which is trusted, so
-    # are missing. Installed here, they stay in their own layer when
+    # they need no version and no hash. make and git are base tools that
-    # script/ changes.
+    # script/bootstrap installs when they are missing. Installed here, they
+    # stay in their own layer when script/ changes.
     RUN apt-get update \
-        && apt-get install -y --no-install-recommends make git \
+        && apt-get install -y --no-install-recommends ca-certificates make git \
+            python3 python3-pip python3-venv \
         && rm -rf /var/lib/apt/lists/*
+    # Debian's Python refuses a system-wide pip install, so pipenv goes in a
+    # virtual environment. pipenv is not bundled with Python, so
+    # script/bootstrap installs it by hash, with the pip this puts on PATH.
+    RUN python3 -m venv /opt/pipenv
+    ENV PATH=/opt/pipenv/bin:$PATH
     WORKDIR /app
     COPY script/ script/
     COPY Pipfile Pipfile.lock ./
@@ -857,10 +878,8 @@ style conventions are in separate documents:
       function defined and never invoked has the same exit status and the same
       empty output as one that worked.
 
-    Node is the exception to the whole-token comparison. The canonical
+    A tool from the distribution has no pin, so `script/bootstrap` installs it
-    `script/bootstrap` compares only node's major version. That is because the
+    when it is missing. make, git, node and yarn are such tools.
-    `Dockerfile` stages start from a node 22 alpine image, which is not the
-    exact pin, and nvm cannot install a prebuilt node on alpine.
 
     Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 

script/bootstrap

@@ -1,24 +1,13 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# installed tools are skipped. Base tools, node and yarn come from nix,
-# or apk (detected in that order); assumes nothing is present. The
+# apt, brew, or apk (detected in that order), with no version and no
-# installed node is used only when its major version is the pinned one;
+# hash, because the distribution is trusted. Assumes nothing is present.
-# otherwise (node missing, or another major) the pinned version is
-# installed via nvm (installing nvm itself first, from a hash-verified
-# release archive, never curl | sh), and yarn and the packages are
-# installed under it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned versions, 2026-07-06
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -67,87 +56,12 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
-# verify_sha256 <file> <expected-hash>
+# Debian and Ubuntu name the yarn command yarnpkg.
-verify_sha256() {
+run_yarn() {
-    if command -v sha256sum >/dev/null 2>&1; then
+    if command -v yarn >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+        yarn "$@"
     else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+        yarnpkg "$@"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-# True when the node on PATH has the pinned major version. Only the
-# major is compared: the Dockerfile stages start from a node 22 alpine
-# image whose exact version is not the pin, and nvm cannot install a
-# prebuilt node on alpine. Another major is not used: the pinned yarn 1
-# prints a deprecation warning under node 24. script/fmt and
-# script/fmt-check carry this function unchanged, to run the yarn
-# installed here.
-node_is_pinned_major() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
-ensure_node() {
-    if node_is_pinned_major; then
-        echo "bootstrap: using node $(node --version)"
-        return 0
-    fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-    nvm_sh "nvm use $NODE_VERSION >/dev/null && \
-        echo \"bootstrap: using node \$(node --version)\""
-}
-
-ensure_yarn() {
-    if ! node_is_pinned_major; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-        return 0
-    fi
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if node_is_pinned_major; then
-        yarn install --frozen-lockfile
-    else
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
     fi
 }
 
@@ -156,10 +70,21 @@ main() {
 
     if missing make; then pkg_install gnumake make make make; fi
     if missing git; then pkg_install git git git git; fi
+    if missing node; then pkg_install nodejs nodejs node nodejs; fi
+    if missing yarn && missing yarnpkg; then
+        pkg_install yarn yarnpkg yarn yarn
+    fi
 
-    ensure_node
+    # Debian 13 and Ubuntu 26.04 package yarn 4, which refuses a yarn 1
-    ensure_yarn
+    # yarn.lock, or rewrites it and drops its hashes.
-    install_js_deps
+    yarn_version="$(run_yarn --version)"
+    if [ "${yarn_version%%.*}" != "1" ]; then
+        echo "bootstrap: yarn $yarn_version refuses this yarn 1 yarn.lock;" \
+            "use a distribution that packages yarn 1" >&2
+        exit 1
+    fi
+
+    run_yarn install --frozen-lockfile
 
     echo "bootstrap complete"
 }

script/fmt

@@ -4,33 +4,13 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Must match the pin in script/bootstrap.
+# Debian and Ubuntu name the yarn command yarnpkg.
-NODE_VERSION="22.17.0"
-
-# True when the node on PATH has the pinned major version: the same
-# function as in script/bootstrap, which uses it to decide where it
-# installs yarn.
-node_is_pinned_major() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
-# Run the yarn script/bootstrap installed: the yarn on PATH when the
-# node on PATH has the pinned major version, and otherwise yarn under
-# the pinned node in nvm, which bootstrap leaves off the PATH of the
-# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
+        yarn "$@"
+    else
+        yarnpkg "$@"
     fi
-    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 
 main() {

script/fmt-check

@@ -4,33 +4,13 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Must match the pin in script/bootstrap.
+# Debian and Ubuntu name the yarn command yarnpkg.
-NODE_VERSION="22.17.0"
-
-# True when the node on PATH has the pinned major version: the same
-# function as in script/bootstrap, which uses it to decide where it
-# installs yarn.
-node_is_pinned_major() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    installed="$(node --version)"
-    installed="${installed#v}"
-    [ "${installed%%.*}" = "${NODE_VERSION%%.*}" ]
-}
-
-# Run the yarn script/bootstrap installed: the yarn on PATH when the
-# node on PATH has the pinned major version, and otherwise yarn under
-# the pinned node in nvm, which bootstrap leaves off the PATH of the
-# shell that called it. nvm is a bash script, hence the subshell.
 run_yarn() {
-    if node_is_pinned_major && command -v yarn >/dev/null 2>&1; then
+    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
+        yarn "$@"
+    else
+        yarnpkg "$@"
     fi
-    if node_is_pinned_major || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt-check: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 
 main() {