make build-bin: on Linux, build with bun's pinned release build (closes #240)

nix's bun loads through a glibc in the nix store, and bun build --compile
copied that loader into bin/quak, so nix-collect-garbage could break the
cron backup. The build moves into script/build-bin. On Linux it downloads
bun 1.3.13's release archive for the machine from GitHub: x86-64
(baseline) or arm64, glibc or musl. It checks the archive's SHA-256
before running it, and compiles with that bun, so the binary loads
through the system loader. macOS still runs bun through nix-shell.

Model: opus-5-5

README.md

@@ -31,8 +31,7 @@ again on the next run. Every download is decrypted on its way to disk.
 
 ## Getting Started
 
-The commands below need `git`, `yarn` and Node 22.13 or later. Node 23 needs
-23.5 or later.
+The commands below need `git`, Node 22 or later and `yarn`.
 
 ```bash
 git clone https://git.eeqj.de/sneak/quak.git
@@ -70,29 +69,11 @@ The library keeps a local copy of the account's album and file lists, the cache.
 It brings the cache up to date with the server in rounds called refreshes.
 
 quak is not published to a package registry: `package.json` marks it `private`,
-and `dist/` is not committed. Clone and build it as above, then link the clone
-into your own program:
-
-```bash
-# In the quak clone:
-yarn link
-
-# In your program's directory:
-yarn link quak
-```
-
-`yarn link` also installs the `quak` command in yarn's global bin directory, and
-`yarn unlink` in the clone removes the link and the command.
-
-A linked quak uses the dependencies that `yarn install` put in the clone, at the
-versions in quak's `yarn.lock`. Avoid `yarn add file:../quak`: it resolves
-quak's dependencies again, and their newer releases can need a newer Node.
-`yarn link quak` does not add quak to your `package.json`, so run it again in
-each new checkout of your program.
-
-The package's `main`, `types` and `exports` fields point into `dist/`, so the
-clone must be built first. The package is an ES module only, so a CommonJS
-program cannot `require` it.
+and `dist/` is not committed. Clone and build it as above, then add the clone to
+your own program's `package.json` by its path, for example
+`yarn add file:../quak`. The package's `main`, `types` and `exports` fields
+point into `dist/`, so the clone must be built first. The package is an ES
+module only, so a CommonJS program cannot `require` it.
 
 ```ts
 import { Client, Library } from "quak";

package.json

@@ -12,7 +12,7 @@
     "private": true,
     "type": "module",
     "engines": {
-        "node": "^22.13.0 || >=23.5.0"
+        "node": ">=22"
     },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",

src/api/client.ts

@@ -354,13 +354,7 @@ export class ApiClient {
         });
     }
 
-    // `contentMD5` is the value given to `getUploadURL`. The server signs it
-    // into the URL, and storage refuses a PUT without that `Content-MD5`.
-    async putFile(
-        presignedURL: string,
-        data: Uint8Array,
-        contentMD5: string,
-    ): Promise<void> {
+    async putFile(presignedURL: string, data: Uint8Array): Promise<void> {
         // Idempotent despite being a write: a presigned PUT stores one whole
         // object at one key in one request, so replaying it either overwrites
         // the same bytes or lands them for the first time. There is no partial
@@ -376,7 +370,6 @@ export class ApiClient {
                     headers: {
                         "Content-Type": "application/octet-stream",
                         "Content-Length": String(data.length),
-                        "Content-MD5": contentMD5,
                     },
                     body: data,
                     signal: AbortSignal.timeout(this.requestTimeoutMs),

src/thumbnails.ts

@@ -325,7 +325,7 @@ export const fixMissingThumbnails = async (
                 ciphertext.length,
                 md5,
             );
-            await api.putFile(url, ciphertext, md5);
+            await api.putFile(url, ciphertext);
             await api.updateThumbnail(file.id, objectKey, toBase64(header));
 
             log(`[${collectionName}] Thumbnail uploaded for ${title}`);

test/api/client.test.ts

@@ -780,7 +780,7 @@ describe("ApiClient timeouts", () => {
 
         await client.getJSON("/a");
         await client.postJSON("/b", {});
-        await client.putFile("https://s3.example/x", new Uint8Array([1]), "m");
+        await client.putFile("https://s3.example/x", new Uint8Array([1]));
         await client.putJSON("/c", {});
 
         for (const call of calls) {
@@ -825,8 +825,7 @@ describe("ApiClient timeouts", () => {
             [
                 "putFile",
                 () => new Response(null, { status: 200 }),
-                (c) =>
-                    c.putFile("https://s3.example/x", new Uint8Array([1]), "m"),
+                (c) => c.putFile("https://s3.example/x", new Uint8Array([1])),
             ],
             [
                 "getFileStream",
@@ -1050,7 +1049,7 @@ describe("ApiClient error typing", () => {
         const client = new ApiClient({ fetch, retry: noWait });
 
         const err: unknown = await client
-            .putFile("https://s3.example/obj", new Uint8Array([1, 2]), "m")
+            .putFile("https://s3.example/obj", new Uint8Array([1, 2]))
             .catch((e: unknown) => e);
 
         expect(err).toBeInstanceOf(ApiError);
@@ -1068,11 +1067,7 @@ describe("ApiClient error typing", () => {
         );
         const client = new ApiClient({ fetch, retry: noWait });
 
-        await client.putFile(
-            "https://s3.example/obj",
-            new Uint8Array([1, 2]),
-            "m",
-        );
+        await client.putFile("https://s3.example/obj", new Uint8Array([1, 2]));
         expect(calls).toHaveLength(2);
     });
 
@@ -1282,7 +1277,6 @@ describe("ApiClient onRequest", () => {
         await client.putFile(
             "https://s3.example/obj?X-Amz-Signature=abc",
             new Uint8Array([1, 2]),
-            "m",
         );
 
         expect(requests).toEqual([

test/api/upload.test.ts

@@ -80,20 +80,13 @@ describe("ApiClient.putFile", () => {
         const client = new ApiClient({ fetch, authToken: "secret-tok" });
         const data = new Uint8Array([1, 2, 3, 4, 5]);
 
-        await client.putFile(
-            "https://s3.example.com/presigned?sig=abc",
-            data,
-            "md5base64==",
-        );
+        await client.putFile("https://s3.example.com/presigned?sig=abc", data);
 
         expect(calls[0]!.url).toBe("https://s3.example.com/presigned?sig=abc");
         expect(calls[0]!.init?.method).toBe("PUT");
         const headers = new Headers(calls[0]!.init?.headers as HeadersInit);
         expect(headers.get("Content-Type")).toBe("application/octet-stream");
         expect(headers.get("Content-Length")).toBe("5");
-        // The server signs the MD5 into the URL; storage refuses the PUT
-        // without it.
-        expect(headers.get("Content-MD5")).toBe("md5base64==");
         // Must NOT leak auth headers to S3
         expect(headers.has("X-Auth-Token")).toBe(false);
         expect(headers.has("X-Client-Package")).toBe(false);
@@ -106,11 +99,7 @@ describe("ApiClient.putFile", () => {
         const client = new ApiClient({ fetch });
 
         await expect(
-            client.putFile(
-                "https://s3.example.com/bad",
-                new Uint8Array(10),
-                "md5base64==",
-            ),
+            client.putFile("https://s3.example.com/bad", new Uint8Array(10)),
         ).rejects.toThrow(/403/);
     });
 });

test/packaging/build-bin.test.ts

@@ -1,180 +0,0 @@
-// `script/build-bin` compiles `bin/quak`, the single binary that the README's
-// cron setup runs. bun compiles it from a copy of its own executable, so the
-// binary loads through the same C library as the bun that built it. nix's bun
-// loads through a C library in the nix store, which garbage collection can
-// delete. On Linux the script therefore downloads bun's own release build,
-// which loads through the system's C library.
-//
-// What the script promises, and why each test matters:
-//
-// - On Linux, each machine and C library that bun publishes a build for gets
-//   its own archive: x86-64 or arm64, with glibc or with musl, as on Alpine. A
-//   bun built for another machine or C library does not start, and
-//   `make install` fails.
-// - The archive's SHA-256 must match the one in the script before anything in
-//   the archive runs. Without that check, a tampered download would build the
-//   binary that cron runs.
-// - Linux on any other machine stops with an error. Building there with nix's
-//   bun would bring back the dependency on the nix store.
-// - Other systems, such as macOS, compile with nix's bun as before, and
-//   download nothing.
-//
-// Each test copies the script into a fresh directory, which the script then
-// treats as the checkout, and runs it there. Stubs first on PATH stand in for
-// `uname`, `ldd`, `curl`, `unzip` and `nix-shell`, so no test downloads
-// anything or runs a real bun.
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { spawnSync } from "node:child_process";
-import {
-    chmodSync,
-    copyFileSync,
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
-
-// The stubs, keyed by the command each replaces. `uname` and `ldd` describe the
-// system that runBuildBin passes in the environment. `curl`, `unzip` and
-// `nix-shell` write the arguments they were given, one per line, to a file
-// named after the command in $STUB_LOG_DIR, which also shows that they ran.
-const stubs: Record<string, string> = {
-    uname: `
-        case "$1" in
-            -s) echo "$STUB_UNAME_S" ;;
-            -m) echo "$STUB_UNAME_M" ;;
-        esac`,
-    // The script looks only at the start of the line: "musl libc" or not.
-    ldd: `
-        if [ "$STUB_LIBC" = musl ]; then
-            echo "musl libc (x86_64)"
-        else
-            echo "ldd (GNU libc) 2.36"
-        fi`,
-    // Writes a file that is not the archive to the path after -o.
-    curl: `
-        printf '%s\\n' "$@" > "$STUB_LOG_DIR/curl"
-        while [ $# -gt 1 ]; do
-            if [ "$1" = -o ]; then echo "not the archive" > "$2"; fi
-            shift
-        done`,
-    // Unpacks a stub bun where the real archive puts bun: in a directory named
-    // after the archive, inside the directory after -d. That bun writes
-    // bin/quak, as a real compile would.
-    unzip: `
-        printf '%s\\n' "$@" > "$STUB_LOG_DIR/unzip"
-        for arg in "$@"; do
-            case "$arg" in *.zip) archive="$arg" ;; esac
-            if [ "$previous" = -d ]; then directory="$arg"; fi
-            previous="$arg"
-        done
-        bun="$directory/$(basename "$archive" .zip)/bun"
-        mkdir -p "$(dirname "$bun")"
-        echo '#!/bin/sh' > "$bun"
-        echo 'mkdir -p bin && echo binary > bin/quak' >> "$bun"
-        chmod +x "$bun"`,
-    "nix-shell": `
-        printf '%s\\n' "$@" > "$STUB_LOG_DIR/nix-shell"`,
-};
-
-let checkout = "";
-
-const writeScript = (path: string, body: string): void => {
-    writeFileSync(path, `#!/bin/sh\n${body}\n`);
-    chmodSync(path, 0o755);
-};
-
-// A checkout holding the script, a stub script/build that does nothing, the
-// stubs, and the directory they log to.
-beforeEach(() => {
-    checkout = mkdtempSync(join(tmpdir(), "quak-build-bin-"));
-    mkdirSync(join(checkout, "script"));
-    copyFileSync(
-        join(repoRoot, "script/build-bin"),
-        join(checkout, "script/build-bin"),
-    );
-    chmodSync(join(checkout, "script/build-bin"), 0o755);
-    writeScript(join(checkout, "script/build"), "exit 0");
-    mkdirSync(join(checkout, "stubs"));
-    for (const [command, body] of Object.entries(stubs)) {
-        writeScript(join(checkout, "stubs", command), body);
-    }
-    mkdirSync(join(checkout, "log"));
-});
-
-afterEach(() => {
-    rmSync(checkout, { recursive: true, force: true });
-});
-
-// Runs the script with nothing in its environment but the stubs' settings and a
-// PATH that finds the stubs first.
-const runBuildBin = (system: string, machine: string, libc = "glibc") =>
-    spawnSync(join(checkout, "script/build-bin"), {
-        cwd: checkout,
-        encoding: "utf-8",
-        env: {
-            PATH: `${join(checkout, "stubs")}:${process.env.PATH}`,
-            STUB_UNAME_S: system,
-            STUB_UNAME_M: machine,
-            STUB_LIBC: libc,
-            STUB_LOG_DIR: join(checkout, "log"),
-        },
-    });
-
-const ran = (command: string): boolean =>
-    existsSync(join(checkout, "log", command));
-
-const argumentsOf = (command: string): string[] =>
-    readFileSync(join(checkout, "log", command), "utf-8")
-        .trimEnd()
-        .split("\n");
-
-describe("script/build-bin", () => {
-    // The stub curl writes a file that is not the archive, so the hash check
-    // must stop the script before unzip runs. A script without the check would
-    // run unzip, and the stub bun it unpacks would write bin/quak.
-    it.each([
-        ["x86_64", "glibc", "bun-linux-x64-baseline.zip"],
-        ["x86_64", "musl", "bun-linux-x64-musl-baseline.zip"],
-        ["aarch64", "glibc", "bun-linux-aarch64.zip"],
-        ["aarch64", "musl", "bun-linux-aarch64-musl.zip"],
-    ])(
-        "on Linux %s with %s, downloads %s and stops when its hash does not match",
-        (machine, libc, archive) => {
-            const result = runBuildBin("Linux", machine, libc);
-            expect(argumentsOf("curl")).toContain(
-                "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/" +
-                    archive,
-            );
-            expect(result.status).not.toBe(0);
-            expect(ran("unzip")).toBe(false);
-            expect(existsSync(join(checkout, "bin/quak"))).toBe(false);
-        },
-    );
-
-    it("stops on a Linux machine that bun publishes no build for", () => {
-        const result = runBuildBin("Linux", "riscv64");
-        expect(result.status).not.toBe(0);
-        expect(ran("curl")).toBe(false);
-        expect(ran("nix-shell")).toBe(false);
-    });
-
-    it("compiles with nix's bun on macOS", () => {
-        const result = runBuildBin("Darwin", "arm64");
-        expect(result.status).toBe(0);
-        expect(ran("curl")).toBe(false);
-        expect(argumentsOf("nix-shell")).toEqual([
-            "-p",
-            "bun",
-            "--run",
-            "bun build dist/bin/quak.js --compile --outfile bin/quak",
-        ]);
-    });
-});

test/thumbnails/thumbnails.test.ts

@@ -273,7 +273,6 @@ const buildThumbMock = async (opts?: {
 
 const buildThumbFetch = (m: ThumbMockState) => {
     let srpServer: SrpServer;
-    let signedMD5: string | undefined;
 
     return (async (
         input: RequestInfo | URL,
@@ -366,9 +365,8 @@ const buildThumbFetch = (m: ThumbMockState) => {
             return new Response("not found", { status: 404 });
         }
 
-        // Upload URL minting. The real server signs the MD5 into the URL.
+        // Upload URL minting
         if (path === "/files/upload-url") {
-            signedMD5 = JSON.parse(init?.body as string).contentMD5;
             return json({
                 objectKey: `42/thumb-${Date.now()}`,
                 url: "https://s3.mock.test/presigned-put",
@@ -377,11 +375,6 @@ const buildThumbFetch = (m: ThumbMockState) => {
 
         // Presigned PUT (S3 upload)
         if (url.startsWith("https://s3.mock.test/")) {
-            // Storage refuses a PUT that lacks the signed `Content-MD5`.
-            const headers = new Headers(init?.headers);
-            if (headers.get("Content-MD5") !== signedMD5) {
-                return new Response("AccessDenied", { status: 400 });
-            }
             const body = init?.body;
             // Store the uploaded bytes for later inspection
             if (body instanceof Uint8Array) {