cf39fb6957
Two blockers from the parallel Opus review batch: 1. The Tauri CLI install in release-desktop.yml was the last unfrozen install path: `npm install --save-dev --prefix studio @tauri-apps/cli@2.10.1 --no-fund --no-audit` pins the top-level version but leaves the transitive closure floating, defeats the pre-install lockfile audit (no lockfile to scan), and skips integrity verification. Committed a minimal studio/package.json (devDep @tauri-apps/cli@2.10.1) plus the resolved studio/package-lock.json (12 packages: CLI + 11 platform-native binaries, all with integrity hashes, lockfileVersion 3). Switched the step to `npm ci --prefix studio` and added a pre-install lockfile_supply_chain_audit.py step ahead of it so any tarball postinstall is gated by the structural scan. Allowlisted studio/package-lock.json .gitignore and added it to the audit script's default scan set. 2. The bun branch was dead code in build.sh, studio/setup.sh, and studio/setup.ps1: nowhere in the repo is a bun.lock committed, and `bun install --frozen-lockfile` cannot migrate from package-lock.json. With no lockfile, every entry to the bun path either silently regenerates a bun.lock (under permissive install modes -- a fresh attack surface) or fails outright (under frozen-lockfile). Removed `npm install -g bun` bootstrap, the `_try_bun_install` helper + cache-retry, every `if bun.lock && command -v bun` guard, and the now-unreachable "fall back to npm" messaging. All three scripts now have a single `npm ci` path. bun.lock skip entries in lint-ci.yml + wheel-smoke.yml are kept as forward-compat sanity checks -- they assert bun.lock is NOT shipped / scanned, which is stronger after this commit, not weaker. Smoke-tested locally: `npm ci --prefix studio` resolves 3 packages (CLI + 2 linux native binaries), `npx --prefix studio tauri --version` prints `tauri-cli 2.10.1` exactly. `python3 scripts/lockfile_supply_chain_audit.py` scans 3 npm + 1 cargo lockfiles, 0 findings. `bash -n build.sh`, `bash -n studio/setup.sh`, and a pwsh scriptblock parse of studio/setup.ps1 all succeed.
233 lines
7.1 KiB
JSON
233 lines
7.1 KiB
JSON
{
|
|
"name": "unsloth-studio-tauri-cli",
|
|
"version": "0.0.0",
|
|
"lockfileVersion": 3,
|
|
"requires": true,
|
|
"packages": {
|
|
"": {
|
|
"name": "unsloth-studio-tauri-cli",
|
|
"version": "0.0.0",
|
|
"license": "AGPL-3.0-only",
|
|
"devDependencies": {
|
|
"@tauri-apps/cli": "2.10.1"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.10.1.tgz",
|
|
"integrity": "sha512-jQNGF/5quwORdZSSLtTluyKQ+o6SMa/AUICfhf4egCGFdMHqWssApVgYSbg+jmrZoc8e1DscNvjTnXtlHLS11g==",
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"bin": {
|
|
"tauri": "tauri.js"
|
|
},
|
|
"engines": {
|
|
"node": ">= 10"
|
|
},
|
|
"funding": {
|
|
"type": "opencollective",
|
|
"url": "https://opencollective.com/tauri"
|
|
},
|
|
"optionalDependencies": {
|
|
"@tauri-apps/cli-darwin-arm64": "2.10.1",
|
|
"@tauri-apps/cli-darwin-x64": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm-gnueabihf": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-arm64-musl": "2.10.1",
|
|
"@tauri-apps/cli-linux-riscv64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-x64-gnu": "2.10.1",
|
|
"@tauri-apps/cli-linux-x64-musl": "2.10.1",
|
|
"@tauri-apps/cli-win32-arm64-msvc": "2.10.1",
|
|
"@tauri-apps/cli-win32-ia32-msvc": "2.10.1",
|
|
"@tauri-apps/cli-win32-x64-msvc": "2.10.1"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-darwin-arm64": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.10.1.tgz",
|
|
"integrity": "sha512-Z2OjCXiZ+fbYZy7PmP3WRnOpM9+Fy+oonKDEmUE6MwN4IGaYqgceTjwHucc/kEEYZos5GICve35f7ZiizgqEnQ==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"darwin"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-darwin-x64": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.10.1.tgz",
|
|
"integrity": "sha512-V/irQVvjPMGOTQqNj55PnQPVuH4VJP8vZCN7ajnj+ZS8Kom1tEM2hR3qbbIRoS3dBKs5mbG8yg1WC+97dq17Pw==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"darwin"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.10.1.tgz",
|
|
"integrity": "sha512-Hyzwsb4VnCWKGfTw+wSt15Z2pLw2f0JdFBfq2vHBOBhvg7oi6uhKiF87hmbXOBXUZaGkyRDkCHsdzJcIfoJC2w==",
|
|
"cpu": [
|
|
"arm"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-OyOYs2t5GkBIvyWjA1+h4CZxTcdz1OZPCWAPz5DYEfB0cnWHERTnQ/SLayQzncrT0kwRoSfSz9KxenkyJoTelA==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-arm64-musl": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.10.1.tgz",
|
|
"integrity": "sha512-MIj78PDDGjkg3NqGptDOGgfXks7SYJwhiMh8SBoZS+vfdz7yP5jN18bNaLnDhsVIPARcAhE1TlsZe/8Yxo2zqg==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-X0lvOVUg8PCVaoEtEAnpxmnkwlE1gcMDTqfhbefICKDnOTJ5Est3qL0SrWxizDackIOKBcvtpejrSiVpuJI1kw==",
|
|
"cpu": [
|
|
"riscv64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-x64-gnu": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.10.1.tgz",
|
|
"integrity": "sha512-2/12bEzsJS9fAKybxgicCDFxYD1WEI9kO+tlDwX5znWG2GwMBaiWcmhGlZ8fi+DMe9CXlcVarMTYc0L3REIRxw==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-linux-x64-musl": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.10.1.tgz",
|
|
"integrity": "sha512-Y8J0ZzswPz50UcGOFuXGEMrxbjwKSPgXftx5qnkuMs2rmwQB5ssvLb6tn54wDSYxe7S6vlLob9vt0VKuNOaCIQ==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"linux"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-arm64-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-iSt5B86jHYAPJa/IlYw++SXtFPGnWtFJriHn7X0NFBVunF6zu9+/zOn8OgqIWSl8RgzhLGXQEEtGBdR4wzpVgg==",
|
|
"cpu": [
|
|
"arm64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-ia32-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-gXyxgEzsFegmnWywYU5pEBURkcFN/Oo45EAwvZrHMh+zUSEAvO5E8TXsgPADYm31d1u7OQU3O3HsYfVBf2moHw==",
|
|
"cpu": [
|
|
"ia32"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
},
|
|
"node_modules/@tauri-apps/cli-win32-x64-msvc": {
|
|
"version": "2.10.1",
|
|
"resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.10.1.tgz",
|
|
"integrity": "sha512-6Cn7YpPFwzChy0ERz6djKEmUehWrYlM+xTaNzGPgZocw3BD7OfwfWHKVWxXzdjEW2KfKkHddfdxK1XXTYqBRLg==",
|
|
"cpu": [
|
|
"x64"
|
|
],
|
|
"dev": true,
|
|
"license": "Apache-2.0 OR MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"win32"
|
|
],
|
|
"engines": {
|
|
"node": ">= 10"
|
|
}
|
|
}
|
|
}
|
|
}
|