Merge pull request #36 from microsoft/bump-sharp-libvips-compliance

Bump sharp to 0.35.3 and bring compliance tooling up to date

Author: GiorgioUghini

.github/workflows/non-windows.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     name: ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -59,18 +59,47 @@ jobs:
           plutil -lint "$plist"
 
       - run: npm ci
-      - run: npm run compliance:licenses
+      - name: Cache compliance source downloads
+        uses: actions/cache@v4
+        with:
+          path: .compliance-cache
+          key: compliance-${{ runner.os }}-${{ hashFiles('third_party/compliance-policy.json') }}
+          restore-keys: compliance-${{ runner.os }}-
+
+      # macOS arm64 is a release target, so it must be able to produce the complete
+      # corresponding-source bundle. Linux installs from source and only needs the
+      # license inventory.
+      - name: Prepare compliance materials (release target)
+        if: runner.os == 'macOS'
+        run: npm run compliance:prepare
+      - name: Prepare compliance licenses (source-install platform)
+        if: runner.os != 'macOS'
+        run: npm run compliance:licenses
       - name: Verify platform license coverage
         run: |
           node --input-type=module -e "
             import { existsSync, readFileSync } from 'node:fs';
             const inventory = JSON.parse(readFileSync('.compliance/LICENSE-INVENTORY.json'));
             const libvips = inventory.packages.find(({ name }) =>
               name.startsWith('@img/sharp-libvips-'));
-            if (!libvips || libvips.licenseSource !== 'licenses/LGPL-3.0.txt')
+            if (!libvips || !libvips.licenseSource.includes('licenses/LGPL-3.0.txt'))
               throw new Error('Platform Sharp/libvips LGPL coverage is missing');
             if (!existsSync('.compliance/licenses/LGPL-3.0.txt'))
               throw new Error('Canonical LGPL-3.0 text is missing');
+            const wasm = inventory.packages.find(({ name }) => name === '@img/sharp-wasm32');
+            if (wasm) {
+              for (const term of ['LICENSE', 'licenses/LGPL-3.0.txt', 'canonical SPDX MIT text'])
+                if (!wasm.licenseSource.includes(term))
+                  throw new Error('@img/sharp-wasm32 license term ' + term + ' is unresolved');
+            }
+            const native = JSON.parse(readFileSync('.compliance/NATIVE-COMPONENTS.json'));
+            if (native.packages.length !== 1)
+              throw new Error('Exactly one native payload must be selected');
+            if (!native.packages[0].name.endsWith('-' + process.arch))
+              throw new Error('Native payload does not match the runner architecture');
+            for (const excluded of native.excludedFromArtifacts)
+              if (native.packages[0].name === excluded)
+                throw new Error('An excluded WASM package was selected as the native payload');
           "
       - name: Verify optional window provider
         run: >-

.github/workflows/windows.yml

@@ -67,6 +67,13 @@ jobs:
           architecture: ${{ matrix.arch }}
           cache: npm
 
+      - name: Cache compliance source downloads
+        uses: actions/cache@v4
+        with:
+          path: .compliance-cache
+          key: compliance-windows-${{ matrix.arch }}-${{ hashFiles('third_party/compliance-policy.json') }}
+          restore-keys: compliance-windows-${{ matrix.arch }}-
+
       - name: Install native dependencies
         shell: pwsh
         run: |

.gitignore

@@ -4,6 +4,7 @@ dist-electron
 release
 .compliance
 .compliance-cache
+.compliance-review
 *.log
 .DS_Store
 

RELEASING.md

@@ -84,7 +84,8 @@ npm run compliance:prepare
 The pull request must pass:
 
 - Windows x64 and ARM64 license, test, build, package, and architecture checks;
-- macOS and Ubuntu license, test, and build checks;
+- macOS full corresponding-source preparation, test, and build checks;
+- Ubuntu license, test, and build checks;
 - commit-pinned source-installer checks on Windows, macOS, and Ubuntu.
 
 Resolve every compliance failure. Never disable or bypass a compliance check to
@@ -158,8 +159,13 @@ Do not commit the temporary release-notes file.
 
 ## 6. Optional binary release
 
-Binary publication is a separate decision. Build each artifact on its native
-operating system and architecture:
+Binary publication is a separate decision. The supported release targets are
+**Windows x64**, **Windows ARM64**, and **macOS arm64**; every other platform,
+including Linux and macOS x64, is a source install (see `INSTALL.md`). The
+compliance tooling refuses to prepare a redistributable bundle on an
+unsupported target.
+
+Build each artifact on its native operating system and architecture:
 
 ```sh
 npm ci

THIRD-PARTY-NOTICES.md

@@ -49,7 +49,8 @@ Those components remain under their own terms; the generated
   codec library whose bundled notice identifies FFmpeg as **LGPL-2.1-or-later**.
   GPL portions require an explicit non-default FFmpeg build configuration.
 - Electron's `LICENSE.electron.txt` and `LICENSES.chromium.html` are retained in
-  every packaged application.
+  every packaged application. Chromium's notice file differs per platform, so it
+  is reviewed separately for each release target.
 - The currently pinned source is Electron
   [`v43.1.1`](https://github.com/electron/electron/tree/v43.1.1), Chromium
   [`150.0.7871.114`](https://chromium.googlesource.com/chromium/src/+/150.0.7871.114),
@@ -69,12 +70,17 @@ Those components remain under their own terms; the generated
   **Apache-2.0 AND LGPL-3.0-or-later**; other platforms load the corresponding
   **LGPL-3.0-or-later** `@img/sharp-libvips-*` package.
 - The currently pinned source is Sharp
-  [`v0.34.5`](https://github.com/lovell/sharp/tree/v0.34.5), its reproducible
+  [`v0.35.3`](https://github.com/lovell/sharp/tree/v0.35.3), its reproducible
   packaging scripts
-  [`sharp-libvips v1.2.4`](https://github.com/lovell/sharp-libvips/tree/v1.2.4),
+  [`sharp-libvips v1.3.2`](https://github.com/lovell/sharp-libvips/tree/v1.3.2),
   and libvips
-  [`v8.17.3`](https://github.com/libvips/libvips/tree/v8.17.3). The unpacked
+  [`v8.18.3`](https://github.com/libvips/libvips/tree/v8.18.3). The unpacked
   native module remains replaceable in the packaged application.
+- Sharp also publishes a WebAssembly build, `@img/sharp-wasm32`, which npm
+  installs on every platform because its FreeBSD and WebContainers wrappers
+  declare the platform constraints. Skill Recorder never loads it and excludes it
+  and its WASM-only runtime dependency `@emnapi/runtime` from every packaged
+  artifact, so neither is distributed.
 - The native payload also contains libraries under MPL-2.0, MIT, BSD, ISC,
   fontconfig, FreeType, libpng, libtiff, zlib, and related permissive terms.
   The exact upstream table is distributed as

electron/frames/extractor.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { existsSync } from "node:fs";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -169,3 +170,21 @@ test("FrameExtractor deduplicates identical source JPEGs without deleting retain
   assert.equal(reloaded.manifest.length, 1);
   assert.equal(existsSync(path.join(framesDir, reloaded.manifest[0].file)), true);
 });
+
+test("sharp loads through the app's require path as a callable factory (guards sharp 0.35 export shape)", async () => {
+  // The frame extractor loads sharp with createRequire(import.meta.url)("sharp"), which
+  // resolves sharp's CommonJS "require" export condition. sharp 0.35 split its import and
+  // require export shapes, so this guards that the require path stays a directly-callable
+  // factory exposing the .extract().jpeg() pipeline the extractor depends on.
+  const requireFromHere = createRequire(import.meta.url);
+  const loaded = requireFromHere("sharp") as typeof sharp;
+  assert.equal(typeof loaded, "function");
+  const cropped = await loaded({
+    create: { width: 8, height: 8, channels: 3, background: { r: 10, g: 20, b: 30 } },
+  })
+    .extract({ left: 1, top: 1, width: 4, height: 4 })
+    .jpeg({ quality: 88 })
+    .toBuffer();
+  assert.ok(cropped.length > 0);
+});
+

electron/frames/extractor.ts

@@ -18,7 +18,7 @@ const log = createLogger("Frames");
 const require = createRequire(import.meta.url);
 const execFileAsync = promisify(execFile);
 
-type Sharp = typeof import("sharp");
+type Sharp = (typeof import("sharp"))["default"];
 let sharpMod: Sharp | null | undefined;
 function sharp(): Sharp | null {
   if (sharpMod === undefined) {