From f2a7e1da6b3866407aaf2d4ba3d237275b8ac8bd Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 5 Feb 2025 23:42:29 +0530 Subject: [PATCH] fix: Corepack pnpm issue (#10840) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit So, a while back Circle CI builds and Heroku builds started to fail. From all the threads I read, it seems like the [npm registry rotated it's signing keys](https://github.com/pnpm/pnpm/issues/9014#issuecomment-2616589753) New pnpm versions were signed with the new key. Corepack, however, bundles a static set of trusted keys (from Node’s release), so it continued verifying signatures only against the old key. When it encountered packages signed with the new key, Corepack’s integrity check failed with “Cannot find matching keyid” errors.This mismatch caused Corepack’s integrity check to fail with “Cannot find matching keyid” errors. Workarounds include the following 1. Updating Corepack (to 0.31.0), they [upgraded their package](https://github.com/nodejs/corepack/releases/tag/v0.31.0) to include the new integrity check keys. But we seldom control what's going on with the CI, also, updating this across our scripts is going to be a painful task. Besides Heroku has [made some fixes](https://github.com/heroku/buildpacks-nodejs/pull/1010) around this 2. Disabling integrity checks 🔥 #YOLO 3. Pinning `pnpm` to older versions, or pinning it to a newer version with the checksum in place. Doing the third one here, running `corepack use pnpm@9.15.5` fixes this, [ref](https://github.com/pnpm/pnpm/issues/9014#issuecomment-2623761494) We can get rid of this over time as CDN caches used by build systems are refreshed. But the change in this PR is not disruptive in anyway, only rigidly secure. Fixes: https://github.com/chatwoot/chatwoot/issues/10832 --- Here are the threads to follow - https://github.com/pnpm/pnpm/issues/9014 - https://github.com/pnpm/pnpm/issues/9029 - https://github.com/nodejs/corepack/issues/612 - https://github.com/nodejs/corepack/issues/616 - https://github.com/heroku/buildpacks-nodejs/pull/1010 --------- Co-authored-by: Vishnu Narayanan --- .circleci/config.yml | 2 +- .devcontainer/docker-compose.yml | 24 ++++++++-------- .github/workflows/frontend-fe.yml | 4 +-- .github/workflows/run_foss_spec.yml | 3 +- .github/workflows/size-limit.yml | 10 ++----- deployment/setup_20.04.sh | 10 +++---- docker/Dockerfile | 43 +++++++++++++++++++++-------- package.json | 7 +++-- 8 files changed, 58 insertions(+), 45 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index db7f87d5c..bc7053130 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -19,7 +19,7 @@ jobs: steps: - checkout - node/install: - node-version: '20.12' + node-version: '23.7' - node/install-pnpm - node/install-packages: pkg-manager: pnpm diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml index 8b0704bfa..c5530ac17 100644 --- a/.devcontainer/docker-compose.yml +++ b/.devcontainer/docker-compose.yml @@ -5,30 +5,30 @@ version: '3' services: - base: + base: build: context: .. dockerfile: .devcontainer/Dockerfile.base args: - VARIANT: "ubuntu-22.04" - NODE_VERSION: "20.9.0" - RUBY_VERSION: "3.3.3" + VARIANT: 'ubuntu-22.04' + NODE_VERSION: '23.7.0' + RUBY_VERSION: '3.3.3' # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000. - USER_UID: "1000" - USER_GID: "1000" + USER_UID: '1000' + USER_GID: '1000' image: base:latest - + app: build: context: .. dockerfile: .devcontainer/Dockerfile args: - VARIANT: "ubuntu-22.04" - NODE_VERSION: "20.9.0" - RUBY_VERSION: "3.3.3" + VARIANT: 'ubuntu-22.04' + NODE_VERSION: '23.7.0' + RUBY_VERSION: '3.3.3' # On Linux, you may need to update USER_UID and USER_GID below if not your local UID is not 1000. - USER_UID: "1000" - USER_GID: "1000" + USER_UID: '1000' + USER_GID: '1000' volumes: - ..:/workspace:cached diff --git a/.github/workflows/frontend-fe.yml b/.github/workflows/frontend-fe.yml index 15bb6f5e9..5af4857e0 100644 --- a/.github/workflows/frontend-fe.yml +++ b/.github/workflows/frontend-fe.yml @@ -23,12 +23,10 @@ jobs: bundler-cache: true - uses: pnpm/action-setup@v4 - with: - version: 9.3.0 - uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 23 cache: 'pnpm' - name: Install pnpm dependencies diff --git a/.github/workflows/run_foss_spec.yml b/.github/workflows/run_foss_spec.yml index 0af172849..5a9d35d0b 100644 --- a/.github/workflows/run_foss_spec.yml +++ b/.github/workflows/run_foss_spec.yml @@ -38,7 +38,6 @@ jobs: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 with: - version: 9 ref: ${{ github.event.pull_request.head.ref }} repository: ${{ github.event.pull_request.head.repo.full_name }} @@ -48,7 +47,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 23 cache: 'pnpm' - name: Install pnpm dependencies diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml index 0758ca7d0..724f69ec3 100644 --- a/.github/workflows/size-limit.yml +++ b/.github/workflows/size-limit.yml @@ -19,13 +19,11 @@ jobs: with: bundler-cache: true # runs 'bundle install' and caches installed gems automatically - - uses: pnpm/action-setup@v2 - with: - version: 9.3.0 + - uses: pnpm/action-setup@v4 - uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 23 cache: 'pnpm' - name: pnpm @@ -39,7 +37,7 @@ jobs: - name: setup env run: | cp .env.example .env - + - name: Run asset compile run: bundle exec rake assets:precompile env: @@ -47,5 +45,3 @@ jobs: - name: Size Check run: pnpm run size - - diff --git a/deployment/setup_20.04.sh b/deployment/setup_20.04.sh index 3802f9f95..eddd1bc8b 100644 --- a/deployment/setup_20.04.sh +++ b/deployment/setup_20.04.sh @@ -177,7 +177,7 @@ function install_dependencies() { echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list mkdir -p /etc/apt/keyrings curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg - NODE_MAJOR=20 + NODE_MAJOR=23 echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg 16" > /etc/apt/sources.list.d/pgdg.list wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add - @@ -779,15 +779,15 @@ function upgrade_node() { # Parse major version number major_version=$(echo "$current_version" | cut -d. -f1) - if [ "$major_version" -ge 20 ]; then - echo "Node.js is already version $current_version (>= 20.x). Skipping Node.js upgrade." + if [ "$major_version" -ge 23 ]; then + echo "Node.js is already version $current_version (>= 23.x). Skipping Node.js upgrade." return fi - echo "Upgrading Node.js version to v20.x" + echo "Upgrading Node.js version to v23.x" mkdir -p /etc/apt/keyrings curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg - NODE_MAJOR=20 + NODE_MAJOR=23 echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list apt-get update diff --git a/docker/Dockerfile b/docker/Dockerfile index d99aa6cf7..008884ce1 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,6 +1,12 @@ # pre-build stage +FROM node:23-alpine as node FROM ruby:3.3.3-alpine3.19 AS pre-builder +ARG NODE_VERSION="23.7.0" +ARG PNPM_VERSION="10.2.0" +ENV NODE_VERSION=${NODE_VERSION} +ENV PNPM_VERSION=${PNPM_VERSION} + # ARG default to production settings # For development docker-compose file overrides ARGS ARG BUNDLE_WITHOUT="development:test" @@ -25,18 +31,24 @@ RUN apk update && apk add --no-cache \ tzdata \ postgresql-dev \ postgresql-client \ - nodejs=20.15.1-r0 \ git \ + curl \ + xz \ && mkdir -p /var/app \ && gem install bundler -# Install pnpm and configure environment -RUN wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.shrc" SHELL="$(which sh)" sh - \ - && echo 'export PNPM_HOME="/root/.local/share/pnpm"' >> /root/.shrc \ - && echo 'export PATH="$PNPM_HOME:$PATH"' >> /root/.shrc \ - && export PNPM_HOME="/root/.local/share/pnpm" \ - && export PATH="$PNPM_HOME:$PATH" \ - && pnpm --version +COPY --from=node /usr/local/bin/node /usr/local/bin/ +COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules +RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \ + && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx + +RUN npm install -g pnpm@${PNPM_VERSION} + +RUN echo 'export PNPM_HOME="/root/.local/share/pnpm"' >> /root/.shrc \ + && echo 'export PATH="$PNPM_HOME:$PATH"' >> /root/.shrc \ + && export PNPM_HOME="/root/.local/share/pnpm" \ + && export PATH="$PNPM_HOME:$PATH" \ + && pnpm --version # Persist the environment variables in Docker ENV PNPM_HOME="/root/.local/share/pnpm" @@ -86,6 +98,10 @@ RUN rm -rf /gems/ruby/3.3.0/cache/*.gem \ # final build stage FROM ruby:3.3.3-alpine3.19 +ARG NODE_VERSION="23.7.0" +ARG PNPM_VERSION="10.2.0" +ENV NODE_VERSION=${NODE_VERSION} +ENV PNPM_VERSION=${PNPM_VERSION} ARG BUNDLE_WITHOUT="development:test" ENV BUNDLE_WITHOUT ${BUNDLE_WITHOUT} @@ -114,11 +130,14 @@ RUN apk update && apk add --no-cache \ vips \ && gem install bundler +COPY --from=node /usr/local/bin/node /usr/local/bin/ +COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules + RUN if [ "$RAILS_ENV" != "production" ]; then \ - apk add --no-cache nodejs=20.15.1-r0; \ - # Install pnpm and configure environment - wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.shrc" SHELL="$(which sh)" sh - \ - && source /root/.shrc \ + apk add --no-cache curl \ + && ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \ + && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \ + && npm install -g pnpm@${PNPM_VERSION} \ && pnpm --version; \ fi diff --git a/package.json b/package.json index 9118e551a..62ef883b4 100644 --- a/package.json +++ b/package.json @@ -139,8 +139,8 @@ "vitest": "2.0.1" }, "engines": { - "node": "20.x", - "pnpm": "9.x" + "node": "23.x", + "pnpm": "10.x" }, "husky": { "hooks": { @@ -162,5 +162,6 @@ "*.scss": [ "scss-lint" ] - } + }, + "packageManager": "pnpm@10.2.0+sha512.0d27364e0139c6aadeed65ada153135e0ca96c8da42123bd50047f961339dc7a758fc2e944b428f52be570d1bd3372455c1c65fa2e7aa0bfbf931190f9552001" }