feat(standalone): migrate standalone binaries to Node 26 Single Executable Applications (SEAs) - #10899
feat(standalone): migrate standalone binaries to Node 26 Single Executable Applications (SEAs)#10899joehan wants to merge 7 commits into
Conversation
…table Applications (SEAs) - Replace legacy @yao-pkg/pkg with native Node 26 --build-sea and esbuild - Intercept child process execution via in-memory script routing with createRequire to eliminate duplicate Node binary - Replace shelljs runtime dependency with native fs/child_process shell polyfill - Add multi-target build script supporting Linux x64, macOS Universal 2 (arm64 + x64 with lipo), and Windows x64 - Update firepit-builder pipeline to produce SEA artifacts and SHA256 checksums - Document architecture and build workflows in standalone/README.md
Wiz Scan Summary
|
| Scanner | Findings |
|---|---|
 |
- |
 |
- |
 |
- |
 |
- |
 |
17   |
 |
- |
| Total | 17 |
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request migrates the Firepit standalone executable builder from @yao-pkg/pkg to Node.js 26's native Single Executable Application (--build-sea) capabilities and esbuild, removing external dependencies like shelljs in favor of a native inline shell polyfill. Feedback on these changes highlights several critical cross-platform and reliability issues: Unix-specific commands (cp -R and find) are used in build-sea.js which will fail on Windows; unconsumed response streams during HTTP redirects or errors in downloadFile can cause socket leaks; and reading directories without verifying they are files in the pipeline script poses an EISDIR crash risk. Additionally, in firepit.js, executing child scripts via createRequire fails to set up require.main properly, and ImitateNode() does not account for leading Node.js options.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…EA build for automatic cache invalidation
…al binary creation via rcodesign in Linux builds and Dockerfile
…one binary validation
…n, templates bundling, and shebangs
…runtime/node wrapper to is:node
|
/joe-review |
- build-sea.js: use cross-platform fs.cpSync instead of shell cp, add recursive .node file deletion helper, return undefined on rcodesign tool failure, and resume response streams on redirects/errors - firepit.js: set process.argv[1] and execute child scripts with Module.runMain(), parse leading options into execArgv in ImitateNode() - pipeline.js: isolate and stage headless artifacts to outputDir before headful build to avoid binary overwrite, add defensive isFile() check for checksum calculation, and fix Prettier formatting
|
|
||
| # Install dependencies | ||
| RUN apt-get update && \ | ||
| apt-get install -y wget tar | ||
| apt-get install -y wget tar curl | ||
|
|
||
| # Install apple-codesign (rcodesign) for signing and stitching macOS binaries on Linux | ||
| RUN curl -fsSL https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.29.0/apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz | tar -xz --strip-components=1 -C /usr/local/bin apple-codesign-0.29.0-x86_64-unknown-linux-musl/rcodesign | ||
|
|
||
| # Install hub | ||
| RUN curl -fsSL --output hub.tgz https://github.com/github/hub/releases/download/v2.11.2/hub-linux-amd64-2.11.2.tgz |
There was a problem hiding this comment.
There's no way we should be curl piping and using this random library for codesigning. Definitely need to find a better, approved approach here.
3 participants
Description
This PR migrates the
firebase-toolsstandalone binaries to use Node.js 26 native Single Executable Applications (--build-sea) andesbuild, completely replacing the deprecated@yao-pkg/pkgcompiler and eliminating the need for external binary injection tools likepostject.Architectural Highlights
--build-sea):firepit.jsandwelcome.jswithesbuild(--bundle --platform=node --target=node26).child_process.fork()orfirebase is:node,firepit.jsintercepts script arguments at the entrypoint and resolves them viacreateRequire.#!/bin/shshebangs and PATH configuration fornpm,node,firebase, andshell.-c --subshell script execution for package lifecycle scripts (e.g.protobufjspostinstall) and predeploy hooks (npm run lint,npm run build).shelljsanduser-homeruntime dependencies with a native cross-platform polyfill (mkdir,rm,cp,chmod,ln,ls,cat,exec) backed by Nodefs,os.homedir(), andchild_process.spawnSync.standalone/build-sea.jsdownloads official Node 26 binaries and builds executables for:firebase-tools-linux)firebase-tools-macos-arm64)firebase-tools-macos-x64)rcodesign(firebase-tools-macos)firebase-tools-win.exe)WebSocketTransport.stop()terminates active client sockets and includes a safety timeout to prevent shutdown hangs on singleCtrl+C.Verification & Testing
scripts/test-sea-e2e.sh) executed and verified:15.26.0)--tool:setup-check)firebase is:node -e,-p)crypto,fs,path,os)is:npm)fork()runtime/node,runtime/shellwith-c --)