From 5949532e6450d1aebc681caa8db2192a43b11f12 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:24:25 +0200 Subject: fix(packaging): ship only the TMDB token line of QE/default.env build-node.sh and build-node-runtime.ps1 copied QE/default.env whole into every deb, rpm and Windows build after checking only its first 30 bytes. The file is unversioned and sits beside other QE notes, so any line added to it later would have gone out publicly. Only its first line ships now, and only once it is exactly MESHBAY_TMDB_DEFAULT_TOKEN=; a missing file, a BOM, a token not on the first line or an empty one still stop the build. The Linux step is run by a test against a scratch repo; the PowerShell one has the same rule and was not run here. Co-Authored-By: Claude Opus 5.5 --- packaging/win/build-node-runtime.ps1 | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'packaging/win/build-node-runtime.ps1') diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1 index 28b96e8..3d26ec2 100644 --- a/packaging/win/build-node-runtime.ps1 +++ b/packaging/win/build-node-runtime.ps1 @@ -140,8 +140,9 @@ else { } # --- 5. default.env (shared TMDB token) ------------------------------ -# Copied as is from QE\default.env (never versioned), one line: -# MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... Beside the exe, where +# Taken from QE\default.env (never versioned). Only its first line ships, and +# only once it is exactly MESHBAY_TMDB_DEFAULT_TOKEN=: anything else +# written in that file stays out of a public package. Beside the exe, where # platform.packaged_default_env() looks for it. The daemon reads it beneath # %LOCALAPPDATA%\meshbay\node.env and the operator's own token, so it is only # the fallback. No token, no build: an empty one goes unnoticed. The check is @@ -150,11 +151,13 @@ $defaultEnv = Join-Path $Repo "QE\default.env" $text = if (Test-Path -LiteralPath $defaultEnv) { [System.Text.Encoding]::ASCII.GetString([System.IO.File]::ReadAllBytes($defaultEnv)) } else { "" } -if (-not $text.StartsWith("MESHBAY_TMDB_DEFAULT_TOKEN=eyJ")) { - throw "$defaultEnv missing, or not starting with MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" +$tokenLine = ($text -split "`n", 2)[0].TrimEnd("`r") +if ($tokenLine -cnotmatch '^MESHBAY_TMDB_DEFAULT_TOKEN=eyJ[A-Za-z0-9_.-]+$') { + throw "$defaultEnv missing, or its first line is not MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" } -Copy-Item -LiteralPath $defaultEnv (Join-Path $frozen "default.env") -Step "default.env copied from QE\" +[System.IO.File]::WriteAllText((Join-Path $frozen "default.env"), "$tokenLine`n", + (New-Object System.Text.UTF8Encoding $false)) +Step "default.env: token line taken from QE\" # --- 6. publish ---------------------------------------------------- Move-Item $frozen $OutDir -- cgit v1.2.3