Merge branch 'main' into landau/fix-prerelease-job

Author: mikeland73

.github/workflows/cli-post-release.yml

@@ -24,5 +24,4 @@ jobs:
         run: |
           tmp_file=$(mktemp)
           echo "${{ github.ref_name }}" > $tmp_file
-          aws s3 cp $tmp_file s3://releases.jetpack.io/devbox/latest/version
           aws s3 cp $tmp_file s3://releases.jetpack.io/devbox/stable/version

examples/stacks/drupal/composer.lock

@@ -158,12 +158,12 @@ AddEncoding gzip svgz
     # Serve gzip compressed CSS files if they exist and the client accepts gzip.
     RewriteCond %{HTTP:Accept-encoding} gzip
     RewriteCond %{REQUEST_FILENAME}\.gz -s
-    RewriteRule ^(.*css_[a-zA-Z0-9-_])\.css$ $1\.css\.gz [QSA]
+    RewriteRule ^(.*css_[a-zA-Z0-9-_]+)\.css$ $1\.css\.gz [QSA]
 
     # Serve gzip compressed JS files if they exist and the client accepts gzip.
     RewriteCond %{HTTP:Accept-encoding} gzip
     RewriteCond %{REQUEST_FILENAME}\.gz -s
-    RewriteRule ^(.*js_[a-zA-Z0-9-_])\.js$ $1\.js\.gz [QSA]
+    RewriteRule ^(.*js_[a-zA-Z0-9-_]+)\.js$ $1\.js\.gz [QSA]
 
     # Serve correct content types, and prevent double compression.
     RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1,E=no-brotli:1]

examples/stacks/drupal/web/.htaccess

@@ -531,6 +531,25 @@
  */
 # $settings['file_additional_public_schemes'] = ['example'];
 
+/**
+ * File schemes whose paths should not be normalized:
+ *
+ * Normally, Drupal normalizes '/./' and '/../' segments in file URIs in order
+ * to prevent unintended file access. For example, 'private://css/../image.png'
+ * is normalized to 'private://image.png' before checking access to the file.
+ *
+ * On Windows, Drupal also replaces '\' with '/' in URIs for the local
+ * filesystem.
+ *
+ * If file URIs with one or more scheme should not be normalized like this, then
+ * list the schemes here. For example, if 'porcelain://china/./plate.png' should
+ * not be normalized to 'porcelain://china/plate.png', then add 'porcelain' to
+ * this array. In this case, make sure that the module providing the 'porcelain'
+ * scheme does not allow unintended file access when using '/../' to move up the
+ * directory tree.
+ */
+# $settings['file_sa_core_2023_005_schemes'] = ['porcelain'];
+
 /**
  * Private file path:
  *

examples/stacks/drupal/web/sites/default/default.settings.php

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"go.jetpack.io/devbox/internal/build"
 
 	"go.jetpack.io/devbox/internal/boxcli/midcobra"
 	"go.jetpack.io/devbox/internal/cloud/openssh/sshshim"
@@ -34,10 +35,19 @@ func RootCmd() *cobra.Command {
 		Use:   "devbox",
 		Short: "Instant, easy, predictable development environments",
 		PersistentPreRun: func(cmd *cobra.Command, args []string) {
-			vercheck.CheckVersion(cmd.ErrOrStderr())
 			if flags.quiet {
 				cmd.SetErr(io.Discard)
 			}
+
+			// Skip CheckVersion for `devbox global shellenv` because users will include that
+			// command in their shellrc files, and we don't want to bother them everytime they
+			// open their terminals.
+			//
+			// Skip CheckVersion for engineers building devbox during development.
+			if !strings.HasPrefix(cmd.CommandPath(), "devbox global shellenv") &&
+				!build.IsDev {
+				vercheck.CheckVersion(cmd.ErrOrStderr())
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return cmd.Help()

internal/boxcli/root.go

@@ -1,30 +1,30 @@
-FROM alpine:3
+FROM debian:stable-slim
 
-# Setting up devbox user
-ENV DEVBOX_USER=devbox
-RUN adduser -h /home/$DEVBOX_USER -D -s /bin/bash $DEVBOX_USER
-RUN addgroup sudo
-RUN addgroup $DEVBOX_USER sudo
-RUN echo " $DEVBOX_USER      ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
+# Step 1: Installing dependencies
+RUN apt-get update
+RUN apt-get -y install bash binutils git xz-utils wget sudo
 
-# installing dependencies
-RUN apk add --no-cache bash binutils git libstdc++ xz sudo
+# Step 2: Setting up devbox user
+ENV DEVBOX_USER=devbox
+RUN adduser $DEVBOX_USER
+RUN usermod -aG sudo $DEVBOX_USER
+RUN echo "devbox ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/$DEVBOX_USER
 
 USER $DEVBOX_USER
 
-# installing devbox
-RUN wget --quiet --output-document=/dev/stdout https://get.jetpack.io/devbox | bash -s -- -f
+# Step 3: Installing devbox
+RUN wget --quiet --output-document=/dev/stdout https://get.jetpack.io/devbox   | bash -s -- -f
 RUN chown -R "${DEVBOX_USER}:${DEVBOX_USER}" /usr/local/bin/devbox
 
-# nix installer script
-RUN wget --quiet --output-document=/dev/stdout https://nixos.org/nix/install | sh -s -- --no-daemon
+# Step 4: Installing Nix
+RUN wget --output-document=/dev/stdout https://nixos.org/nix/install | sh -s -- --no-daemon
 RUN . ~/.nix-profile/etc/profile.d/nix.sh
 # updating PATH
 ENV PATH="/home/${DEVBOX_USER}/.nix-profile/bin:/home/${DEVBOX_USER}/.devbox/nix/profile/default/bin:${PATH}"
 
+# Step 5: Installing your devbox project
 WORKDIR /code
 RUN sudo chown $DEVBOX_USER:root /code
 COPY devbox.json devbox.json
-RUN devbox run -- echo "Installing packages"
+RUN devbox install
 CMD ["devbox", "shell"]
-

internal/impl/tmpl/devcontainerDockerfile.tmpl

@@ -27,8 +27,9 @@ type Input struct {
 func InputFromString(s string, l lock.Locker) *Input {
 	u, _ := url.Parse(s)
 	if u.Path == "" && u.Opaque != "" && u.Scheme == "path" {
-		u.Path = filepath.Join(l.ProjectDir(), u.Opaque)
-		u.Opaque = ""
+		// This normalizes url paths to be absolute. It also ensures all
+		// path urls have a single slash (instead of possibly 3 slashes)
+		u, _ = url.Parse("path:" + filepath.Join(l.ProjectDir(), u.Opaque))
 	}
 	return &Input{*u, l}
 }
@@ -136,19 +137,18 @@ func (i *Input) PackageAttributePath() (string, error) {
 				strings.Join(lo.Keys(infos), ", ")
 		}
 		return "", usererr.New(
-			"Flake \"%s\" is ambiguous. %s",
+			"Package \"%s\" is ambiguous. %s",
 			i.String(),
 			outputs,
 		)
 	}
 
-	return "", usererr.New("Flake \"%s\" was not found", i.String())
+	return "", usererr.New("Package \"%s\" was not found", i.String())
 }
 
 func (i *Input) urlWithoutFragment() string {
 	u := i.URL // get copy
 	u.Fragment = ""
-	// This will produce urls with extra slashes after the scheme, but that's ok
 	return u.String()
 }
 
@@ -161,7 +161,7 @@ func (i *Input) hash() string {
 }
 
 func (i *Input) validateExists() (bool, error) {
-	if i.IsDevboxPackage() {
+	if i.isVersioned() {
 		version := i.version()
 		if version == "" && i.isVersioned() {
 			return false, usererr.New("No version specified for %q.", i.Path)

internal/nix/input.go

@@ -29,16 +29,16 @@ func TestInput(t *testing.T) {
 		{
 			pkg:                "path:path/to/my-flake#my-package",
 			isFlake:            true,
-			name:               "my-flake-c7758d",
-			urlWithoutFragment: "path://" + filepath.Join(projectDir, "path/to/my-flake"),
-			urlForInput:        "path://" + filepath.Join(projectDir, "path/to/my-flake"),
+			name:               "my-flake-eaedce",
+			urlWithoutFragment: "path:" + filepath.Join(projectDir, "path/to/my-flake"),
+			urlForInput:        "path:" + filepath.Join(projectDir, "path/to/my-flake"),
 		},
 		{
 			pkg:                "path:.#my-package",
 			isFlake:            true,
-			name:               "my-project-744eaa",
-			urlWithoutFragment: "path://" + projectDir,
-			urlForInput:        "path://" + projectDir,
+			name:               "my-project-bbeb05",
+			urlWithoutFragment: "path:" + projectDir,
+			urlForInput:        "path:" + projectDir,
 		},
 		{
 			pkg:                "path:/tmp/my-project/path/to/my-flake#my-package",