tools: make undici updater build wasm from src

[mhdawson]

No description provided.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[mhdawson]

@marco-ippolito as discussed, update to undici updater to make it build wasm from source.

One commit is for the update to the updater, the other commit updates undici to the latest version to show the changes in what's updated/stored.

I can remove the commit for the undici update after you've taken a look if we want to land the change to the updater on its own.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 87.07%. Comparing base (f9f9a42) to head (3b724e2).
Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #54128      +/-   ##
==========================================
- Coverage   87.08%   87.07%   -0.01%     
==========================================
  Files         643      643              
  Lines      181581   181582       +1     
  Branches    34897    34891       -6     
==========================================
- Hits       158122   158110      -12     
- Misses      16747    16750       +3     
- Partials     6712     6722      +10     

see 24 files with indirect coverage changes

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/60773/

[RafaelGSS]

@mhdawson sorry for my ignorance, but would that make undici builds reproducible?

[marco-ippolito]

Cc @nodejs/undici for visibility

[mhdawson]

@RafaelGSS I don't think it goes all the way to making the reproducible because the container used to build the WASM may change, but that is something that I plan to work on as a follow on as part of the work I've mentioned in the security-wg.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/60781/

[mcollina]

lgtm

This is actually amazing.

[mertcanaltin]

lgtm

[mhdawson]

Rebased since there had been an undici update, now just adds the files which would be added by the updater but which were not being stored.

[Uzlopak]

I actually dont understand what the benefit is.

I proposed nodejs/undici#3173 to ensure the integrity of the wasm files in the undici repo. This PR basically says, that nodejs does not trust the wasm files and thus needs to recompile them.

[marco-ippolito]

I actually dont understand what the benefit is.

I proposed nodejs/undici#3173 to ensure the integrity of the wasm files in the undici repo. This PR basically says, that nodejs does not trust the wasm files and thus needs to recompile them.

• we can hotfix on nodejs directly without a undici release
• decouple the npm package from node, so undici is more free to experiment
• download undici sources from github release rather than from npm package
• use the same docker image as other dependency updates for repeatable build

These are some pros I could think of.
What are the cons?

[Uzlopak]

But this PR is not about decoupling undici but only the wasm binaries 🤷.

[Uzlopak]

I wonder: Is this right? Doesnt we need to also generate the wasm.js files, where the wasm file content is stored as base64?!

[mhdawson]

@Uzlopak I believe all of the WASM files are generated. It may not be obvious in the updated PR since it's not updating to a new version of undici and the wasm files seem to generate to the same thing unless either the undici code is changed or the tools used to generation change neither of which has occured in this update.

[mhdawson]

@Uzlopak the other thing this PR fixes is that in a previous conversation the ask was that the source needed to build undici be in the deps, that was not the case (hence the files being added under deps/undici) and the best way to validate that is to make sure to build all of the components in the updater.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/60909/

[mhdawson]

CI is green so unless there is additional discussion by end of day today I'll go ahead and land

[Uzlopak]

I tested it locally and validated to be working technically correct.

LGTM

[mhdawson]

Landed in e9deab9