Repository navigation
fix(install): fall back to a GNU mirror for vcpkg asset downloads - #46
Merged
Merged
Conversation
The Windows source build pulls some vcpkg dependencies (notably the gsasl port -> gsasl-<ver>.tar.gz) only from the GNU FTP network (ftpmirror.gnu.org / ftp.gnu.org). That network is intermittently unreachable; when it times out the native build fails with 'Download failed, halting portfile'. Set X_VCPKG_ASSET_SOURCES to an x-script asset provider that redirects GNU-FTP asset URLs to a reachable GNU mirror (mirrors.kernel.org, overridable via NODE_LIBCURL_GNU_MIRROR) and falls back to the original URL for every other asset. The value is appended to any X_VCPKG_ASSET_SOURCES the consumer already set, so their asset cache keeps precedence. vcpkg still verifies each asset's SHA512, so the mirror swap cannot substitute a different file. The helper uses only native Node.js modules and is a no-op on non-Windows (the source build only runs on Windows).
vcpkg launches the x-script asset command with CreateProcessW (no shell) in its own build environment, where PATH is reset. A bare `node` program token therefore isn't found and the download fails with 'CreateProcessW failed with 2', so vcpkg falls back to the unreachable GNU-FTP origin and times out. Use process.execPath (the absolute path to the running Node) as the program token instead of `node`, keeping both the interpreter and script paths quoted for spaces.
Collaborator
Author
|
aborovsky
added a commit
to BrightSec/bright-cli
that referenced
this pull request
Oct 6, 2026
@brightsec/node-libcurl 5.1.6 (BrightSec/node-libcurl#46) makes the Windows vcpkg source build resilient to GNU FTP outages: it routes vcpkg asset downloads through an x-script that falls back to a reachable GNU mirror (gsasl etc.), fixing the download timeouts that broke the Windows e2e install. Keeps bright-cli on the maintained node-libcurl release. The transitive build deps (tar / brace-expansion / picomatch) were already patched on next via the undici-override PR (#788); this bump moves the direct dependency itself and carries the install-resilience fix. Production webpack build and all 222 unit tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On Windows, node-libcurl's
preinstallruns a vcpkg source build. Some vcpkgports download their sources only from the GNU FTP network — notably the
gsaslport, whose portfile lists just:That network is intermittently unreachable. When it times out, vcpkg exhausts
its retries on both hosts and halts the whole build:
The file itself still exists — only GNU FTP's hosts are down. The identical
tarball is served across the GNU mirror network (e.g.
mirrors.kernel.org,whose copy's SHA512 matches vcpkg's expected hash exactly).
Fix
Set
X_VCPKG_ASSET_SOURCESfor thevcpkg installinvocation to anx-scriptasset provider.vcpkg hands each asset download to a small bundled Node helper
(
scripts/vcpkg-fetch-asset.js) that:ftpmirror.gnu.org/ftp.gnu.org/gnu/...URLs to a reachableGNU mirror (
mirrors.kernel.org, overridable viaNODE_LIBCURL_GNU_MIRROR), andDetails:
X_VCPKG_ASSET_SOURCESalready in the environment, so a consumer's own assetcache still takes precedence.
mirror can't substitute a different file. Origin is not blocked — the helper
itself also falls back to the original URL.
scripts/vcpkg-*.js. No-op in practice on non-Windows (the source build onlyruns on Windows).
This fixes the fragility at the source, so every consumer of node-libcurl
benefits — not just a single downstream CI.
Verification
Exercised the helper exactly as vcpkg invokes it
(
node scripts/vcpkg-fetch-asset.js {url} {sha512} {dst}):ftpmirror.gnu.org→ fetched frommirrors.kernel.org;SHA512 matches vcpkg's expected
62fb4a93…e703bc9.ftp.gnu.org→ also redirected to the mirror..exe) → original URL, follows redirects,downloads intact.
node --checkpasses on both files; prettier-clean.