Update @oclif/core to 3.26.0

See: https://github.com/oclif/core/compare/3.25.0...3.26.0

Change-type: patch

.github/actions/publish/action.yml

@@ -44,6 +44,12 @@ runs:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
 
+    - name: Set up Python 3.11
+      if: runner.os == 'macOS'
+      uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4
+      with:
+        python-version: "3.11"
+
     - name: Install additional tools
       if: runner.os == 'Windows'
       shell: bash
@@ -69,18 +75,11 @@ runs:
       if: runner.os == 'Windows'
       shell: powershell
       run: |
-        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:WINDOWS_CERTIFICATE
-        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/certificate.pfx
+        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:SM_CLIENT_CERT_FILE_B64
+        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/Certificate_pkcs12.p12
         Remove-Item -path ${{ runner.temp }} -include certificate.base64
-
-        Import-PfxCertificate `
-          -FilePath ${{ runner.temp }}/certificate.pfx `
-          -CertStoreLocation Cert:\CurrentUser\My `
-          -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
-
       env:
-        WINDOWS_CERTIFICATE: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING }}
-        WINDOWS_CERTIFICATE_PASSWORD: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+        SM_CLIENT_CERT_FILE_B64: ${{ fromJSON(inputs.secrets).SM_CLIENT_CERT_FILE_B64 }}
 
     # https://github.com/product-os/scripts/tree/master/shared
     # https://github.com/product-os/balena-concourse/blob/master/pipelines/github-events/template.yml
@@ -100,12 +99,21 @@ runs:
             CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
 
         elif [[ $runner_os =~ windows|win ]]; then
-            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
-            CSC_LINK='${{ runner.temp }}\certificate.pfx'
+            SM_HOST=${{ fromJSON(inputs.secrets).SM_HOST }}
+            SM_API_KEY=${{ fromJSON(inputs.secrets).SM_API_KEY }}
+            SM_CLIENT_CERT_FILE='${{ runner.temp }}\Certificate_pkcs12.p12'
+            SM_CLIENT_CERT_PASSWORD=${{ fromJSON(inputs.secrets).SM_CLIENT_CERT_PASSWORD }}
+            SM_CODE_SIGNING_CERT_SHA1_HASH=${{ fromJSON(inputs.secrets).SM_CODE_SIGNING_CERT_SHA1_HASH }}
 
-            # patches/all/oclif.patch
-            MSYSSHELLPATH="$(which bash)"
-            MSYSTEM=MSYS
+            curl --silent --retry 3 --fail https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download \
+              -H "x-api-key:$SM_API_KEY" \
+              -o smtools-windows-x64.msi
+            msiexec -i smtools-windows-x64.msi -qn
+            PATH="/c/Program Files/DigiCert/DigiCert One Signing Manager Tools:${PATH}"
+            smksp_registrar.exe list
+            smctl.exe keypair ls
+            /c/Windows/System32/certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+            smksp_cert_sync.exe
 
             # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
             PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
@@ -119,8 +127,8 @@ runs:
         # https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
         # https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
         CSC_FOR_PULL_REQUEST: true
-        # https://sectigo.com/resource-library/time-stamping-server
-        TIMESTAMP_SERVER: http://timestamp.sectigo.com
+        # https://docs.digicert.com/es/software-trust-manager/ci-cd-integrations/plugins/github-custom-action-for-keypair-signing.html
+        TIMESTAMP_SERVER: http://timestamp.digicert.com
         # Apple notarization (automation/build-bin.ts)
         XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
         XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}

.github/actions/test/action.yml

@@ -45,9 +45,9 @@ runs:
         [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
 
         if [[ -e package-lock.json ]] || [[ -e npm-shrinkwrap.json ]]; then
-            npm ci
+            CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' npm ci
         else
-            npm i
+            CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' npm i
         fi
 
         npm run build

.github/workflows/flowzone.yml

@@ -21,6 +21,6 @@ jobs:
       )
     secrets: inherit
     with:
-      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"],["macos-latest-xlarge"]]'
       github_prerelease: false
       restrict_custom_actions: false

.versionbot/CHANGELOG.yml

@@ -1,3 +1,125 @@
+- commits:
+    - subject: Move klaw library to dev dependency
+      hash: bb4713ab9a2445cc7adab24f7d9549331f1c72e8
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.1.5
+  title: ""
+  date: 2024-03-14T15:52:35.043Z
+- commits:
+    - subject: Update @balena/lint to 8.0.0
+      hash: 634ad156ce9a6557102f438715c4a90fccf2db9c
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: myarmolinsky
+      nested: []
+  version: 18.1.4
+  title: ""
+  date: 2024-03-14T14:34:45.902Z
+- commits:
+    - subject: Use standard oclif run.js & dev.js
+      hash: 742c015f21b36685c8dcd9ba494ef0298924bcc9
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.1.3
+  title: ""
+  date: 2024-03-14T12:57:18.555Z
+- commits:
+    - subject: Move macos binary signing to oclif pretarball lifecycle
+      hash: 7f11805a7fdd9dbfebae198321bfd0640769092b
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.1.2
+  title: ""
+  date: 2024-03-13T13:49:08.000Z
+- commits:
+    - subject: Remove patching tmp for windows runners
+      hash: 6515d6ae10ea9bb43793ebfc3843150bce6e8864
+      body: ""
+      footer:
+        See: https://github.com/balena-io/balena-cli/pull/1298/files#r297236577
+        see: https://github.com/balena-io/balena-cli/pull/1298/files#r297236577
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.1.1
+  title: ""
+  date: 2024-03-12T17:39:11.347Z
+- commits:
+    - subject: Add support for macos arm64 builds
+      hash: 38a2817587030678f316d55828b9ce73481716b8
+      body: ""
+      footer:
+        Change-type: minor
+        change-type: minor
+      author: Otavio Jacobi
+      nested: []
+  version: 18.1.0
+  title: ""
+  date: 2024-03-12T14:21:26.866Z
+- commits:
+    - subject: Update dependencies
+      hash: 756f6b328b10f3f5bfffbcca8078a2ad03c99287
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.0.4
+  title: ""
+  date: 2024-03-11T22:19:04.713Z
+- commits:
+    - subject: Removes signing patches
+      hash: f9f41eef4bae9e41531a149fed029c0cea23f3d1
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.0.3
+  title: ""
+  date: 2024-03-11T14:25:45.117Z
+- commits:
+    - subject: Remove no longer needed windows oclif patches
+      hash: ecfd4a260e4734c768480b98d05cee08f366a672
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.0.2
+  title: ""
+  date: 2024-03-07T19:40:22.571Z
+- commits:
+    - subject: Fix windows signing
+      hash: 2e061845ae01fd6d3aa10c97bf8a68a8dba5dfd9
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Otavio Jacobi
+      nested: []
+  version: 18.0.1
+  title: ""
+  date: 2024-03-07T16:30:09.344Z
 - commits:
     - subject: Update to Node 20
       hash: bf5e61a61c542f0c0a57ae49bb9a9998588d6851
@@ -1049,9 +1171,11 @@
                 Bumps [lint-staged](https://github.com/okonet/lint-staged) from
                 13.3.0 to 14.0.0.
 
-                - [Release notes](https://github.com/okonet/lint-staged/releases)
+                - [Release
+                notes](https://github.com/okonet/lint-staged/releases)
 
-                - [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
+                -
+                [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
 
 
                 ---
@@ -1391,9 +1515,11 @@
                         [lint-staged](https://github.com/okonet/lint-staged)
                         from 13.3.0 to 14.0.0.
 
-                        - [Release notes](https://github.com/okonet/lint-staged/releases)
+                        - [Release
+                        notes](https://github.com/okonet/lint-staged/releases)
 
-                        - [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
+                        -
+                        [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
 
 
                         ---
@@ -1768,9 +1894,11 @@
                         [lint-staged](https://github.com/okonet/lint-staged)
                         from 13.3.0 to 14.0.0.
 
-                        - [Release notes](https://github.com/okonet/lint-staged/releases)
+                        - [Release
+                        notes](https://github.com/okonet/lint-staged/releases)
 
-                        - [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
+                        -
+                        [Commits](https://github.com/okonet/lint-staged/compare/v13.3.0...v14.0.0)
 
 
                         ---
@@ -2969,7 +3097,8 @@
                                 Be more lenient with decoding compressed
                                 responses, since (very rarely)
 
-                                servers send slightly invalid gzip responses that are still accepted
+                                servers send slightly invalid gzip responses
+                                that are still accepted
 
                                 by common browsers.
 
@@ -2989,7 +3118,8 @@
                               body: >
                                 The only breaking change is dropping support
 
-                                for node v8 but we have already done that in v11.
+                                for node v8 but we have already done that in
+                                v11.
                               footer:
                                 Change-type: minor
                                 change-type: minor
@@ -3018,7 +3148,8 @@
                               body: >
                                 Otherwise request from the browser could end up
 
-                                on the domain of the current url. For the dashboard
+                                on the domain of the current url. For the
+                                dashboard
 
                                 this would mean the UI nginx would respond with
 
@@ -4296,7 +4427,8 @@
                                 Be more lenient with decoding compressed
                                 responses, since (very rarely)
 
-                                servers send slightly invalid gzip responses that are still accepted
+                                servers send slightly invalid gzip responses
+                                that are still accepted
 
                                 by common browsers.
 
@@ -4316,7 +4448,8 @@
                               body: >
                                 The only breaking change is dropping support
 
-                                for node v8 but we have already done that in v11.
+                                for node v8 but we have already done that in
+                                v11.
                               footer:
                                 Change-type: minor
                                 change-type: minor
@@ -4345,7 +4478,8 @@
                               body: >
                                 Otherwise request from the browser could end up
 
-                                on the domain of the current url. For the dashboard
+                                on the domain of the current url. For the
+                                dashboard
 
                                 this would mean the UI nginx would respond with
 
@@ -5566,7 +5700,8 @@
                         Be more lenient with decoding compressed responses,
                         since (very rarely)
 
-                        servers send slightly invalid gzip responses that are still accepted
+                        servers send slightly invalid gzip responses that are
+                        still accepted
 
                         by common browsers.
 
@@ -7402,7 +7537,9 @@
 
         ```
 
-        Error: Could not detect abi for version 16.13.0 and runtime node.  Updating "node-abi" might help solve this issue if it is a new release of node
+        Error: Could not detect abi for version 16.13.0 and runtime
+        node.  Updating "node-abi" might help solve this issue if it is a new
+        release of node
 
         ```
       footer:
@@ -7538,7 +7675,8 @@
                 - getAllByApplication
 
 
-                Changelog-entry: Enable audit logging and reviewing device changes. The SDK defaults to fetch last 7 days of history
+                Changelog-entry: Enable audit logging and reviewing device
+                changes. The SDK defaults to fetch last 7 days of history
               footer:
                 Change-type: minor
                 change-type: minor
@@ -7736,7 +7874,8 @@
                 This is part of the work for enabling the creation of
                 configuration
 
-                variables with a colon character as a means to allow Raspberry PI users
+                variables with a colon character as a means to allow Raspberry
+                PI users
 
                 to enable the second HDMI port on RPI4 and others.
               footer:
@@ -7896,11 +8035,14 @@
                 [catch-uncommitted](https://github.com/resin-io-modules/catch-uncommitted)
                 from 1.6.2 to 2.0.0.
 
-                - [Release notes](https://github.com/resin-io-modules/catch-uncommitted/releases)
+                - [Release
+                notes](https://github.com/resin-io-modules/catch-uncommitted/releases)
 
-                - [Changelog](https://github.com/balena-io-modules/catch-uncommitted/blob/master/CHANGELOG.md)
+                -
+                [Changelog](https://github.com/balena-io-modules/catch-uncommitted/blob/master/CHANGELOG.md)
 
-                - [Commits](https://github.com/resin-io-modules/catch-uncommitted/compare/v1.6.2...v2.0.0)
+                -
+                [Commits](https://github.com/resin-io-modules/catch-uncommitted/compare/v1.6.2...v2.0.0)
 
 
                 ---
@@ -8771,9 +8913,11 @@
         Bumps [parse-link-header](https://github.com/thlorenz/parse-link-header)
         from 1.0.1 to 2.0.0.
 
-        - [Release notes](https://github.com/thlorenz/parse-link-header/releases)
+        - [Release
+        notes](https://github.com/thlorenz/parse-link-header/releases)
 
-        - [Commits](https://github.com/thlorenz/parse-link-header/compare/v1.0.1...v2.0.0)
+        -
+        [Commits](https://github.com/thlorenz/parse-link-header/compare/v1.0.1...v2.0.0)
 
 
         ---
@@ -9723,11 +9867,14 @@
                 Bumps [browserify](https://github.com/browserify/browserify)
                 from 14.5.0 to 17.0.0.
 
-                - [Release notes](https://github.com/browserify/browserify/releases)
+                - [Release
+                notes](https://github.com/browserify/browserify/releases)
 
-                - [Changelog](https://github.com/browserify/browserify/blob/master/changelog.markdown)
+                -
+                [Changelog](https://github.com/browserify/browserify/blob/master/changelog.markdown)
 
-                - [Commits](https://github.com/browserify/browserify/compare/14.5.0...v17.0.0)
+                -
+                [Commits](https://github.com/browserify/browserify/compare/14.5.0...v17.0.0)
 
 
                 ---
@@ -9755,9 +9902,11 @@
 
                 - [Release notes](https://github.com/raszi/node-tmp/releases)
 
-                - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
+                -
+                [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
 
-                - [Commits](https://github.com/raszi/node-tmp/compare/v0.0.31...v0.2.1)
+                -
+                [Commits](https://github.com/raszi/node-tmp/compare/v0.0.31...v0.2.1)
 
 
                 ---
@@ -9839,9 +9988,11 @@
 
                 - [Release notes](https://github.com/mochajs/mocha/releases)
 
-                - [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
+                -
+                [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
 
-                - [Commits](https://github.com/mochajs/mocha/compare/v3.5.3...v10.0.0)
+                -
+                [Commits](https://github.com/mochajs/mocha/compare/v3.5.3...v10.0.0)
 
 
                 ---
@@ -9881,9 +10032,11 @@
                 Bumps [mockttp](https://github.com/httptoolkit/mockttp) from
                 0.9.1 to 2.7.0.
 
-                - [Release notes](https://github.com/httptoolkit/mockttp/releases)
+                - [Release
+                notes](https://github.com/httptoolkit/mockttp/releases)
 
-                - [Commits](https://github.com/httptoolkit/mockttp/compare/v0.9.1...v2.7.0)
+                -
+                [Commits](https://github.com/httptoolkit/mockttp/compare/v0.9.1...v2.7.0)
 
 
                 ---
@@ -9955,9 +10108,11 @@
                 Bumps [superagent](https://github.com/visionmedia/superagent)
                 from 3.8.3 to 7.1.2.
 
-                - [Release notes](https://github.com/visionmedia/superagent/releases)
+                - [Release
+                notes](https://github.com/visionmedia/superagent/releases)
 
-                - [Changelog](https://github.com/visionmedia/superagent/blob/master/HISTORY.md)
+                -
+                [Changelog](https://github.com/visionmedia/superagent/blob/master/HISTORY.md)
 
                 - [Commits](https://github.com/visionmedia/superagent/commits)
 
@@ -9987,9 +10142,11 @@
 
                 - [Release notes](https://github.com/motdotla/dotenv/releases)
 
-                - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
+                -
+                [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
 
-                - [Commits](https://github.com/motdotla/dotenv/compare/v4.0.0...v16.0.0)
+                -
+                [Commits](https://github.com/motdotla/dotenv/compare/v4.0.0...v16.0.0)
 
 
                 ---
@@ -10584,9 +10741,11 @@
                 Using build instead of pull allows to add metadata (e.g. labels)
                 to pulled images in an
 
-                atomic way. This commit adds the `DockerProgres.build()` method to
+                atomic way. This commit adds the `DockerProgres.build()` method
+                to
 
-                build an image from a remote (or local) source and track the progress of
+                build an image from a remote (or local) source and track the
+                progress of
 
                 the build.
               footer:
@@ -10617,7 +10776,8 @@
               body: >
                 Starting in balenaOS v2.93.0 the supervisor images are tagged
 
-                as balena_supervisor after being pulled from the balena registry.
+                as balena_supervisor after being pulled from the balena
+                registry.
               footer:
                 Change-type: patch
                 change-type: patch
@@ -11674,7 +11834,8 @@
                                 Be more lenient with decoding compressed
                                 responses, since (very rarely)
 
-                                servers send slightly invalid gzip responses that are still accepted
+                                servers send slightly invalid gzip responses
+                                that are still accepted
 
                                 by common browsers.
 
@@ -13348,7 +13509,8 @@
         This changes improves the speed that the project is tarballed by
         switching from
 
-        `klaw` to `recursive-fs` and not running `lstat` on files that are ignored.
+        `klaw` to `recursive-fs` and not running `lstat` on files that are
+        ignored.
 
         Whilst testing with the Jellyfish repository, which contains a number of
 
@@ -13373,9 +13535,11 @@
         Fixes #2394
 
 
-        When pushing to a device in local mode, if a service is not external, and uses
+        When pushing to a device in local mode, if a service is not external,
+        and uses
 
-        an `image` field, that value should be used for tags and target state, otherwise
+        an `image` field, that value should be used for tags and target state,
+        otherwise
 
         it won't match the image name generated on the device by balenaEngine.
       footer:
@@ -13553,7 +13717,11 @@
         https://github.com/compose-spec/compose-spec/blob/43f6537b2c8f01b6d3f0e184d13a0f3cb93d38d7/spec.md#fragments
 
 
-        Removing the FAILSAFE_SCHEMA flag is not expected to break existing project files, since the default behaviour is more liberal, or cause problems down the road given we perform validation immediately after. Docs for the flag: https://github.com/nodeca/js-yaml#load-string---options-
+        Removing the FAILSAFE_SCHEMA flag is not expected to break existing
+        project files, since the default behaviour is more liberal, or cause
+        problems down the road given we perform validation immediately after.
+        Docs for the flag:
+        https://github.com/nodeca/js-yaml#load-string---options-
       footer:
         Change-type: minor
         change-type: minor
@@ -13860,7 +14028,8 @@
                         Be more lenient with decoding compressed responses,
                         since (very rarely)
 
-                        servers send slightly invalid gzip responses that are still accepted
+                        servers send slightly invalid gzip responses that are
+                        still accepted
 
                         by common browsers.
 
@@ -14159,7 +14328,8 @@
         This change allows use of a contract and release semver when doing a
         push,
 
-        and is part of the larger feature to use the builder as part of a CI/CD pipeline.
+        and is part of the larger feature to use the builder as part of a CI/CD
+        pipeline.
       footer:
         Change-type: minor
         change-type: minor
@@ -14610,7 +14780,8 @@
       body: >
         This change will allow to build releases as draft and have them being
 
-        set as final at a later stage. This change is part of a larger feature towards
+        set as final at a later stage. This change is part of a larger feature
+        towards
 
         using the builder as part of CI/CD pipelines.
       footer:
@@ -15091,7 +15262,8 @@
       body: >
         When using deploy to create a release for a multi-container project one
 
-        needs to follow this to avoid triggering a build. Relevant for CI/CD scenarios
+        needs to follow this to avoid triggering a build. Relevant for CI/CD
+        scenarios
 
         with their own build pipeline.
       footer:
@@ -15133,7 +15305,8 @@
         users to configure the image with system connection settings.
 
 
-        This change affects both the `balena local configure` and `balena os configure` commands.
+        This change affects both the `balena local configure` and `balena os
+        configure` commands.
       footer:
         Change-type: patch
         change-type: patch
@@ -15530,10 +15703,12 @@
         The `local` logging driver captures output from container’s
         stdout/stderr
 
-        and writes them to an internal storage that is optimized for performance and disk use.
+        and writes them to an internal storage that is optimized for performance
+        and disk use.
 
 
-        We also want to capture these logs on startup to wait for success/failure.
+        We also want to capture these logs on startup to wait for
+        success/failure.
 
 
         Advise the use of `--privileged` when running Docker-in-Docker to avoid
@@ -15972,7 +16147,8 @@
       body: >
         10.4.0 improves image size estimation
 
-        10.4.1 prevents running out of space while pulling images because of temporary files
+        10.4.1 prevents running out of space while pulling images because of
+        temporary files
       footer:
         Change-type: patch
         change-type: patch
@@ -24351,7 +24527,8 @@
         This fixes a build error caused by a recent version bump of
         'patch-package':
 
-        "Patch file found for package execa which is not present at node_modules/qqjs/node_modules/execa"
+        "Patch file found for package execa which is not present at
+        node_modules/qqjs/node_modules/execa"
       footer:
         Change-type: patch
         change-type: patch
@@ -24636,7 +24813,8 @@
         any balenaOS devices' message - if the OS is Windows.
 
 
-        Also updated the INSTALL instructions with details of the dependency on Bonjour.
+        Also updated the INSTALL instructions with details of the dependency on
+        Bonjour.
       footer:
         Change-type: patch
         change-type: patch
@@ -25522,11 +25700,17 @@
       body: >
         The full warning output was:
 
-        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 drain listeners added. Use emitter.setMaxListeners() to increase limit
+        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory
+        leak detected. 11 drain listeners added. Use emitter.setMaxListeners()
+        to increase limit
 
-        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 error listeners added. Use emitter.setMaxListeners() to increase limit
+        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory
+        leak detected. 11 error listeners added. Use emitter.setMaxListeners()
+        to increase limit
 
-        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 close listeners added. Use emitter.setMaxListeners() to increase limit
+        (node:43572) MaxListenersExceededWarning: Possible EventEmitter memory
+        leak detected. 11 close listeners added. Use emitter.setMaxListeners()
+        to increase limit
       footer:
         Change-type: patch
         change-type: patch
@@ -25628,13 +25812,17 @@
         E.g. "balena build -e -h <IP> -p 2375" with the CLI running on a Mac
         laptop,
 
-        using balenaEngine on an Intel NUC device, building an image for the RPi (ARM
+        using balenaEngine on an Intel NUC device, building an image for the RPi
+        (ARM
 
-        image arch). Previously, QEMU setup by the CLI assumed that docker ran on the
+        image arch). Previously, QEMU setup by the CLI assumed that docker ran
+        on the
 
-        same OS as the CLI (Docker for Mac has built-in binfmt_misc support and does
+        same OS as the CLI (Docker for Mac has built-in binfmt_misc support and
+        does
 
-        not require additional setup, but balenaEngine on Linux requires explicit QEMU
+        not require additional setup, but balenaEngine on Linux requires
+        explicit QEMU
 
         setup.)
       footer:
@@ -25725,7 +25913,8 @@
         Fixes #1380
 
 
-        Argument parsing of "env rm" command was improved by migrating it to oclif
+        Argument parsing of "env rm" command was improved by migrating it to
+        oclif
       footer:
         Change-type: patch
         change-type: patch
@@ -25753,16 +25942,24 @@
 
         ```
 
-        lib/actions-oclif/env/add.ts(73,16): error TS2742: The inferred type of 'flags' cannot be named without a reference to '../../../../../../../../../volumes/live/c64feead-f78e-4bd4-742d-ccd29aef53c4/volume/node_modules/@oclif/parser/lib/flags'. This is likely not portable. A type annotation is necessary.
+        lib/actions-oclif/env/add.ts(73,16): error TS2742: The inferred type of
+        'flags' cannot be named without a reference to
+        '../../../../../../../../../volumes/live/c64feead-f78e-4bd4-742d-ccd29aef53c4/volume/node_modules/@oclif/parser/lib/flags'.
+        This is likely not portable. A type annotation is necessary.
 
-        lib/actions-oclif/version.ts(42,16): error TS2742: The inferred type of 'flags' cannot be named without a reference to '../../../../../../../../volumes/live/c64feead-f78e-4bd4-742d-ccd29aef53c4/volume/node_modules/@oclif/parser/lib/flags.js'. This is likely not portable. A type annotation is necessary.
+        lib/actions-oclif/version.ts(42,16): error TS2742: The inferred type of
+        'flags' cannot be named without a reference to
+        '../../../../../../../../volumes/live/c64feead-f78e-4bd4-742d-ccd29aef53c4/volume/node_modules/@oclif/parser/lib/flags.js'.
+        This is likely not portable. A type annotation is necessary.
 
         ```
 
 
-        This appears to be reported on the Typescript repo here https://github.com/microsoft/TypeScript/issues/29221
+        This appears to be reported on the Typescript repo here
+        https://github.com/microsoft/TypeScript/issues/29221
 
-        The suggested workaround is to explicitly set the type of the `flags` static
+        The suggested workaround is to explicitly set the type of the `flags`
+        static
 
         property.
       footer:
@@ -26817,7 +27014,8 @@
         To fix the same error as here
         https://github.com/nodejs/node/issues/20285
 
-        Task changes as described at https://fettblog.eu/gulp-4-parallel-and-series/
+        Task changes as described at
+        https://fettblog.eu/gulp-4-parallel-and-series/
       footers:
         change-type: patch
         signed-off-by: Gergely Imreh <gergely@balena.io>
@@ -27724,7 +27922,11 @@
         for is to determine whether the command should issue a legacy user API
         key or a provisioning key.
 
-        This makes version optional but tries to figure it out by itself by reading os-release from the image's boot partition. This is not foul-proof however, and while it'll work with most recent images it won't work with all and in that case it'll bail out and only then warn the user to specify it via the --version argument.
+        This makes version optional but tries to figure it out by itself by
+        reading os-release from the image's boot partition. This is not
+        foul-proof however, and while it'll work with most recent images it
+        won't work with all and in that case it'll bail out and only then warn
+        the user to specify it via the --version argument.
       footers:
         change-type: minor
       hash: 8291c96e69407a4c691a35c27ff3cd406794e946
@@ -28364,9 +28566,21 @@
         compatibility merely by looking for the `os-config` executable in the
         device, and bail out if it’s not present.
 
-        `join` and `leave` accept a couple of optional arguments and implement a wizard-style interface if these are not given. They allow to interactively select the device and the application to promote to. If the user has no apps, `join` will offer the user to create one. `join` will also offer the user to login or create an account if they’re not logged in already without exiting the wizard.
+        `join` and `leave` accept a couple of optional arguments and implement a
+        wizard-style interface if these are not given. They allow to
+        interactively select the device and the application to promote to. If
+        the user has no apps, `join` will offer the user to create one. `join`
+        will also offer the user to login or create an account if they’re not
+        logged in already without exiting the wizard.
 
-        `resin-sync` (that's used internally to discover local devices) requires admin privileges. If no device has been specified as an argument, the commands will launch the device scanning process in a privileged subprocess via two new internal commands: `internal sudo` and `internal scanDevices`. This avoids having the user to invoke the commands with sudo and only request escalation if truly needed. This commit also removes the dependency to “president”, implementing “sudo” functionality within the CLI.
+        `resin-sync` (that's used internally to discover local devices) requires
+        admin privileges. If no device has been specified as an argument, the
+        commands will launch the device scanning process in a privileged
+        subprocess via two new internal commands: `internal sudo` and `internal
+        scanDevices`. This avoids having the user to invoke the commands with
+        sudo and only request escalation if truly needed. This commit also
+        removes the dependency to “president”, implementing “sudo” functionality
+        within the CLI.
       footers:
         change-type: minor
       hash: 5cbe1c410f7081ff78b41e8a6d9c0f06ad92934e
@@ -28835,7 +29049,8 @@
         image tars via the builder. It’s needed for users to avoid having to
         switch between CLI versions in order to push to legacy apps as well.
 
-        Note: this pins resin-sdk to 9.0.0-beta14 as I couldn’t get it to install otherwise — npm would always install 9.0.0-beta9 instead.
+        Note: this pins resin-sdk to 9.0.0-beta14 as I couldn’t get it to
+        install otherwise — npm would always install 9.0.0-beta9 instead.
       footers:
         change-type: minor
       hash: 62f006b89ab0fa8a1575f213579910f732f17c0f
@@ -28965,7 +29180,8 @@
 
         * all 'resin-sdk' requires replaced with 'resin-sdk-preconfigured'
 
-        * resin-sdk-preconfigured TS typings are copy pasted from the current resin-sdk master
+        * resin-sdk-preconfigured TS typings are copy pasted from the current
+        resin-sdk master
 
         The idea is to progressively replace all 'resin-sdk-preconfigured'
 
@@ -29015,7 +29231,10 @@
       body: >-
         New version is 3.1.0.
 
-        The updated version is not backwards compatible as it removes all *Async methods that are in wide use in the CLI. The workaround for now is to manually promisify the client and replace all `new Docker()` calls with a shared function that returns a promisified client.
+        The updated version is not backwards compatible as it removes all *Async
+        methods that are in wide use in the CLI. The workaround for now is to
+        manually promisify the client and replace all `new Docker()` calls with
+        a shared function that returns a promisified client.
       hash: 299bc0db132e5b04894b6b955aa469666a66ce8c
       subject: Update docker-toolbelt
     - author: Akis Kesoglou
@@ -29040,9 +29259,11 @@
 
         - Adds a utility file to retrieve the CLI version and its parts
 
-        - Adds a helper that can be used to manipulate display on capable clients
+        - Adds a helper that can be used to manipulate display on capable
+        clients
 
-        - Declares several new dependencies. Most are already indirectly installed via some dependency
+        - Declares several new dependencies. Most are already indirectly
+        installed via some dependency
       footers:
         change-type: minor
       hash: 14a3f51b730b12ad66462342888fb2b4bcf1f1ea

CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 18.1.5 - 2024-03-14
+
+* Move klaw library to dev dependency [Otavio Jacobi]
+
+## 18.1.4 - 2024-03-14
+
+* Update @balena/lint to 8.0.0 [myarmolinsky]
+
+## 18.1.3 - 2024-03-14
+
+* Use standard oclif run.js & dev.js [Otavio Jacobi]
+
+## 18.1.2 - 2024-03-13
+
+* Move macos binary signing to oclif pretarball lifecycle [Otavio Jacobi]
+
+## 18.1.1 - 2024-03-12
+
+* Remove patching tmp for windows runners [Otavio Jacobi]
+
+## 18.1.0 - 2024-03-12
+
+* Add support for macos arm64 builds [Otavio Jacobi]
+
+## 18.0.4 - 2024-03-11
+
+* Update dependencies [Otavio Jacobi]
+
+## 18.0.3 - 2024-03-11
+
+* Removes signing patches [Otavio Jacobi]
+
+## 18.0.2 - 2024-03-07
+
+* Remove no longer needed windows oclif patches [Otavio Jacobi]
+
+## 18.0.1 - 2024-03-07
+
+* Fix windows signing [Otavio Jacobi]
+
 ## 18.0.0 - 2024-02-06
 
 * Update to Node 20 [Otávio Jacobi]

automation/build-bin.ts

@@ -20,9 +20,9 @@ import type { JsonVersions } from '../lib/commands/version/index';
 import { run as oclifRun } from '@oclif/core';
 import * as archiver from 'archiver';
 import * as Bluebird from 'bluebird';
-import { execFile } from 'child_process';
+import { exec, execFile } from 'child_process';
 import * as filehound from 'filehound';
-import { Stats } from 'fs';
+import type { Stats } from 'fs';
 import * as fs from 'fs-extra';
 import * as klaw from 'klaw';
 import * as path from 'path';
@@ -41,6 +41,7 @@ import {
 } from './utils';
 
 const execFileAsync = promisify(execFile);
+const execAsync = promisify(exec);
 
 export const packageJSON = loadPackageJson();
 export const version = 'v' + packageJSON.version;
@@ -60,9 +61,13 @@ const standaloneZips: PathByPlatform = {
 	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.zip`),
 };
 
-const oclifInstallers: PathByPlatform = {
-	darwin: dPath('macos', `balena-${version}.pkg`),
-	win32: dPath('win32', `balena-${version}-${arch}.exe`),
+const getOclifInstallersOriginalNames = async (): Promise<PathByPlatform> => {
+	const { stdout } = await execAsync('git rev-parse --short HEAD');
+	const sha = stdout.trim();
+	return {
+		darwin: dPath('macos', `balena-${version}-${sha}-${arch}.pkg`),
+		win32: dPath('win32', `balena-${version}-${sha}-${arch}.exe`),
+	};
 };
 
 const renamedOclifInstallers: PathByPlatform = {
@@ -182,10 +187,10 @@ async function execPkg(...args: any[]) {
 async function buildPkg() {
 	// https://github.com/vercel/pkg#targets
 	let targets = `linux-${arch}`;
-	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
 	if (process.platform === 'darwin') {
-		targets = `macos-x64`;
+		targets = `macos-${arch}`;
 	}
+	// TBC: not yet possible to build for Windows arm64 on x64 nodes
 	if (process.platform === 'win32') {
 		targets = `win-x64`;
 	}
@@ -321,7 +326,11 @@ async function zipPkg() {
 	});
 }
 
-async function signFilesForNotarization() {
+export async function signFilesForNotarization() {
+	console.log('Signing files for notarization');
+	if (process.platform !== 'darwin') {
+		return;
+	}
 	console.log('Deleting unneeded zip files...');
 	await new Promise((resolve, reject) => {
 		klaw('node_modules/')
@@ -421,6 +430,7 @@ export async function buildStandaloneZip() {
 }
 
 async function renameInstallerFiles() {
+	const oclifInstallers = await getOclifInstallersOriginalNames();
 	if (await fs.pathExists(oclifInstallers[process.platform])) {
 		await fs.rename(
 			oclifInstallers[process.platform],
@@ -435,18 +445,20 @@ async function renameInstallerFiles() {
  * https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe
  */
 async function signWindowsInstaller() {
-	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
+	if (process.env.SM_CODE_SIGNING_CERT_SHA1_HASH) {
 		const exeName = renamedOclifInstallers[process.platform];
 		console.log(`Signing installer "${exeName}"`);
 		// trust ...
 		await execFileAsync('signtool.exe', [
 			'sign',
-			'-t',
+			'-sha1',
+			process.env.SM_CODE_SIGNING_CERT_SHA1_HASH,
+			'-tr',
 			process.env.TIMESTAMP_SERVER || 'http://timestamp.comodoca.com',
-			'-f',
-			process.env.CSC_LINK,
-			'-p',
-			process.env.CSC_KEY_PASSWORD,
+			'-td',
+			'SHA256',
+			'-fd',
+			'SHA256',
 			'-d',
 			`balena-cli ${version}`,
 			exeName,
@@ -491,7 +503,7 @@ export async function buildOclifInstaller() {
 	let packOpts = ['-r', ROOT];
 	if (process.platform === 'darwin') {
 		packOS = 'macos';
-		packOpts = packOpts.concat('--targets', 'darwin-x64');
+		packOpts = packOpts.concat('--targets', `darwin-${arch}`);
 	} else if (process.platform === 'win32') {
 		packOS = 'win';
 		packOpts = packOpts.concat('--targets', 'win32-x64');
@@ -507,10 +519,6 @@ export async function buildOclifInstaller() {
 			console.log(`rimraf(${dir})`);
 			await Bluebird.fromCallback((cb) => rimraf(dir, cb));
 		}
-		if (process.platform === 'darwin') {
-			console.log('Signing files for notarization...');
-			await signFilesForNotarization();
-		}
 		console.log('=======================================================');
 		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
 		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);

automation/capitanodoc/doc-types.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { Command as OclifCommandClass } from '@oclif/core';
+import type { Command as OclifCommandClass } from '@oclif/core';
 
 type OclifCommand = typeof OclifCommandClass;
 

automation/capitanodoc/index.ts

@@ -16,7 +16,7 @@
  */
 import * as path from 'path';
 import { getCapitanoDoc } from './capitanodoc';
-import { Category, Document, OclifCommand } from './doc-types';
+import type { Category, Document, OclifCommand } from './doc-types';
 import * as markdown from './markdown';
 import { stripIndent } from '../../lib/utils/lazy';
 

automation/capitanodoc/markdown.ts

@@ -20,7 +20,7 @@ import * as _ from 'lodash';
 
 import { getManualSortCompareFunction } from '../../lib/utils/helpers';
 import { capitanoizeOclifUsage } from '../../lib/utils/oclif-utils';
-import { Category, Document, OclifCommand } from './doc-types';
+import type { Category, Document, OclifCommand } from './doc-types';
 
 function renderOclifCommand(command: OclifCommand): string[] {
 	const result = [`## ${ent.encode(command.usage || '')}`];

automation/run.ts

@@ -21,6 +21,7 @@ import {
 	buildOclifInstaller,
 	buildStandaloneZip,
 	catchUncommitted,
+	signFilesForNotarization,
 	testShrinkwrap,
 } from './build-bin';
 import {
@@ -54,6 +55,7 @@ async function parse(args?: string[]) {
 	const commands: { [cmd: string]: () => void | Promise<void> } = {
 		'build:installer': buildOclifInstaller,
 		'build:standalone': buildStandaloneZip,
+		'sign:binaries': signFilesForNotarization,
 		'catch-uncommitted': catchUncommitted,
 		'test-shrinkwrap': testShrinkwrap,
 		fix1359: updateDescriptionOfReleasesAffectedByIssue1359,
@@ -65,21 +67,6 @@ async function parse(args?: string[]) {
 		}
 	}
 
-	// The BUILD_TMP env var is used as an alternative location for oclif
-	// (patched) to copy/extract the CLI files, run npm install and then
-	// create the NSIS executable installer for Windows. This was necessary
-	// to avoid issues with a 260-char limit on Windows paths (possibly a
-	// limitation of some library used by NSIS), as the "current working dir"
-	// provided by balena CI is a rather long path to start with.
-	if (process.platform === 'win32' && !process.env.BUILD_TMP) {
-		const randID = (await import('crypto'))
-			.randomBytes(6)
-			.toString('base64')
-			.replace(/\+/g, '-')
-			.replace(/\//g, '_'); // base64url (RFC 4648)
-		process.env.BUILD_TMP = `C:\\tmp\\${randID}`;
-	}
-
 	for (const arg of args) {
 		try {
 			const cmdFunc = commands[arg];

automation/update-module.ts

@@ -107,11 +107,11 @@ async function $main() {
 
 	const changeType = process.argv[4]
 		? // if the caller specified a change type, use that one
-		  validateChangeType(process.argv[4])
+			validateChangeType(process.argv[4])
 		: // use the same change type as in the dependency, but avoid major bumps
-		semverChangeType && semverChangeType !== 'major'
-		? semverChangeType
-		: 'minor';
+			semverChangeType && semverChangeType !== 'major'
+			? semverChangeType
+			: 'minor';
 	console.log(`Using Change-type: ${changeType}`);
 
 	let { stdout: currentBranch } = await run('git rev-parse --abbrev-ref HEAD');

automation/utils.ts

@@ -76,8 +76,8 @@ export function diffLines(str1: string, str2: string): string {
 			return part.added
 				? prefix(part.value, '+')
 				: part.removed
-				? prefix(part.value, '-')
-				: prefix(part.value, ' ');
+					? prefix(part.value, '-')
+					: prefix(part.value, ' ');
 		})
 		.join('\n');
 	return diffStr;

bin/balena

@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-
-// We boost the threadpool size as ext2fs can deadlock with some
-// operations otherwise, if the pool runs out.
-process.env.UV_THREADPOOL_SIZE = '64';
-
-// Disable oclif registering ts-node
-process.env.OCLIF_TS_NODE = 0;
-
-async function run() {
-	// Use fast-boot to cache require lookups, speeding up startup
-	await require('../build/fast-boot').start();
-
-	// Set the desired es version for downstream modules that support it
-	require('@balena/es-version').set('es2018');
-
-	// Run the CLI
-	await require('../build/app').run(undefined, { dir: __dirname });
-}
-
-run();

bin/balena

@@ -0,0 +1 @@
+run.js

bin/balena-dev

@@ -1,87 +0,0 @@
-#!/usr/bin/env node
-
-// ****************************************************************************
-// THIS IS FOR DEV PURPOSES ONLY AND WILL NOT BE PART OF THE PUBLISHED PACKAGE
-// Before opening a PR you should build and test your changes using bin/balena
-// ****************************************************************************
-
-// We boost the threadpool size as ext2fs can deadlock with some
-// operations otherwise, if the pool runs out.
-process.env.UV_THREADPOOL_SIZE = '64';
-
-// Note on `fast-boot2`: We do not use `fast-boot2` with `balena-dev` because:
-// * fast-boot2's cacheKiller option is configured to include the timestamps of
-//   the package.json and npm-shrinkwrap.json files, to avoid unexpected CLI
-//   behavior when changes are made to dependencies during development. This is
-//   generally a good thing, however, `balena-dev` (a few lines below) edits
-//   `package.json` to modify oclif paths, and this results in cache
-//   invalidation and a performance hit rather than speedup.
-// * Even if the timestamps are removed from cacheKiller, so that there is no
-//   cache invalidation, fast-boot's speedup is barely noticeable when ts-node
-//   is used, e.g. 1.43s vs 1.4s when running `balena version`.
-// * `fast-boot` causes unexpected behavior when used with `npm link` or
-//   when the `node_modules` folder is manually modified (affecting transitive
-//   dependencies) during development (e.g. bug investigations). A workaround
-//   is to use `balena-dev` without `fast-boot`. See also notes in
-//   `CONTRIBUTING.md`.
-
-const path = require('path');
-const rootDir = path.join(__dirname, '..');
-
-// Allow balena-dev to work with oclif by temporarily
-// pointing oclif config options to lib/ instead of build/
-modifyOclifPaths();
-// Undo changes on exit
-process.on('exit', function () {
-	modifyOclifPaths(true);
-});
-// Undo changes in case of ctrl-c
-process.on('SIGINT', function () {
-	modifyOclifPaths(true);
-	// Note process exit here will interfere with commands that do their own SIGINT handling,
-	// but without it commands can not be exited.
-	// So currently using balena-dev does not guarantee proper exit behaviour when using ctrl-c.
-	// Ideally a better solution is needed.
-	process.exit();
-});
-
-// Set the desired es version for downstream modules that support it
-require('@balena/es-version').set('es2018');
-
-// Note: before ts-node v6.0.0, 'transpile-only' (no type checking) was the
-// default option. We upgraded ts-node and found that adding 'transpile-only'
-// was necessary to avoid a mysterious 'null' error message. On the plus side,
-// it is supposed to run faster. We still benefit from type checking when
-// running 'npm run build'.
-require('ts-node').register({
-	project: path.join(rootDir, 'tsconfig.json'),
-	transpileOnly: true,
-});
-require('../lib/app').run(undefined, { dir: __dirname, development: true });
-
-// Modify package.json oclif paths from build/ -> lib/, or vice versa
-function modifyOclifPaths(revert) {
-	const fs = require('fs');
-	const packageJsonPath = path.join(rootDir, 'package.json');
-
-	const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
-	const packageObj = JSON.parse(packageJson);
-
-	if (!packageObj.oclif) {
-		return;
-	}
-
-	let oclifSectionText = JSON.stringify(packageObj.oclif);
-	if (!revert) {
-		oclifSectionText = oclifSectionText.replace(/\/build\//g, '/lib/');
-	} else {
-		oclifSectionText = oclifSectionText.replace(/\/lib\//g, '/build/');
-	}
-
-	packageObj.oclif = JSON.parse(oclifSectionText);
-	fs.writeFileSync(
-		packageJsonPath,
-		`${JSON.stringify(packageObj, null, 2)}\n`,
-		'utf8',
-	);
-}

bin/balena-dev

@@ -0,0 +1 @@
+dev.js

bin/dev.cmd

@@ -0,0 +1,3 @@
+@echo off
+
+node "%~dp0\run" %*

bin/dev.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+// ****************************************************************************
+// THIS IS FOR DEV PURPOSES ONLY AND WILL NOT BE PART OF THE PUBLISHED PACKAGE
+// Before opening a PR you should build and test your changes using bin/balena
+// ****************************************************************************
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Note on `fast-boot2`: We do not use `fast-boot2` with `balena-dev` because:
+// * fast-boot2's cacheKiller option is configured to include the timestamps of
+//   the package.json and npm-shrinkwrap.json files, to avoid unexpected CLI
+//   behavior when changes are made to dependencies during development. This is
+//   generally a good thing, however, `balena-dev` (a few lines below) edits
+//   `package.json` to modify oclif paths, and this results in cache
+//   invalidation and a performance hit rather than speedup.
+// * Even if the timestamps are removed from cacheKiller, so that there is no
+//   cache invalidation, fast-boot's speedup is barely noticeable when ts-node
+//   is used, e.g. 1.43s vs 1.4s when running `balena version`.
+// * `fast-boot` causes unexpected behavior when used with `npm link` or
+//   when the `node_modules` folder is manually modified (affecting transitive
+//   dependencies) during development (e.g. bug investigations). A workaround
+//   is to use `balena-dev` without `fast-boot`. See also notes in
+//   `CONTRIBUTING.md`.
+
+const path = require('path');
+const rootDir = path.join(__dirname, '..');
+
+// Allow balena-dev to work with oclif by temporarily
+// pointing oclif config options to lib/ instead of build/
+modifyOclifPaths();
+// Undo changes on exit
+process.on('exit', function () {
+	modifyOclifPaths(true);
+});
+// Undo changes in case of ctrl-c
+process.on('SIGINT', function () {
+	modifyOclifPaths(true);
+	// Note process exit here will interfere with commands that do their own SIGINT handling,
+	// but without it commands can not be exited.
+	// So currently using balena-dev does not guarantee proper exit behaviour when using ctrl-c.
+	// Ideally a better solution is needed.
+	process.exit();
+});
+
+// Set the desired es version for downstream modules that support it
+require('@balena/es-version').set('es2018');
+
+// Note: before ts-node v6.0.0, 'transpile-only' (no type checking) was the
+// default option. We upgraded ts-node and found that adding 'transpile-only'
+// was necessary to avoid a mysterious 'null' error message. On the plus side,
+// it is supposed to run faster. We still benefit from type checking when
+// running 'npm run build'.
+require('ts-node').register({
+	project: path.join(rootDir, 'tsconfig.json'),
+	transpileOnly: true,
+});
+require('../lib/app').run(undefined, { dir: __dirname, development: true });
+
+// Modify package.json oclif paths from build/ -> lib/, or vice versa
+function modifyOclifPaths(revert) {
+	const fs = require('fs');
+	const packageJsonPath = path.join(rootDir, 'package.json');
+
+	const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
+	const packageObj = JSON.parse(packageJson);
+
+	if (!packageObj.oclif) {
+		return;
+	}
+
+	let oclifSectionText = JSON.stringify(packageObj.oclif);
+	if (!revert) {
+		oclifSectionText = oclifSectionText.replace(/\/build\//g, '/lib/');
+	} else {
+		oclifSectionText = oclifSectionText.replace(/\/lib\//g, '/build/');
+	}
+
+	packageObj.oclif = JSON.parse(oclifSectionText);
+	fs.writeFileSync(
+		packageJsonPath,
+		`${JSON.stringify(packageObj, null, 2)}\n`,
+		'utf8',
+	);
+}

bin/run.cmd

@@ -0,0 +1,3 @@
+@echo off
+
+node "%~dp0\run" %*

bin/run.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Disable oclif registering ts-node
+process.env.OCLIF_TS_NODE = 0;
+
+async function run() {
+	// Use fast-boot to cache require lookups, speeding up startup
+	await require('../build/fast-boot').start();
+
+	// Set the desired es version for downstream modules that support it
+	require('@balena/es-version').set('es2018');
+
+	// Run the CLI
+	await require('../build/app').run(undefined, { dir: __dirname });
+}
+
+run();

lib/app.ts

@@ -16,8 +16,8 @@
  */
 
 import * as packageJSON from '../package.json';
+import type { AppOptions } from './preparser';
 import {
-	AppOptions,
 	checkDeletedCommand,
 	preparseArgs,
 	unsupportedFlag,
@@ -157,7 +157,7 @@ async function oclifRun(command: string[], options: AppOptions) {
 	await Promise.all([trackPromise, deprecationPromise, runPromise]);
 }
 
-/** CLI entrypoint. Called by the `bin/balena` and `bin/balena-dev` scripts. */
+/** CLI entrypoint. Called by the `bin/run.js` and `bin/dev.js` scripts. */
 export async function run(cliArgs = process.argv, options: AppOptions) {
 	try {
 		const { setOfflineModeEnvVars, normalizeEnvVars, pkgExec } = await import(

lib/commands/api-keys/index.ts

@@ -52,7 +52,7 @@ export default class ApiKeysCmd extends Command {
 					await getApplication(getBalenaSdk(), options.fleet, {
 						$select: 'actor',
 					})
-			  ).actor
+				).actor
 			: await getBalenaSdk().auth.getActorId();
 		const keys = await getBalenaSdk().pine.get({
 			resource: 'api_key',
@@ -65,7 +65,7 @@ export default class ApiKeysCmd extends Command {
 								name: {
 									$ne: null,
 								},
-						  }
+							}
 						: {}),
 				},
 				$orderby: 'name asc',

lib/commands/device/index.ts

@@ -91,7 +91,7 @@ export default class DeviceCmd extends Command {
 							},
 							...expandForAppName.$expand,
 						},
-				  }
+					}
 				: {
 						$select: [
 							'device_name',
@@ -118,7 +118,7 @@ export default class DeviceCmd extends Command {
 							'is_undervolted',
 						],
 						...expandForAppName,
-				  },
+					},
 		)) as ExtendedDevice;
 
 		if (options.view) {

lib/commands/device/init.ts

@@ -132,7 +132,7 @@ export default class DeviceInitCmd extends Command {
 							$select: 'slug',
 						},
 					},
-			  })
+				})
 			: await (await import('../../utils/patterns')).selectApplication();
 
 		// Register new device

lib/commands/envs/index.ts

@@ -126,7 +126,7 @@ export default class EnvsCmd extends Command {
 		let fleetSlug: string | undefined = options.fleet
 			? await (
 					await import('../../utils/sdk')
-			  ).getFleetSlug(balena, options.fleet)
+				).getFleetSlug(balena, options.fleet)
 			: undefined;
 		let fullUUID: string | undefined; // as oppposed to the short, 7-char UUID
 

lib/commands/logs/index.ts

@@ -19,7 +19,7 @@ import { Flags, Args } from '@oclif/core';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { LogMessage } from 'balena-sdk';
+import type { LogMessage } from 'balena-sdk';
 
 const MAX_RETRY = 1000;
 

lib/commands/preload/index.ts

@@ -173,7 +173,7 @@ Can be repeated to add multiple certificates.\
 		const fleetSlug: string | undefined = options.fleet
 			? await (
 					await import('../../utils/sdk')
-			  ).getFleetSlug(balena, options.fleet)
+				).getFleetSlug(balena, options.fleet)
 			: undefined;
 
 		const progressBars: {

lib/commands/push/index.ts

@@ -23,7 +23,7 @@ import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { dockerignoreHelp, registrySecretsHelp } from '../../utils/messages';
 import type { BalenaSDK } from 'balena-sdk';
 import { ExpectedError, instanceOf } from '../../errors';
-import { RegistrySecrets } from '@balena/compose/dist/multibuild';
+import type { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import { lowercaseIfSlug } from '../../utils/normalization';
 import {
 	applyReleaseTagKeysAndValues,

lib/commands/releases/index.ts

@@ -78,7 +78,7 @@ export default class ReleasesCmd extends Command {
 								$select: ['tag_key', 'value'],
 							},
 						},
-				  }
+					}
 				: { $select: fields },
 		);
 

lib/fast-boot.ts

@@ -20,7 +20,7 @@
  * we have permissions over the cache file before even attempting to load
  * fast boot.
  * DON'T IMPORT BALENA-CLI MODULES HERE, as this module is loaded directly
- * from `bin/balena`, before the CLI's entrypoint in `lib/app.ts`.
+ * from `bin/run.js`, before the CLI's entrypoint in `lib/app.ts`.
  */
 
 import * as fs from 'fs';

lib/framework/output.ts

@@ -88,7 +88,7 @@ async function outputDataSet(
 			...(options.json
 				? {
 						output: 'json',
-				  }
+					}
 				: {}),
 			columns: options.fields,
 			printLine,
@@ -147,7 +147,7 @@ function getLongestObjectKeyLength(o: any): number {
 	return Object.keys(o).length >= 1
 		? Object.keys(o).reduce((a, b) => {
 				return a.length > b.length ? a : b;
-		  }).length
+			}).length
 		: 0;
 }
 

lib/utils/compose.ts

@@ -30,7 +30,7 @@ import type {
 } from './compose-types';
 import { getChalk } from './lazy';
 import Logger = require('./logger');
-import { ProgressCallback } from 'docker-progress';
+import type { ProgressCallback } from 'docker-progress';
 
 export function generateOpts(options: {
 	source?: string;

lib/utils/compose_ts.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 import { Flags } from '@oclif/core';
-import { BalenaSDK } from 'balena-sdk';
+import type { BalenaSDK } from 'balena-sdk';
 import type { TransposeOptions } from '@balena/compose/dist/emulate';
 import type * as Dockerode from 'dockerode';
 import { promises as fs } from 'fs';
@@ -32,7 +32,7 @@ import * as semver from 'semver';
 import type { Duplex, Readable } from 'stream';
 import type { Pack } from 'tar-stream';
 import { ExpectedError } from '../errors';
-import {
+import type {
 	BuiltImage,
 	ComposeOpts,
 	ComposeProject,

lib/utils/device/deploy.ts

@@ -18,13 +18,13 @@
 import * as semver from 'balena-semver';
 import * as Docker from 'dockerode';
 import * as _ from 'lodash';
-import { Composition } from '@balena/compose/dist/parse';
-import {
+import type { Composition } from '@balena/compose/dist/parse';
+import type {
 	BuildTask,
-	getAuthConfigObj,
 	LocalImage,
 	RegistrySecrets,
 } from '@balena/compose/dist/multibuild';
+import { getAuthConfigObj } from '@balena/compose/dist/multibuild';
 import type { Readable } from 'stream';
 
 import { BALENA_ENGINE_TMP_PATH } from '../../config';
@@ -37,7 +37,8 @@ import {
 	makeImageName,
 } from '../compose_ts';
 import Logger = require('../logger');
-import { DeviceAPI, DeviceInfo } from './api';
+import type { DeviceInfo } from './api';
+import { DeviceAPI } from './api';
 import * as LocalPushErrors from './errors';
 import LivepushManager from './live';
 import { displayBuildLog } from './logs';

lib/utils/device/live.ts

@@ -30,11 +30,8 @@ import Logger = require('../logger');
 import { Dockerfile } from 'livepush';
 import type DeviceAPI from './api';
 import type { DeviceInfo, Status } from './api';
-import {
-	DeviceDeployOptions,
-	generateTargetState,
-	rebuildSingleTask,
-} from './deploy';
+import type { DeviceDeployOptions } from './deploy';
+import { generateTargetState, rebuildSingleTask } from './deploy';
 import { BuildError } from './errors';
 import { getServiceColourFn } from './logs';
 import { delay } from '../helpers';

lib/utils/device/ssh.ts

@@ -17,11 +17,11 @@ limitations under the License.
 import { ExpectedError } from '../../errors';
 import { stripIndent } from '../lazy';
 
+import type { SshRemoteCommandOpts } from '../ssh';
 import {
 	findBestUsernameForDevice,
 	getRemoteCommandOutput,
 	runRemoteCommand,
-	SshRemoteCommandOpts,
 } from '../ssh';
 
 export interface DeviceSSHOpts extends SshRemoteCommandOpts {

lib/utils/env-common.ts

@@ -85,13 +85,13 @@ export function getVarResourceName(
 		? isConfig
 			? 'device_config_variable'
 			: isService
-			? 'device_service_environment_variable'
-			: 'device_environment_variable'
+				? 'device_service_environment_variable'
+				: 'device_environment_variable'
 		: isConfig
-		? 'application_config_variable'
-		: isService
-		? 'service_environment_variable'
-		: 'application_environment_variable';
+			? 'application_config_variable'
+			: isService
+				? 'service_environment_variable'
+				: 'application_environment_variable';
 }
 
 /**

lib/utils/ignore.ts

@@ -15,7 +15,8 @@
  * limitations under the License.
  */
 import * as _ from 'lodash';
-import { promises as fs, Stats } from 'fs';
+import type { Stats } from 'fs';
+import { promises as fs } from 'fs';
 import * as path from 'path';
 
 import type { Ignore } from '@balena/dockerignore';

lib/utils/proxy.ts

@@ -18,7 +18,7 @@
 import type { Options as GlobalTunnelNgConfig } from 'global-tunnel-ng';
 export type { GlobalTunnelNgConfig };
 
-import { CliSettings } from './bootstrap';
+import type { CliSettings } from './bootstrap';
 
 type ProxyConfig = string | GlobalTunnelNgConfig;
 

lib/utils/remote-build.ts

@@ -17,7 +17,7 @@ import type { BalenaSDK } from 'balena-sdk';
 import * as JSONStream from 'JSONStream';
 import * as readline from 'readline';
 import * as request from 'request';
-import { RegistrySecrets } from '@balena/compose/dist/multibuild';
+import type { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import type * as Stream from 'stream';
 import streamToPromise = require('stream-to-promise');
 import type { Pack } from 'tar-stream';

lib/utils/ssh.ts

@@ -14,7 +14,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { spawn, StdioOptions } from 'child_process';
+import type { StdioOptions } from 'child_process';
+import { spawn } from 'child_process';
 import * as _ from 'lodash';
 
 import { ExpectedError } from '../errors';

lib/utils/sudo.ts

@@ -15,7 +15,8 @@
  * limitations under the License.
  */
 
-import { ChildProcess, spawn, SpawnOptions } from 'child_process';
+import type { ChildProcess, SpawnOptions } from 'child_process';
+import { spawn } from 'child_process';
 import { stripIndent } from './lazy';
 
 /**

lib/utils/tunnel.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 import type { BalenaSDK } from 'balena-sdk';
-import { Socket } from 'net';
+import type { Socket } from 'net';
 import * as tls from 'tls';
 import { TypedError } from 'typed-error';
 import { ExpectedError } from '../errors';

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "18.0.0",
+  "version": "18.1.5",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -22,7 +22,7 @@
     "oclif.manifest.json"
   ],
   "bin": {
-    "balena": "./bin/balena"
+    "balena": "./bin/run.js"
   },
   "pkg": {
     "scripts": [
@@ -48,6 +48,7 @@
   "scripts": {
     "postinstall": "node patches/apply-patches.js",
     "prebuild": "rimraf build/ build-bin/",
+    "pretarball": "ts-node --transpile-only ../../automation/run.ts sign:binaries",
     "build": "npm run build:src && npm run catch-uncommitted",
     "build:t": "npm run lint && npm run build:fast && npm run build:test",
     "build:src": "npm run lint && npm run build:fast && npm run build:test && npm run build:doc && npm run build:completion",
@@ -74,7 +75,7 @@
     "ci": "npm run test && npm run catch-uncommitted",
     "lint": "npm run lint-tsconfig && npm run lint-other",
     "lint-tsconfig": "balena-lint -e ts -e js -t tsconfig.dev.json --fix automation/ lib/ tests/ typings/",
-    "lint-other": "balena-lint -e ts -e js --fix bin/balena bin/balena-dev completion/ .mocharc.js .mocharc-standalone.js",
+    "lint-other": "balena-lint -e ts -e js --fix bin/run.js bin/dev.js completion/ .mocharc.js .mocharc-standalone.js",
     "update": "ts-node --transpile-only ./automation/update-module.ts",
     "prepare": "echo {} > bin/.fast-boot.json",
     "prepublishOnly": "npm run build"
@@ -102,6 +103,7 @@
     "bin": "balena",
     "commands": "./build/commands",
     "helpClass": "./build/help",
+    "topicSeparator": " ",
     "hooks": {
       "prerun": "./build/hooks/prerun/track",
       "command_not_found": "./build/hooks/command-not-found/suggest"
@@ -111,11 +113,11 @@
     ],
     "macos": {
       "identifier": "io.balena.cli",
-      "sign": "Developer ID Installer: Balena Ltd (66H43P8FRG)"
+      "sign": "\"Developer ID Installer: Balena Ltd (66H43P8FRG)\""
     }
   },
   "devDependencies": {
-    "@balena/lint": "^7.2.1",
+    "@balena/lint": "^8.0.0",
     "@electron/notarize": "^2.0.0",
     "@octokit/plugin-throttling": "^3.5.1",
     "@octokit/rest": "^18.6.7",
@@ -181,6 +183,7 @@
     "inline-source-cli": "^2.0.0",
     "intercept-stdout": "^0.1.2",
     "jsonwebtoken": "^8.5.1",
+    "klaw": "^3.0.0",
     "mkdirp": "^1.0.4",
     "mocha": "^8.4.0",
     "mock-require": "^3.0.3",
@@ -199,7 +202,7 @@
     "@balena/dockerignore": "^1.0.2",
     "@balena/env-parsing": "^1.1.8",
     "@balena/es-version": "^1.0.1",
-    "@oclif/core": "^3.14.1",
+    "@oclif/core": "^3.24.0",
     "@resin.io/valid-email": "^0.1.0",
     "@sentry/node": "^6.16.1",
     "@types/fast-levenshtein": "0.0.1",
@@ -245,7 +248,6 @@
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
     "JSONStream": "^1.0.3",
-    "klaw": "^3.0.0",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
     "minimatch": "^3.0.4",
@@ -286,6 +288,6 @@
     "windosu": "^0.3.0"
   },
   "versionist": {
-    "publishedAt": "2024-02-06T12:19:36.007Z"
+    "publishedAt": "2024-03-14T15:52:35.905Z"
   }
 }

patches/all/@oclif+core+3.26.0.patch

@@ -12,19 +12,21 @@ index 607d8dc..07ba1f2 100644
      return lines.join('\n');
  }
 diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
-index 63c0545..7caad4a 100644
+index bc54de4..cb246ce 100644
 --- a/node_modules/@oclif/core/lib/help/command.js
 +++ b/node_modules/@oclif/core/lib/help/command.js
-@@ -58,7 +58,7 @@ class CommandHelp extends formatter_1.HelpFormatter {
-         if (args.filter((a) => a.description).length === 0)
+@@ -59,7 +59,9 @@ class CommandHelp extends formatter_1.HelpFormatter {
              return;
          return args.map((a) => {
--            const name = a.name.toUpperCase();
-+            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
+             // Add ellipsis to indicate that the argument takes multiple values if strict is false
+-            const name = this.command.strict === false ? `${a.name.toUpperCase()}...` : a.name.toUpperCase();
++            let name = this.command.strict === false ? `${a.name.toUpperCase()}...` : a.name.toUpperCase();
++            name = a.required ? `<${name}>` : `[${name}]`;
++
              let description = a.description || '';
              if (a.default)
                  description = `${(0, theme_1.colorize)(this.config?.theme?.flagDefaultValue, `[default: ${a.default}]`)} ${description}`;
-@@ -153,14 +153,12 @@ class CommandHelp extends formatter_1.HelpFormatter {
+@@ -154,14 +156,12 @@ class CommandHelp extends formatter_1.HelpFormatter {
              label = labels.join(flag.char ? (0, theme_1.colorize)(this.config?.theme?.flagSeparator, ', ') : '  ');
          }
          if (flag.type === 'option') {
@@ -42,10 +44,10 @@ index 63c0545..7caad4a 100644
          }
          return (0, theme_1.colorize)(this.config.theme?.flag, label);
 diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
-index 242538a..efde8ac 100644
+index e1859e1..756654c 100644
 --- a/node_modules/@oclif/core/lib/help/index.js
 +++ b/node_modules/@oclif/core/lib/help/index.js
-@@ -168,11 +168,12 @@ class Help extends HelpBase {
+@@ -172,11 +172,12 @@ class Help extends HelpBase {
          }
          this.log(this.formatCommand(command));
          this.log('');
@@ -56,17 +58,17 @@ index 242538a..efde8ac 100644
              this.log('');
          }
 -        if (subCommands.length > 0) {
-+        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
++        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
              const aliases = [];
              const uniqueSubCommands = subCommands.filter((p) => {
                  aliases.push(...p.aliases);
 diff --git a/node_modules/@oclif/core/lib/parser/errors.js b/node_modules/@oclif/core/lib/parser/errors.js
-index 656ec6b..2bbf36b 100644
+index b37743a..6b2e5c3 100644
 --- a/node_modules/@oclif/core/lib/parser/errors.js
 +++ b/node_modules/@oclif/core/lib/parser/errors.js
-@@ -14,7 +14,8 @@ Object.defineProperty(exports, "CLIError", { enumerable: true, get: function ()
- class CLIParseError extends errors_1.CLIError {
+@@ -15,7 +15,8 @@ class CLIParseError extends errors_1.CLIError {
      parse;
+     showHelp = false;
      constructor(options) {
 -        options.message += '\nSee more help with --help';
 +        const help = options.command ? `\`${options.command} --help\`` : '--help';
@@ -74,7 +76,7 @@ index 656ec6b..2bbf36b 100644
          super(options.message, { exit: options.exit });
          this.parse = options.parse;
      }
-@@ -37,7 +38,8 @@ exports.InvalidArgsSpecError = InvalidArgsSpecError;
+@@ -38,7 +39,8 @@ exports.InvalidArgsSpecError = InvalidArgsSpecError;
  class RequiredArgsError extends CLIParseError {
      args;
      constructor({ args, exit, flagsWithMultiple, parse, }) {
@@ -83,13 +85,13 @@ index 656ec6b..2bbf36b 100644
 +        let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
          const namedArgs = args.filter((a) => a.name);
          if (namedArgs.length > 0) {
-             const list = (0, list_1.renderList)(namedArgs.map((a) => [a.name, a.description]));
-@@ -48,7 +50,7 @@ class RequiredArgsError extends CLIParseError {
+             const list = (0, list_1.renderList)(namedArgs.map((a) => {
+@@ -52,7 +54,7 @@ class RequiredArgsError extends CLIParseError {
              message += `\n\nNote: ${flags} allow${flagsWithMultiple.length === 1 ? 's' : ''} multiple values. Because of this you need to provide all arguments before providing ${flagsWithMultiple.length === 1 ? 'that flag' : 'those flags'}.`;
              message += '\nAlternatively, you can use "--" to signify the end of the flags and the beginning of arguments.';
          }
 -        super({ exit: cache_1.default.getInstance().get('exitCodes')?.requiredArgs ?? exit, message, parse });
 +        super({ exit: cache_1.default.getInstance().get('exitCodes')?.requiredArgs ?? exit, message, parse, command });
          this.args = args;
+         this.showHelp = true;
      }
- }

patches/all/oclif+3.17.2.dev.patch

@@ -1,19 +1,5 @@
-diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
-index d06d0b3..c571fe3 100644
---- a/node_modules/oclif/lib/commands/pack/macos.js
-+++ b/node_modules/oclif/lib/commands/pack/macos.js
-@@ -177,7 +177,8 @@ class PackMacos extends core_1.Command {
-             if (process.env.OSX_KEYCHAIN)
-                 args.push('--keychain', process.env.OSX_KEYCHAIN);
-             args.push(dist);
--            await exec(`pkgbuild  ${args.join(' ')}`);
-+            console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
-+            await exec(`pkgbuild  "${args.join('" "')}"`);
-         };
-         const arches = _.uniq(buildConfig.targets
-             .filter(t => t.platform === 'darwin')
 diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index c0926bd..a37cd6e 100644
+index c0926bd..e4f645c 100644
 --- a/node_modules/oclif/lib/commands/pack/win.js
 +++ b/node_modules/oclif/lib/commands/pack/win.js
 @@ -59,6 +59,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
@@ -29,46 +15,25 @@ index c0926bd..a37cd6e 100644
    SetOutPath $INSTDIR
    File /r bin
    File /r client
-@@ -226,7 +232,8 @@ class PackWin extends core_1.Command {
-                 fs.writeFile(path.join(installerBase, 'bin', `${flags['additional-cli']}`), scripts.sh({ bin: flags['additional-cli'] })),
-             ] : []));
-             await fs.move(buildConfig.workspace({ platform: 'win32', arch }), path.join(installerBase, 'client'));
--            await exec(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-+            const { msysExec, toMsysPath } = require("../../util");
-+            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-             const templateKey = (0, upload_util_1.templateShortKey)('win32', { bin: config.bin, version: config.version, sha: buildConfig.gitSha, arch });
-             const o = buildConfig.dist(`win32/${templateKey}`);
-             await fs.move(path.join(installerBase, 'installer.exe'), o);
 diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index 384ea4b..602daa4 100644
+index 384ea4b..c9607f3 100644
 --- a/node_modules/oclif/lib/tarballs/build.js
 +++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -21,7 +21,8 @@ const pack = async (from, to) => {
-         await exec(`tar cfJ ${to} ${(path.basename(from))}`, { cwd }));
- };
- async function build(c, options = {}) {
--    const { xz, config } = c;
-+    const { xz, config, tmp } = c;
-+    console.error(`[debug] oclif c.root="${c.root}" c.workspace()="${c.workspace()}"`);
-     const packCLI = async () => {
-         const { stdout } = await exec('npm pack --unsafe-perm', { cwd: c.root });
-         return path.join(c.root, stdout.trim().split('\n').pop());
-@@ -30,7 +31,8 @@ async function build(c, options = {}) {
+@@ -30,7 +30,9 @@ async function build(c, options = {}) {
          await fs.emptyDir(c.workspace());
          const tarballNewLocation = path.join(c.workspace(), path.basename(tarball));
          await fs.move(tarball, tarballNewLocation);
 -        await exec(`tar -xzf "${tarballNewLocation}"`, { cwd: c.workspace() });
-+        const { msysExec, toMsysPath } = require("../util");
-+        await msysExec(`tar -xzf ${toMsysPath(tarballNewLocation)}`, { cwd: c.workspace() });
++        let tarCmd = `tar -xzf "${tarballNewLocation}"`;
++        if (process.platform === 'win32') tarCmd += ' --force-local';
++        await exec(tarCmd, { cwd: c.workspace() });
          await Promise.all((await fs.promises.readdir(path.join(c.workspace(), 'package'), { withFileTypes: true }))
              .map(i => fs.move(path.join(c.workspace(), 'package', i.name), path.join(c.workspace(), i.name))));
          await Promise.all([
-@@ -38,6 +40,13 @@ async function build(c, options = {}) {
+@@ -38,6 +40,11 @@ async function build(c, options = {}) {
              fs.promises.rm(path.join(c.workspace(), path.basename(tarball)), { recursive: true }),
              fs.remove(path.join(c.workspace(), 'bin', 'run.cmd')),
          ]);
-+        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
-+        await fs.move(path.join(c.workspace(), 'bin', 'balena'), path.join(c.workspace(), 'bin', 'run'));
 +        // The oclif installers are a production installation, while the source
 +        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
 +        // This has previously led to issues preventing the CLI from starting, so
@@ -77,209 +42,3 @@ index 384ea4b..602daa4 100644
      };
      const updatePJSON = async () => {
          const pjsonPath = path.join(c.workspace(), 'package.json');
-@@ -49,35 +58,20 @@ async function build(c, options = {}) {
-         await fs.writeJSON(pjsonPath, pjson, { spaces: 2 });
-     };
-     const addDependencies = async () => {
--        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
--        if (fs.existsSync(path.join(yarnRoot, 'yarn.lock'))) {
--            await fs.copy(path.join(yarnRoot, 'yarn.lock'), path.join(c.workspace(), 'yarn.lock'));
--            const yarnVersion = (await exec('yarn -v')).stdout.charAt(0);
--            if (yarnVersion === '1') {
--                await exec('yarn --no-progress --production --non-interactive', { cwd: c.workspace() });
--            }
--            else if (yarnVersion === '2') {
--                throw new Error('Yarn 2 is not supported yet. Try using Yarn 1, or Yarn 3');
--            }
--            else {
--                try {
--                    await exec('yarn workspaces focus --production', { cwd: c.workspace() });
--                }
--                catch (error) {
--                    if (error instanceof Error && error.message.includes('Command not found')) {
--                        throw new Error('Missing workspace tools. Run `yarn plugin import workspace-tools`.');
--                    }
--                    throw error;
--                }
--            }
--        }
--        else {
--            const lockpath = fs.existsSync(path.join(c.root, 'package-lock.json')) ?
--                path.join(c.root, 'package-lock.json') :
--                path.join(c.root, 'npm-shrinkwrap.json');
--            await fs.copy(lockpath, path.join(c.workspace(), path.basename(lockpath)));
--            await exec('npm install --production', { cwd: c.workspace() });
-+        const ws = c.workspace();
-+        exec(`cd ${ws}`);
-+        console.error(`[debug] oclif copying node_modules to "${ws}"`)
-+        const source = path.join(c.root, 'node_modules');
-+        if (process.platform === 'win32') {
-+            await exec(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
-+        } else {
-+            // use the shell's `cp` on macOS in order to preserve extended
-+            // file attributes containing `codesign` digital signatures
-+            await exec(`cp -pR "${source}" "${ws}"`);
-         }
-+        console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
-+        await exec('npm prune --production', { cwd: c.workspace() });
-+        console.error(`[debug] oclif done`);
-     };
-     const pretarball = async () => {
-         const pjson = await fs.readJSON(path.join(c.workspace(), 'package.json'));
-@@ -115,7 +109,8 @@ async function build(c, options = {}) {
-             output: path.join(workspace, 'bin', 'node'),
-             platform: target.platform,
-             arch: target.arch,
--            tmp: path.join(config.root, 'tmp'),
-+            tmp,
-+            projectRootPath: c.root
-         });
-         if (options.pack === false)
-             return;
-@@ -158,6 +153,7 @@ async function build(c, options = {}) {
-         await fs.writeJSON(manifestFilepath, manifest, { spaces: 2 });
-     };
-     (0, log_1.log)(`gathering workspace for ${config.bin} to ${c.workspace()}`);
-+    console.error(`[debug] ${options.tarball}`);
-     await extractCLI(options.tarball ? options.tarball : await packCLI());
-     await updatePJSON();
-     await addDependencies();
-diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
-index 216759d..cab0e6e 100644
---- a/node_modules/oclif/lib/tarballs/config.js
-+++ b/node_modules/oclif/lib/tarballs/config.js
-@@ -25,7 +25,10 @@ async function gitSha(cwd, options = {}) {
- }
- exports.gitSha = gitSha;
- async function Tmp(config) {
--    const tmp = path.join(config.root, 'tmp');
-+     const tmp = process.env.BUILD_TMP
-+         ? path.join(process.env.BUILD_TMP, 'oclif')
-+         : path.join(config.root, 'tmp');
-+    console.error(`[debug] oclif tmp="${tmp}"`);
-     await fs.promises.mkdir(tmp, { recursive: true });
-     return tmp;
- }
-@@ -62,7 +65,7 @@ async function buildConfig(root, options = {}) {
-         s3Config: updateConfig.s3,
-         nodeVersion,
-         workspace(target) {
--            const base = path.join(config.root, 'tmp');
-+            const base = tmp;
-             if (target && target.platform)
-                 return path.join(base, [target.platform, target.arch].join('-'), (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
-             return path.join(base, (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
-diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
-index 35f1d0c..5349eaa 100644
---- a/node_modules/oclif/lib/tarballs/node.js
-+++ b/node_modules/oclif/lib/tarballs/node.js
-@@ -12,6 +12,7 @@ const retry = require("async-retry");
- const util_2 = require("../util");
- const pipeline = (0, util_1.promisify)(stream_1.pipeline);
- const exec = (0, util_1.promisify)(child_process_1.exec);
-+const { isMSYS2, msysExec, toMsysPath } = require("../util");
- const RETRY_TIMEOUT_MS = 1000;
- async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-     if (arch === 'arm')
-@@ -42,8 +43,10 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         const basedir = path.dirname(tarball);
-         await fs.promises.mkdir(basedir, { recursive: true });
-         await pipeline(got_1.default.stream(url), fs.createWriteStream(tarball));
--        if (platform !== 'win32')
--            await exec(`grep "${path.basename(tarball)}" "${shasums}" | shasum -a 256 -c -`, { cwd: basedir });
-+        if (platform !== 'win32') {
-+            const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
-+            await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
-+        }
-     };
-     const extract = async () => {
-         (0, log_1.log)(`extracting ${nodeBase}`);
-@@ -51,7 +54,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         await fs.promises.mkdir(nodeTmp, { recursive: true });
-         await fs.promises.mkdir(path.dirname(cache), { recursive: true });
-         if (platform === 'win32') {
--            await exec(`7z x -bd -y "${tarball}"`, { cwd: nodeTmp });
-+            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`, { cwd: nodeTmp });
-             await fs.move(path.join(nodeTmp, nodeBase, 'node.exe'), path.join(cache, 'node.exe'));
-         }
-         else {
-diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
-index 6963e4d..430472d 100644
---- a/node_modules/oclif/lib/upload-util.js
-+++ b/node_modules/oclif/lib/upload-util.js
-@@ -31,10 +31,10 @@ options = { root: '.' }) {
-     const templates = {
-         baseDir: '<%- bin %>',
-         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
--        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
--        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
--        macos: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.pkg',
--        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
-+        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
-+        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
-+        macos: '<%- bin %>-v<%- version %>.pkg',
-+        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
-         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
-     };
-     return _.template(templates[type])(Object.assign({}, options));
-diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
-index 816c71b..1384aa6 100644
---- a/node_modules/oclif/lib/util.js
-+++ b/node_modules/oclif/lib/util.js
-@@ -95,9 +95,10 @@ const hash = async (algo, fp) => {
-     });
- };
- exports.hash = hash;
-+
- async function checkFor7Zip() {
-     try {
--        await exec('7z');
-+        await msysExec('7z', { stdio: [0, null, 2] });
-     }
-     catch (error) {
-         if (error.code === 127)
-@@ -107,3 +108,44 @@ async function checkFor7Zip() {
-     }
- }
- exports.checkFor7Zip = checkFor7Zip;
-+
-+// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
-+// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
-+// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
-+const isCygwin = process.env.OSTYPE === 'cygwin';
-+const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
-+const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
-+const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
-+    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
-+        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
-+            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
-+
-+exports.isCygwin = isCygwin;
-+exports.isMinGW = isMinGW;
-+exports.isMSYS2 = isMSYS2;
-+console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
-+
-+/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
-+function toMsysPath(windowsPath) {
-+    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
-+    let msysPath = windowsPath.replace(/\\/g, '/');
-+    if (isMSYS2 || isMinGW) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
-+    } else if (isCygwin) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
-+    }
-+    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
-+    return msysPath;
-+}
-+exports.toMsysPath = toMsysPath;
-+
-+async function msysExec(cmd, options = {}) {
-+    if (process.platform !== 'win32') {
-+        return exec(cmd, options);
-+    }
-+    const sh = MSYSSHELLPATH;
-+    const args = ['-c', cmd];
-+    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
-+    return exec(`"${sh}" "${args.join('" "')}"`, options);
-+}
-+exports.msysExec = msysExec;

tests/commands/build.spec.ts

@@ -26,9 +26,11 @@ import { BalenaAPIMock } from '../nock/balena-api-mock';
 import { expectStreamNoCRLF, testDockerBuildStream } from '../docker-build';
 import { DockerMock, dockerResponsePath } from '../nock/docker-mock';
 import { cleanOutput, runCommand } from '../helpers';
-import {
+import type {
 	ExpectedTarStreamFiles,
 	ExpectedTarStreamFilesByService,
+} from '../projects';
+import {
 	getDockerignoreWarn1,
 	getDockerignoreWarn2,
 	getDockerignoreWarn3,

tests/commands/deploy.spec.ts

@@ -20,7 +20,7 @@ import type { Request as ReleaseRequest } from '@balena/compose/dist/release';
 import { expect } from 'chai';
 import { promises as fs } from 'fs';
 import * as _ from 'lodash';
-import * as nock from 'nock';
+import type * as nock from 'nock';
 import * as path from 'path';
 import * as sinon from 'sinon';
 
@@ -28,12 +28,11 @@ import { BalenaAPIMock } from '../nock/balena-api-mock';
 import { expectStreamNoCRLF, testDockerBuildStream } from '../docker-build';
 import { DockerMock, dockerResponsePath } from '../nock/docker-mock';
 import { cleanOutput, runCommand, switchSentry } from '../helpers';
-import {
+import type {
 	ExpectedTarStreamFiles,
 	ExpectedTarStreamFilesByService,
-	getDockerignoreWarn1,
-	getDockerignoreWarn3,
 } from '../projects';
+import { getDockerignoreWarn1, getDockerignoreWarn3 } from '../projects';
 
 const repoPath = path.normalize(path.join(__dirname, '..', '..'));
 const projectsPath = path.join(repoPath, 'tests', 'test-data', 'projects');

tests/commands/push.spec.ts

@@ -23,10 +23,10 @@ import { BalenaAPIMock } from '../nock/balena-api-mock';
 import { BuilderMock, builderResponsePath } from '../nock/builder-mock';
 import { expectStreamNoCRLF, testPushBuildStream } from '../docker-build';
 import { cleanOutput, runCommand } from '../helpers';
+import type { ExpectedTarStreamFiles } from '../projects';
 import {
 	addRegSecretsEntries,
 	exists,
-	ExpectedTarStreamFiles,
 	getDockerignoreWarn1,
 	getDockerignoreWarn2,
 	getDockerignoreWarn3,

tests/commands/ssh.spec.ts

@@ -17,7 +17,8 @@
 
 import { expect } from 'chai';
 import mock = require('mock-require');
-import { createServer, Server } from 'net';
+import type { Server } from 'net';
+import { createServer } from 'net';
 
 import { BalenaAPIMock } from '../nock/balena-api-mock';
 import { cleanOutput, runCommand } from '../helpers';

tests/deprecation.spec.ts

@@ -23,13 +23,12 @@ import * as semver from 'semver';
 import * as sinon from 'sinon';
 
 import * as packageJSON from '../package.json';
-import {
-	DeprecationChecker,
-	ReleaseTimestampsByVersion,
-} from '../build/deprecation';
+import type { ReleaseTimestampsByVersion } from '../build/deprecation';
+import { DeprecationChecker } from '../build/deprecation';
 import { BalenaAPIMock } from './nock/balena-api-mock';
 import { NpmMock } from './nock/npm-mock';
-import { runCommand, TestOutput } from './helpers';
+import type { TestOutput } from './helpers';
+import { runCommand } from './helpers';
 
 // "itSS" means "it() Skip Standalone"
 const itSS = process.env.BALENA_CLI_TEST_TYPE === 'standalone' ? it.skip : it;

tests/docker-build.ts

@@ -29,15 +29,15 @@ import { URL } from 'url';
 
 import { makeImageName } from '../build/utils/compose_ts';
 import { stripIndent } from '../build/utils/lazy';
-import { BuilderMock } from './nock/builder-mock';
-import { DockerMock } from './nock/docker-mock';
+import type { BuilderMock } from './nock/builder-mock';
+import type { DockerMock } from './nock/docker-mock';
 import {
 	cleanOutput,
 	deepJsonParse,
 	deepTemplateReplace,
 	runCommand,
 } from './helpers';
-import {
+import type {
 	ExpectedTarStreamFile,
 	ExpectedTarStreamFiles,
 	ExpectedTarStreamFilesByService,

tests/nock/balena-api-mock.ts

@@ -18,7 +18,8 @@
 import * as _ from 'lodash';
 import * as path from 'path';
 
-import { NockMock, ScopeOpts } from './nock-mock';
+import type { ScopeOpts } from './nock-mock';
+import { NockMock } from './nock-mock';
 
 export const apiResponsePath = path.normalize(
 	path.join(__dirname, '..', 'test-data', 'api-response'),

tests/nock/docker-mock.ts

@@ -18,7 +18,8 @@
 import * as path from 'path';
 import * as qs from 'querystring';
 
-import { NockMock, ScopeOpts } from './nock-mock';
+import type { ScopeOpts } from './nock-mock';
+import { NockMock } from './nock-mock';
 
 export const dockerResponsePath = path.normalize(
 	path.join(__dirname, '..', 'test-data', 'docker-response'),

tests/nock/supervisor-mock.ts

@@ -17,7 +17,8 @@
 import * as path from 'path';
 import { Readable } from 'stream';
 
-import { NockMock, ScopeOpts } from './nock-mock';
+import type { ScopeOpts } from './nock-mock';
+import { NockMock } from './nock-mock';
 
 export const dockerResponsePath = path.normalize(
 	path.join(__dirname, '..', 'test-data', 'docker-response'),

tests/proxy.spec.ts

@@ -17,10 +17,8 @@
 
 import { expect } from 'chai';
 
-import {
-	GlobalTunnelNgConfig,
-	makeUrlFromTunnelNgConfig,
-} from '../build/utils/proxy';
+import type { GlobalTunnelNgConfig } from '../build/utils/proxy';
+import { makeUrlFromTunnelNgConfig } from '../build/utils/proxy';
 
 describe('makeUrlFromTunnelNgConfig() function', function () {
 	it('should return a URL given a GlobalTunnelNgConfig object', () => {

tests/test-data/pkg/expected-warnings-darwin-arm64.txt

@@ -0,0 +1,172 @@
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/open/xdg-open
+  %2: path-to-executable/xdg-open
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/open/xdg-open
+  %2: path-to-executable/xdg-open
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/etcher-sdk/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot resolve 'path'
+  node_modules/@balena/compose/dist/parse/schemas/index.js
+  Dynamic require may fail at run time, because the requested file
+  is unknown at compilation time and not included into executable.
+  Use a string literal as an argument for 'require', or leave it
+  as is and specify the resolved file name in 'scripts' option.
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/build/Release/drivelist.node
+  %2: path-to-executable/drivelist.node
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/darwin.sh
+  %2: path-to-executable/drivelist/darwin.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/linux.sh
+  %2: path-to-executable/drivelist/linux.sh
+> Warning Cannot include file %1 into executable.
+  The file must be distributed with executable as %2.
+  %1: node_modules/resin-cli-visuals/node_modules/drivelist/scripts/win32.bat
+  %2: path-to-executable/drivelist/win32.bat
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/axios.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/utils.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/adapters/adapters.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/adapters/http.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/adapters/xhr.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/cancel/CancelToken.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/cancel/CanceledError.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/cancel/isCancel.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/Axios.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/AxiosError.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/AxiosHeaders.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/InterceptorManager.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/buildFullPath.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/dispatchRequest.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/mergeConfig.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/settle.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/core/transformData.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/defaults/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/defaults/transitional.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/env/data.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/AxiosTransformStream.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/AxiosURLSearchParams.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/HttpStatusCode.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/ZlibHeaderTransformStream.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/bind.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/buildURL.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/callbackify.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/combineURLs.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/cookies.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/formDataToJSON.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/formDataToStream.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/fromDataURI.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/isAbsoluteURL.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/isAxiosError.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/isURLSameOrigin.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/parseHeaders.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/parseProtocol.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/readBlob.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/speedometer.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/spread.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/throttle.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/toFormData.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/toURLEncodedForm.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/helpers/validator.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/platform/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/platform/common/utils.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/platform/node/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/platform/node/classes/FormData.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/axios/lib/platform/node/classes/URLSearchParams.js
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+> Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/string-width/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/strip-ansi/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/wrap-ansi/index.js
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+> Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/ansi-regex/index.js
+> Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/ansi-styles/index.js
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=darwin)

tests/test-data/pkg/expected-warnings-darwin-x64.txt

@@ -168,4 +168,5 @@ prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtim
 prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=x64 libc= platform=darwin)
 > Warning Failed to make bytecode node20-x64 for file node_modules/@isaacs/cliui/node_modules/ansi-regex/index.js
 > Warning Failed to make bytecode node20-x64 for file node_modules/@isaacs/cliui/node_modules/ansi-styles/index.js
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=x64 libc= platform=darwin)
 prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=x64 libc= platform=darwin)

tests/test-data/pkg/expected-warnings-linux-arm64.txt

@@ -168,3 +168,4 @@ prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtim
 > Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/ansi-regex/index.js
 > Warning Failed to make bytecode node20-arm64 for file node_modules/@isaacs/cliui/node_modules/ansi-styles/index.js
 prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=arm64 libc= platform=linux)

tests/test-data/pkg/expected-warnings-linux-x64.txt

@@ -168,3 +168,4 @@ prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtim
 > Warning Failed to make bytecode node20-x64 for file node_modules/@isaacs/cliui/node_modules/ansi-regex/index.js
 > Warning Failed to make bytecode node20-x64 for file node_modules/@isaacs/cliui/node_modules/ansi-styles/index.js
 prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=x64 libc= platform=linux)
+prebuild-install warn install No prebuilt binaries found (target=v20.10.0 runtime=node arch=x64 libc= platform=linux)

tests/utils/device/live.spec.ts

@@ -16,7 +16,7 @@
  */
 
 import { expect } from 'chai';
-import * as chokidar from 'chokidar';
+import type * as chokidar from 'chokidar';
 import { promises as fs } from 'fs';
 import * as path from 'path';
 import { promisify } from 'util';

tests/utils/docker.spec.ts

@@ -17,8 +17,8 @@
 
 import { expect } from 'chai';
 
+import type { DockerConnectionCliFlags } from '../../build/utils/docker';
 import {
-	DockerConnectionCliFlags,
 	generateConnectOpts,
 	getDefaultDockerModemOpts,
 } from '../../build/utils/docker';

typings/balena-device-init/index.d.ts

@@ -17,7 +17,7 @@
 
 declare module 'balena-device-init' {
 	import { DeviceTypeJson } from 'balena-sdk';
-	import * as Bluebird from 'bluebird';
+	import type * as Bluebird from 'bluebird';
 
 	interface OperationState {
 		operation:

typings/global.d.ts

@@ -1,4 +1,4 @@
-import { Application, DeviceType, Device } from 'balena-sdk';
+import type { Application, DeviceType, Device } from 'balena-sdk';
 
 declare global {
 	type ApplicationWithDeviceTypeSlug = Omit<