Add balena update command for updating the CLI

Change-type: minor

.github/actions/publish/action.yml

@@ -3,29 +3,29 @@ name: package and draft GitHub release
 # https://github.com/product-os/flowzone/tree/master/.github/actions
 inputs:
   json:
-    description: "JSON stringified object containing all the inputs from the calling workflow"
+    description: 'JSON stringified object containing all the inputs from the calling workflow'
     required: true
   secrets:
-    description: "JSON stringified object containing all the secrets from the calling workflow"
+    description: 'JSON stringified object containing all the secrets from the calling workflow'
     required: true
   variables:
-    description: "JSON stringified object containing all the variables from the calling workflow"
+    description: 'JSON stringified object containing all the variables from the calling workflow'
     required: true
 
   # --- custom environment
   XCODE_APP_LOADER_EMAIL:
     type: string
-    default: "accounts+apple@balena.io"
+    default: 'accounts+apple@balena.io'
   NODE_VERSION:
     type: string
     default: '16.x'
   VERBOSE:
     type: string
-    default: "true"
+    default: 'true'
 
 runs:
   # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
-  using: "composite"
+  using: 'composite'
   steps:
     - name: Download custom source artifact
       uses: actions/download-artifact@v3
@@ -124,6 +124,7 @@ runs:
         # Apple notarization (automation/build-bin.ts)
         XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
         XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
+        XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
 
     - name: Upload artifacts
       uses: actions/upload-artifact@v3

.github/workflows/flowzone.yml

@@ -26,4 +26,4 @@ jobs:
       custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
       repo_config: true
       repo_description: "The official balena CLI tool."
-      github_prerelease: true
+      github_prerelease: false

.versionbot/CHANGELOG.yml

@@ -1,3 +1,111 @@
+- commits:
+    - subject: Remove redundant dependency on docker-toolbelt
+      hash: 0f4054fa4ddf74a8c7ec869bef74cee43f182df1
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Akis Kesoglou
+      nested: []
+    - subject: Pin dockerode to v3.3.3
+      hash: 7545fc5d6e3d2c224a6c2024678b872538e3795c
+      body: >
+        v3.3.4 introduces a regression that is fixed by
+        https://github.com/apocas/dockerode/pull/695 but Dockerode has not
+        published a version that includes the fix yet. Pin the dependency to
+        ensure we don’t ever update to a broken version.
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Akis Kesoglou
+      nested: []
+  version: 16.6.3
+  title: ""
+  date: 2023-06-30T17:07:32.165Z
+- commits:
+    - subject: "macos notarization: Expose team ID instead of keeping it in secrets"
+      hash: d843e75512ebb9a54f00207b1b17aa65dc3244fc
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: myarmolinsky
+      nested: []
+  version: 16.6.2
+  title: ""
+  date: 2023-06-29T12:27:11.915Z
+- commits:
+    - subject: Drop `electron-notarize` dependency in favor of `@electron/notarize`
+      hash: 10b5af69679d04323c920d7fc08b9d691b6590b2
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: myarmolinsky
+      nested: []
+  version: 16.6.1
+  title: ""
+  date: 2023-06-28T12:47:54.665Z
+- commits:
+    - subject: "api-key: Add `revoke` command which accepts a list of API key ids"
+      hash: 4b1378dfbcfdac45adeb3ac39aa101c02ed21c90
+      body: ""
+      footer:
+        Change-type: minor
+        change-type: minor
+      author: myarmolinsky
+      nested: []
+  version: 16.6.0
+  title: ""
+  date: 2023-06-26T13:05:09.313Z
+- commits:
+    - subject: Re-enable automatic github final releases
+      hash: bc405d997e33b975aeda53583890ee7578c98496
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Kyle Harding
+      nested: []
+  version: 16.5.2
+  title: ""
+  date: 2023-06-09T16:03:07.855Z
+- commits:
+    - subject: Update TypeScript to 5.1.3
+      hash: abd73b805b542be4dda02845f8224ed4136455ca
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Thodoris Greasidis
+      nested: []
+  version: 16.5.1
+  title: ""
+  date: 2023-06-02T06:29:58.265Z
+- commits:
+    - subject: Add `balena block create` command for creating Blocks
+      hash: 9975e5d9ac566e9535b43041186f0ad158a19b19
+      body: ""
+      footer:
+        Change-type: minor
+        change-type: minor
+      author: myarmolinsky
+      nested: []
+  version: 16.5.0
+  title: ""
+  date: 2023-05-25T16:45:00.106Z
+- commits:
+    - subject: Add `balena app create` command for creatings Apps
+      hash: c5e8f0d6ea4c958b3b3c63e70ac8540fbf83b779
+      body: ""
+      footer:
+        Change-type: minor
+        change-type: minor
+      author: myarmolinsky
+      nested: []
+  version: 16.4.0
+  title: ""
+  date: 2023-05-25T15:53:21.350Z
 - commits:
     - subject: Add `balena api-keys` command for listing user/fleet API keys
       hash: 166130c3df354531c0699205d9f2ef21ffd6bed6

CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 16.6.3 - 2023-06-30
+
+* Remove redundant dependency on docker-toolbelt [Akis Kesoglou]
+* Pin dockerode to v3.3.3 [Akis Kesoglou]
+
+## 16.6.2 - 2023-06-29
+
+* macos notarization: Expose team ID instead of keeping it in secrets [myarmolinsky]
+
+## 16.6.1 - 2023-06-28
+
+* Drop `electron-notarize` dependency in favor of `@electron/notarize` [myarmolinsky]
+
+## 16.6.0 - 2023-06-26
+
+* api-key: Add `revoke` command which accepts a list of API key ids [myarmolinsky]
+
+## 16.5.2 - 2023-06-09
+
+* Re-enable automatic github final releases [Kyle Harding]
+
+## 16.5.1 - 2023-06-02
+
+* Update TypeScript to 5.1.3 [Thodoris Greasidis]
+
+## 16.5.0 - 2023-05-25
+
+* Add `balena block create` command for creating Blocks [myarmolinsky]
+
+## 16.4.0 - 2023-05-25
+
+* Add `balena app create` command for creatings Apps [myarmolinsky]
+
 ## 16.3.0 - 2023-05-25
 
 * Add `balena api-keys` command for listing user/fleet API keys [myarmolinsky]

automation/build-bin.ts

@@ -465,16 +465,17 @@ async function signWindowsInstaller() {
  * Wait for Apple Installer Notarization to continue
  */
 async function notarizeMacInstaller(): Promise<void> {
+	const teamId = process.env.XCODE_APP_LOADER_TEAM_ID || '66H43P8FRG';
 	const appleId =
 		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
-	const appBundleId = packageJSON.oclif.macos.identifier || 'io.balena.cli';
 	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
 
-	if (appleIdPassword) {
-		const { notarize } = await import('electron-notarize');
-		// https://github.com/electron/notarize/blob/main/README.md
+	if (appleIdPassword && teamId) {
+		const { notarize } = await import('@electron/notarize');
+		// https://github.com/electron/notarize#readme
 		await notarize({
-			appBundleId,
+			tool: 'notarytool',
+			teamId,
 			appPath: renamedOclifInstallers.darwin,
 			appleId,
 			appleIdPassword,

completion/_balena

@@ -8,9 +8,11 @@ _balena() {
   local context state line curcontext="$curcontext"
 
   # Valid top-level completions
-  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys config device device devices env fleet fleet internal key key local os release release tag util )
+  main_commands=( build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util )
   # Sub-completions
-  api_key_cmds=( generate )
+  api_key_cmds=( generate revoke )
+  app_cmds=( create )
+  block_cmds=( create )
   config_cmds=( generate inject read reconfigure write )
   device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet )
   devices_cmds=( supported )
@@ -43,6 +45,12 @@ _balena_sec_cmds() {
       "api-key")
         _describe -t api_key_cmds 'api-key_cmd' api_key_cmds "$@" && ret=0
       ;;
+      "app")
+        _describe -t app_cmds 'app_cmd' app_cmds "$@" && ret=0
+      ;;
+      "block")
+        _describe -t block_cmds 'block_cmd' block_cmds "$@" && ret=0
+      ;;
       "config")
         _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
       ;;

completion/balena-completion.bash

@@ -7,9 +7,11 @@ _balena_complete()
   local cur prev
 
   # Valid top-level completions
-  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys config device device devices env fleet fleet internal key key local os release release tag util"
+  main_commands="build deploy envs fleets join keys leave login logout logs note orgs preload push releases scan settings ssh support tags tunnel version whoami api-key api-keys app block config device device devices env fleet fleet internal key key local os release release tag util"
   # Sub-completions
-  api_key_cmds="generate"
+  api_key_cmds="generate revoke"
+  app_cmds="create"
+  block_cmds="create"
   config_cmds="generate inject read reconfigure write"
   device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet"
   devices_cmds="supported"
@@ -37,6 +39,12 @@ _balena_complete()
       api-key)
         COMPREPLY=( $(compgen -W "$api_key_cmds" -- $cur) )
         ;;
+      app)
+        COMPREPLY=( $(compgen -W "$app_cmds" -- $cur) )
+        ;;
+      block)
+        COMPREPLY=( $(compgen -W "$block_cmds" -- $cur) )
+        ;;
       config)
         COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
         ;;

lib/commands/api-key/revoke.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	ids: string;
+}
+
+export default class RevokeCmd extends Command {
+	public static description = stripIndent`
+		Revoke balenaCloud API keys.
+
+		Revoke balenaCloud API keys with the given
+		comma-separated list of ids.
+
+		The given balenaCloud API keys will no longer be usable.
+`;
+	public static examples = [
+		'$ balena api-key revoke 123',
+		'$ balena api-key revoke 123,124,456',
+	];
+
+	public static args = [
+		{
+			name: 'ids',
+			description: 'the API key ids',
+			required: true,
+		},
+	];
+
+	public static usage = 'api-key revoke <ids>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(RevokeCmd);
+
+		try {
+			const apiKeyIds = params.ids.split(',');
+			if (apiKeyIds.filter((apiKeyId) => !apiKeyId.match(/^\d+$/)).length > 0) {
+				console.log('API key ids must be positive integers');
+				return;
+			}
+			await Promise.all(
+				apiKeyIds.map(
+					async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
+				),
+			);
+			console.log('Successfully revoked the given API keys');
+		} catch (e) {
+			throw e;
+		}
+	}
+}

lib/commands/app/create.ts

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an app.
+
+		Create a new balena app.
+
+		You can specify the organization the app should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The app's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena app create MyApp',
+		'$ balena app create MyApp --organization mmyorg',
+		'$ balena app create MyApp -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'app name',
+			required: true,
+		},
+	];
+
+	public static usage = 'app create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the app should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'app device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppCreateCmd,
+		);
+
+		// Ascertain device type
+		const deviceType =
+			options.type ||
+			(await (await import('../../utils/patterns')).selectDeviceType());
+
+		// Ascertain organization
+		const organization =
+			options.organization?.toLowerCase() || (await this.getOrganization());
+
+		// Create application
+		try {
+			const application = await getBalenaSdk().models.application.create({
+				name: params.name,
+				deviceType,
+				organization,
+				applicationClass: 'app',
+			});
+
+			// Output
+			console.log(
+				`App created: slug "${application.slug}", device type "${deviceType}"`,
+			);
+		} catch (err) {
+			if ((err.message || '').toLowerCase().includes('unique')) {
+				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+				throw new ExpectedError(
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+				);
+			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+				// BalenaRequestError: Request error: Unauthorized
+				throw new ExpectedError(
+					`Error: You are not authorized to create apps in organization "${organization}".`,
+				);
+			}
+
+			throw err;
+		}
+	}
+
+	async getOrganization() {
+		const { getOwnOrganizations } = await import('../../utils/sdk');
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
+
+		if (organizations.length === 0) {
+			// User is not a member of any organizations (should not happen).
+			throw new Error('This account is not a member of any organizations');
+		} else if (organizations.length === 1) {
+			// User is a member of only one organization - use this.
+			return organizations[0].handle;
+		} else {
+			// User is a member of multiple organizations -
+			const { selectOrganization } = await import('../../utils/patterns');
+			return selectOrganization(organizations);
+		}
+	}
+}

lib/commands/block/create.ts

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2016-2021 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	organization?: string;
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class BlockCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an block.
+
+		Create a new balena block.
+
+		You can specify the organization the block should belong to using
+		the \`--organization\` option. The organization's handle, not its name,
+		should be provided. Organization handles can be listed with the
+		\`balena orgs\` command.
+
+		The block's default device type is specified with the \`--type\` option.
+		The \`balena devices supported\` command can be used to list the available
+		device types.
+
+		Interactive dropdowns will be shown for selection if no device type or
+		organization is specified and there are multiple options to choose from.
+		If there is a single option to choose from, it will be chosen automatically.
+		This interactive behavior can be disabled by explicitly specifying a device
+		type and organization.
+	`;
+
+	public static examples = [
+		'$ balena block create MyBlock',
+		'$ balena block create MyBlock --organization mmyorg',
+		'$ balena block create MyBlock -o myorg --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'block name',
+			required: true,
+		},
+	];
+
+	public static usage = 'block create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		organization: flags.string({
+			char: 'o',
+			description: 'handle of the organization the block should belong to',
+		}),
+		type: flags.string({
+			char: 't',
+			description:
+				'block device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			BlockCreateCmd,
+		);
+
+		// Ascertain device type
+		const deviceType =
+			options.type ||
+			(await (await import('../../utils/patterns')).selectDeviceType());
+
+		// Ascertain organization
+		const organization =
+			options.organization?.toLowerCase() || (await this.getOrganization());
+
+		// Create application
+		try {
+			const application = await getBalenaSdk().models.application.create({
+				name: params.name,
+				deviceType,
+				organization,
+				applicationClass: 'block',
+			});
+
+			// Output
+			console.log(
+				`Block created: slug "${application.slug}", device type "${deviceType}"`,
+			);
+		} catch (err) {
+			if ((err.message || '').toLowerCase().includes('unique')) {
+				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
+				throw new ExpectedError(
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
+				);
+			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
+				// BalenaRequestError: Request error: Unauthorized
+				throw new ExpectedError(
+					`Error: You are not authorized to create blocks in organization "${organization}".`,
+				);
+			}
+
+			throw err;
+		}
+	}
+
+	async getOrganization() {
+		const { getOwnOrganizations } = await import('../../utils/sdk');
+		const organizations = await getOwnOrganizations(getBalenaSdk(), {
+			$select: ['name', 'handle'],
+		});
+
+		if (organizations.length === 0) {
+			// User is not a member of any organizations (should not happen).
+			throw new Error('This account is not a member of any organizations');
+		} else if (organizations.length === 1) {
+			// User is a member of only one organization - use this.
+			return organizations[0].handle;
+		} else {
+			// User is a member of multiple organizations -
+			const { selectOrganization } = await import('../../utils/patterns');
+			return selectOrganization(organizations);
+		}
+	}
+}

lib/commands/build.ts

@@ -208,7 +208,7 @@ ${dockerignoreHelp}
 	 *   buildEmulated
 	 *   buildOpts: arguments to forward to docker build command
 	 *
-	 * @param {DockerToolbelt} docker
+	 * @param {Dockerode} docker
 	 * @param {Logger} logger
 	 * @param {ComposeOpts} composeOpts
 	 * @param opts

lib/commands/fleet/create.ts

@@ -115,7 +115,7 @@ export default class FleetCreateCmd extends Command {
 			if ((err.message || '').toLowerCase().includes('unique')) {
 				// BalenaRequestError: Request error: "organization" and "app_name" must be unique.
 				throw new ExpectedError(
-					`Error: fleet "${params.name}" already exists in organization "${organization}".`,
+					`Error: An app or block or fleet with the name "${params.name}" already exists in organization "${organization}".`,
 				);
 			} else if ((err.message || '').toLowerCase().includes('unauthorized')) {
 				// BalenaRequestError: Request error: Unauthorized

lib/help.ts

@@ -14,10 +14,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import Help from '@oclif/plugin-help';
+import { Help } from '@oclif/core';
+import { HelpFormatter } from '@oclif/core/lib/help/formatter';
 import * as indent from 'indent-string';
 import { getChalk } from './utils/lazy';
-import { renderList } from '@oclif/plugin-help/lib/list';
 import { ExpectedError } from './errors';
 
 // Partially overrides standard implementation of help plugin
@@ -39,9 +39,11 @@ function getHelpSubject(args: string[]): string | undefined {
 }
 
 export default class BalenaHelp extends Help {
+	public helpFormatter = new HelpFormatter(this.config);
+
 	public static usage: 'help [command]';
 
-	public showHelp(argv: string[]) {
+	public async showHelp(argv: string[]) {
 		const chalk = getChalk();
 		const subject = getHelpSubject(argv);
 		if (!subject) {
@@ -52,7 +54,7 @@ export default class BalenaHelp extends Help {
 
 		const command = this.config.findCommand(subject);
 		if (command) {
-			this.showCommandHelp(command);
+			await this.showCommandHelp(command);
 			return;
 		}
 
@@ -187,14 +189,15 @@ See: https://git.io/JRHUW#deprecation-policy`,
 			return '';
 		}
 
-		const body = renderList(
+		const body = this.helpFormatter.renderList(
 			commands
 				.filter((c) => c.usage != null && c.usage !== '')
 				.map((c) => [c.usage, this.formatDescription(c.description)]),
 			{
 				spacer: '\n',
 				stripAnsi: this.opts.stripAnsi,
-				maxWidth: this.opts.maxWidth - 2,
+				indentation: 2,
+				multiline: true,
 			},
 		);
 

lib/utils/lazy.ts

@@ -20,7 +20,7 @@ import type * as BalenaSdk from 'balena-sdk';
 import type { Chalk } from 'chalk';
 import type * as visuals from 'resin-cli-visuals';
 import type * as CliForm from 'resin-cli-form';
-import type { ux } from 'cli-ux';
+import type { ux } from '@oclif/core';
 
 // Equivalent of _.once but avoiding the need to import lodash for lazy deps
 const once = <T>(fn: () => T) => {
@@ -57,7 +57,9 @@ export const getCliForm = once(
 	() => require('resin-cli-form') as typeof CliForm,
 );
 
-export const getCliUx = once(() => require('cli-ux').ux as typeof ux);
+export const getCliUx = once(
+	() => require('@oclif/core/lib/cli-ux') as typeof ux,
+);
 
 // Directly export stripIndent as we always use it immediately, but importing just `stripIndent` reduces startup time
 export const stripIndent =

lib/utils/promote.ts

@@ -176,7 +176,7 @@ async function selectLocalBalenaOsDevice(timeout = 4000): Promise<string> {
 	});
 
 	const responsiveDevices: typeof devices = [];
-	const Docker = await import('docker-toolbelt');
+	const Docker = await import('dockerode');
 	await Promise.all(
 		devices.map(async function (device) {
 			const address = device?.address;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "16.3.0",
+  "version": "16.6.3",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -109,11 +109,13 @@
       "sign": "Developer ID Installer: Balena Ltd (66H43P8FRG)"
     },
     "plugins": [
-      "@oclif/plugin-help"
+      "@oclif/plugin-help",
+      "@oclif/plugin-update"
     ]
   },
   "devDependencies": {
     "@balena/lint": "^6.2.2",
+    "@electron/notarize": "^2.0.0",
     "@oclif/config": "^1.18.2",
     "@oclif/parser": "^3.8.6",
     "@octokit/plugin-throttling": "^3.5.1",
@@ -170,7 +172,6 @@
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
     "diff": "^5.0.0",
-    "electron-notarize": "^1.0.0",
     "ent": "^2.2.0",
     "filehound": "^1.17.5",
     "fs-extra": "^9.1.0",
@@ -190,13 +191,14 @@
     "simple-git": "^3.14.1",
     "sinon": "^11.1.2",
     "ts-node": "^10.4.0",
-    "typescript": "^5.0.2"
+    "typescript": "^5.1.3"
   },
   "dependencies": {
     "@balena/compose": "^2.2.1",
     "@balena/dockerignore": "^1.0.2",
     "@balena/es-version": "^1.0.1",
     "@oclif/command": "^1.8.16",
+    "@oclif/plugin-update": "^3.1.15",
     "@resin.io/valid-email": "^0.1.0",
     "@sentry/node": "^6.16.1",
     "@types/fast-levenshtein": "0.0.1",
@@ -216,15 +218,13 @@
     "chalk": "^3.0.0",
     "chokidar": "^3.5.2",
     "cli-truncate": "^2.1.0",
-    "cli-ux": "^5.5.1",
     "color-hash": "^1.1.1",
     "columnify": "^1.5.2",
     "common-tags": "^1.7.2",
     "denymount": "^2.3.0",
     "docker-modem": "3.0.0",
     "docker-progress": "^5.1.3",
-    "docker-toolbelt": "^3.3.10",
-    "dockerode": "^3.3.1",
+    "dockerode": "3.3.3",
     "ejs": "^3.1.6",
     "etcher-sdk": "^8.5.3",
     "event-stream": "3.3.4",
@@ -253,7 +253,7 @@
     "net-keepalive": "^3.0.0",
     "node-cleanup": "^2.1.2",
     "node-unzip-2": "^0.2.8",
-    "oclif": "^1.18.4",
+    "oclif": "^3.9.1",
     "open": "^7.1.0",
     "patch-package": "^6.4.7",
     "prettyjson": "^1.2.5",
@@ -285,6 +285,6 @@
     "windosu": "^0.3.0"
   },
   "versionist": {
-    "publishedAt": "2023-05-25T15:06:37.963Z"
+    "publishedAt": "2023-06-30T17:07:33.152Z"
   }
 }

patches/all/@oclif+core+2.8.11.patch

@@ -0,0 +1,43 @@
+diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
+index 6de139b..b625b46 100644
+--- a/node_modules/@oclif/core/lib/help/command.js
++++ b/node_modules/@oclif/core/lib/help/command.js
+@@ -206,7 +206,7 @@ class CommandHelp extends formatter_1.HelpFormatter {
+         if (args.filter(a => a.description).length === 0)
+             return;
+         return args.map(a => {
+-            const name = a.name.toUpperCase();
++            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
+             let description = a.description || '';
+             if (a.default)
+                 description = `[default: ${a.default}] ${description}`;
+@@ -244,9 +244,7 @@ class CommandHelp extends formatter_1.HelpFormatter {
+             }
+             if (flag.multiple)
+                 value += '...';
+-            if (!value.includes('|'))
+-                value = underline(value);
+-            label += `=${value}`;
++            label += ` <${value}>`
+         }
+         return label;
+     }
+diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
+index f584e65..394ec36 100644
+--- a/node_modules/@oclif/core/lib/help/index.js
++++ b/node_modules/@oclif/core/lib/help/index.js
+@@ -132,11 +132,12 @@ class Help extends HelpBase {
+         }
+         this.log(this.formatCommand(command));
+         this.log('');
+-        if (subTopics.length > 0) {
++        const SUPPRESS_SUBTOPICS = true;
++        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
+             this.log(this.formatTopics(subTopics));
+             this.log('');
+         }
+-        if (subCommands.length > 0) {
++        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
+             const aliases = [];
+             const uniqueSubCommands = subCommands.filter(p => {
+                 aliases.push(...p.aliases);

patches/all/@oclif+plugin-help+3.2.15.patch

@@ -1,43 +0,0 @@
-diff --git a/node_modules/@oclif/plugin-help/lib/command.js b/node_modules/@oclif/plugin-help/lib/command.js
-index b3b9010..788e5c6 100644
---- a/node_modules/@oclif/plugin-help/lib/command.js
-+++ b/node_modules/@oclif/plugin-help/lib/command.js
-@@ -88,7 +88,7 @@ class CommandHelp {
-             return;
-         const body = list_1.renderList(args.map(a => {
-             var _a;
--            const name = a.name.toUpperCase();
-+            const name = a.required ? `<${a.name}>` : `[${a.name}]`;
-             let description = a.description || '';
-             // `a.default` is actually not always a string (typing bug), hence `toString()`
-             if (a.default || ((_a = a.default) === null || _a === void 0 ? void 0 : _a.toString()) === '0')
-@@ -133,9 +133,7 @@ class CommandHelp {
-                 if (!flag.helpValue && flag.options) {
-                     value = flag.options.join('|');
-                 }
--                if (!value.includes('|'))
--                    value = underline(value);
--                left += `=${value}`;
-+                left += ` <${value}>`;
-             }
-             let right = flag.description || '';
-             // `flag.default` is not always a string (typing bug), hence `toString()`
-diff --git a/node_modules/@oclif/plugin-help/lib/index.js b/node_modules/@oclif/plugin-help/lib/index.js
-index 04d7861..c2fb591 100644
---- a/node_modules/@oclif/plugin-help/lib/index.js
-+++ b/node_modules/@oclif/plugin-help/lib/index.js
-@@ -98,11 +98,12 @@ class Help extends HelpBase {
-             console.log(title + '\n');
-         console.log(this.formatCommand(command));
-         console.log('');
--        if (subTopics.length > 0) {
-+        const SUPPRESS_SUBTOPICS = true;
-+        if (subTopics.length > 0 && !SUPPRESS_SUBTOPICS) {
-             console.log(this.formatTopics(subTopics));
-             console.log('');
-         }
--        if (subCommands.length > 0) {
-+        if (subCommands.length > 0 && !SUPPRESS_SUBTOPICS) {
-             console.log(this.formatCommands(subCommands));
-             console.log('');
-         }

patches/all/oclif+1.18.4.patch

@@ -1,278 +0,0 @@
-diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
-index 924f092..a69e60b 100644
---- a/node_modules/oclif/lib/commands/pack/macos.js
-+++ b/node_modules/oclif/lib/commands/pack/macos.js
-@@ -133,6 +133,7 @@ class PackMacos extends command_1.Command {
-         if (process.env.OSX_KEYCHAIN)
-             args.push('--keychain', process.env.OSX_KEYCHAIN);
-         args.push(dist);
-+        console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
-         await qq.x('pkgbuild', args);
-     }
- }
-diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index bf4657e..fd58c7d 100644
---- a/node_modules/oclif/lib/commands/pack/win.js
-+++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -52,6 +52,13 @@ VIAddVersionKey /LANG=\${LANG_ENGLISH} "ProductVersion" "\${VERSION}.0"
- InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
- 
- Section "${config.name} CLI \${VERSION}"
-+  ; First remove any old client files.
-+  ; (Remnants of old versions were causing CLI errors)
-+  ; Initially tried running the Uninstall.exe, but was
-+  ; unable to make script wait for completion (despite using _?)
-+  DetailPrint "Removing files from previous version."
-+  RMDir /r "$INSTDIR\\client"
-+
-   SetOutPath $INSTDIR
-   File /r bin
-   File /r client
-@@ -61,6 +68,8 @@ Section "${config.name} CLI \${VERSION}"
-   WriteUninstaller "$INSTDIR\\Uninstall.exe"
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-                    "DisplayName" "${config.name}"
-+  WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-+                   "DisplayVersion" "\${VERSION}"
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-                    "UninstallString" "$\\"$INSTDIR\\uninstall.exe$\\""
-   WriteRegStr HKLM "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\${config.dirname}" \\
-@@ -193,7 +202,8 @@ class PackWin extends command_1.Command {
-     async run() {
-         await this.checkForNSIS();
-         const { flags } = this.parse(PackWin);
--        const buildConfig = await Tarballs.buildConfig(flags.root);
-+        const $targets = flags.targets ? flags.targets.split(',') : undefined;
-+        const buildConfig = await Tarballs.buildConfig(flags.root, { targets: $targets });
-         const { config, version, gitSha, targets, tmp } = buildConfig;
-         await Tarballs.build(buildConfig, { platform: 'win32', pack: false });
-         const arches = targets.filter(t => t.platform === 'win32').map(t => t.arch);
-@@ -208,7 +218,8 @@ class PackWin extends command_1.Command {
-             // eslint-disable-next-line no-await-in-loop
-             await qq.mv(buildConfig.workspace({ platform: 'win32', arch }), [installerBase, 'client']);
-             // eslint-disable-next-line no-await-in-loop
--            await qq.x(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-+            const { msysExec, toMsysPath } = require("../../util");
-+            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
-             const templateKey = upload_util_1.templateShortKey('win32', { bin: config.bin, version: version, sha: gitSha, arch });
-             const o = buildConfig.dist(`win32/${templateKey}`);
-             // eslint-disable-next-line no-await-in-loop
-@@ -255,4 +266,5 @@ PackWin.hidden = true;
- PackWin.description = 'create windows installer from oclif CLI';
- PackWin.flags = {
-     root: command_1.flags.string({ char: 'r', description: 'path to oclif CLI root', default: '.', required: true }),
-+    targets: command_1.flags.string({char: 't', description: 'comma-separated targets to pack (e.g.: win32-x86,win32-x64)'}),
- };
-diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index d3e8e89..a5d29e2 100644
---- a/node_modules/oclif/lib/tarballs/build.js
-+++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -18,8 +18,9 @@ const pack = async (from, to) => {
-     qq.cd(prevCwd);
- };
- async function build(c, options = {}) {
--    const { xz, config, version, s3Config, gitSha, nodeVersion, targets, updateConfig } = c;
-+    const { xz, config, version, s3Config, gitSha, nodeVersion, targets, updateConfig, tmp } = c;
-     const prevCwd = qq.cwd();
-+    console.error(`[debug] oclif cwd="${prevCwd}"\n c.root="${c.root}" c.workspace()="${c.workspace()}"`);
-     const packCLI = async () => {
-         const stdout = await qq.x.stdout('npm', ['pack', '--unsafe-perm'], { cwd: c.root });
-         return path.join(c.root, stdout.split('\n').pop());
-@@ -30,11 +31,19 @@ async function build(c, options = {}) {
-         tarball = path.basename(tarball);
-         tarball = qq.join([c.workspace(), tarball]);
-         qq.cd(c.workspace());
--        await qq.x(`tar -xzf ${tarball}`);
-+        const { msysExec, toMsysPath } = require("../util");
-+        await msysExec(`tar -xzf ${toMsysPath(tarball)}`);
-         // eslint-disable-next-line no-await-in-loop
-         for (const f of await qq.ls('package', { fullpath: true }))
-             await qq.mv(f, '.');
-         await qq.rm('package', tarball, 'bin/run.cmd');
-+        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
-+        await qq.mv('bin/balena', 'bin/run');
-+        // The oclif installers are a production installation, while the source
-+        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
-+        // This has previously led to issues preventing the CLI from starting, so
-+        // delete `.fast-boot.json` (if any) from the destination folder.
-+        await qq.rm('bin/.fast-boot.json');
-     };
-     const updatePJSON = async () => {
-         qq.cd(c.workspace());
-@@ -46,21 +55,21 @@ async function build(c, options = {}) {
-         await qq.writeJSON('package.json', pjson);
-     };
-     const addDependencies = async () => {
--        qq.cd(c.workspace());
--        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
--        const yarn = await qq.exists([yarnRoot, 'yarn.lock']);
--        if (yarn) {
--            await qq.cp([yarnRoot, 'yarn.lock'], '.');
--            await qq.x('yarn --no-progress --production --non-interactive');
--        }
--        else {
--            let lockpath = qq.join(c.root, 'package-lock.json');
--            if (!await qq.exists(lockpath)) {
--                lockpath = qq.join(c.root, 'npm-shrinkwrap.json');
--            }
--            await qq.cp(lockpath, '.');
--            await qq.x('npm install --production');
-+        const ws = c.workspace();
-+        qq.cd(ws);
-+        console.error(`[debug] oclif copying node_modules to "${ws}"`)
-+        const source = path.join(c.root, 'node_modules');
-+        if (process.platform === 'win32') {
-+            // xcopy is much faster than `qq.cp(source, ws)`
-+            await qq.x(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
-+        } else {
-+            // use the shell's `cp` on macOS in order to preserve extended
-+            // file attributes containing `codesign` digital signatures
-+            await qq.x(`cp -pR "${source}" "${ws}"`);
-         }
-+        console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
-+        await qq.x('npm prune --production');
-+        console.error(`[debug] oclif done`);
-     };
-     const pretarball = async () => {
-         qq.cd(c.workspace());
-@@ -99,7 +108,8 @@ async function build(c, options = {}) {
-             output: path.join(workspace, 'bin', 'node'),
-             platform: target.platform,
-             arch: target.arch,
--            tmp: qq.join(config.root, 'tmp'),
-+            tmp,
-+            projectRootPath: c.root,
-         });
-         if (options.pack === false)
-             return;
-diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
-index 0dc3cd7..1336219 100644
---- a/node_modules/oclif/lib/tarballs/config.js
-+++ b/node_modules/oclif/lib/tarballs/config.js
-@@ -18,7 +18,10 @@ function gitSha(cwd, options = {}) {
- }
- exports.gitSha = gitSha;
- async function Tmp(config) {
--    const tmp = path.join(config.root, 'tmp');
-+    const tmp = process.env.BUILD_TMP
-+        ? path.join(process.env.BUILD_TMP, 'oclif')
-+        : path.join(config.root, 'tmp');
-+    console.error(`[debug] oclif tmp="${tmp}"`);
-     await qq.mkdirp(tmp);
-     return tmp;
- }
-@@ -43,7 +46,7 @@ async function buildConfig(root, options = {}) {
-         s3Config: updateConfig.s3,
-         nodeVersion: updateConfig.node.version || process.versions.node,
-         workspace(target) {
--            const base = qq.join(config.root, 'tmp');
-+            const base = tmp;
-             if (target && target.platform)
-                 return qq.join(base, [target.platform, target.arch].join('-'), upload_util_1.templateShortKey('baseDir', { bin: config.bin }));
-             return qq.join(base, upload_util_1.templateShortKey('baseDir', { bin: config.bin }));
-diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
-index fabe5c4..e32dd76 100644
---- a/node_modules/oclif/lib/tarballs/node.js
-+++ b/node_modules/oclif/lib/tarballs/node.js
-@@ -4,9 +4,10 @@ const errors_1 = require("@oclif/errors");
- const path = require("path");
- const qq = require("qqjs");
- const log_1 = require("../log");
-+const { isMSYS2, msysExec, toMsysPath } = require("../util");
- async function checkFor7Zip() {
-     try {
--        await qq.x('7z', { stdio: [0, null, 2] });
-+        await msysExec('7z', { stdio: [0, null, 2] });
-     }
-     catch (error) {
-         if (error.code === 127)
-@@ -41,7 +42,8 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         const basedir = path.dirname(tarball);
-         await qq.mkdirp(basedir);
-         await qq.download(url, tarball);
--        await qq.x(`grep ${path.basename(tarball)} ${shasums} | shasum -a 256 -c -`, { cwd: basedir });
-+        const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
-+        await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
-     };
-     const extract = async () => {
-         log_1.log(`extracting ${nodeBase}`);
-@@ -51,7 +53,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
-         await qq.mkdirp(path.dirname(cache));
-         if (platform === 'win32') {
-             qq.pushd(nodeTmp);
--            await qq.x(`7z x -bd -y ${tarball} > /dev/null`);
-+            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`);
-             await qq.mv([nodeBase, 'node.exe'], cache);
-             qq.popd();
-         }
-diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
-index 45392cb..3c806c7 100644
---- a/node_modules/oclif/lib/upload-util.js
-+++ b/node_modules/oclif/lib/upload-util.js
-@@ -28,10 +28,10 @@ function templateShortKey(type, ext, options = { root: '.' }) {
-     const templates = {
-         baseDir: '<%- bin %>',
-         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
--        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
--        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
--        macos: '<%- bin %>-v<%- version %>-<%- sha %>.pkg',
--        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
-+        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
-+        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
-+        macos: '<%- bin %>-v<%- version %>.pkg',
-+        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
-         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
-     };
-     return _.template(templates[type])(Object.assign({}, options));
-diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
-index 17748ad..4928fc9 100644
---- a/node_modules/oclif/lib/util.js
-+++ b/node_modules/oclif/lib/util.js
-@@ -67,3 +67,47 @@ exports.sortVersionsObjectByKeysDesc = (input) => {
-     }
-     return result;
- };
-+
-+// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
-+// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
-+// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
-+const isCygwin = process.env.OSTYPE === 'cygwin';
-+const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
-+const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
-+const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
-+    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
-+        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
-+            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
-+
-+exports.isCygwin = isCygwin;
-+exports.isMinGW = isMinGW;
-+exports.isMSYS2 = isMSYS2;
-+console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
-+
-+const qq = require("qqjs");
-+
-+/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
-+function toMsysPath(windowsPath) {
-+    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
-+    let msysPath = windowsPath.replace(/\\/g, '/');
-+    if (isMSYS2 || isMinGW) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
-+    } else if (isCygwin) {
-+        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
-+    }
-+    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
-+    return msysPath;
-+}
-+exports.toMsysPath = toMsysPath;
-+
-+/* Like qqjs qq.x(), but using MSYS bash on Windows instead of cmd.exe */
-+async function msysExec(cmd, options = {}) {
-+    if (process.platform !== 'win32') {
-+        return qq.x(cmd, options);
-+    }
-+    const sh = MSYSSHELLPATH;
-+    const args = ['-c', cmd];
-+    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
-+    return qq.x(sh, args, options);
-+}
-+exports.msysExec = msysExec;

patches/all/oclif+3.9.1.patch

@@ -0,0 +1,294 @@
+diff --git a/node_modules/oclif/lib/commands/pack/macos.js b/node_modules/oclif/lib/commands/pack/macos.js
+index d06d0b3..4bdcd34 100644
+--- a/node_modules/oclif/lib/commands/pack/macos.js
++++ b/node_modules/oclif/lib/commands/pack/macos.js
+@@ -177,6 +177,7 @@ class PackMacos extends core_1.Command {
+             if (process.env.OSX_KEYCHAIN)
+                 args.push('--keychain', process.env.OSX_KEYCHAIN);
+             args.push(dist);
++            console.error(`[debug] oclif pkgbuild "${args.join('" "')}"`);
+             await exec(`pkgbuild  ${args.join(' ')}`);
+         };
+         const arches = _.uniq(buildConfig.targets
+diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
+index 360c34b..4e1047b 100644
+--- a/node_modules/oclif/lib/commands/pack/win.js
++++ b/node_modules/oclif/lib/commands/pack/win.js
+@@ -59,6 +59,13 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+ ${customization}
+ 
+ Section "${config.name} CLI \${VERSION}"
++  ; First remove any old client files.
++  ; (Remnants of old versions were causing CLI errors)
++  ; Initially tried running the Uninstall.exe, but was
++  ; unable to make script wait for completion (despite using _?)
++  DetailPrint "Removing files from previous version."
++  RMDir /r "$INSTDIR\\client"
++
+   SetOutPath $INSTDIR
+   File /r bin
+   File /r client
+@@ -203,7 +210,8 @@ class PackWin extends core_1.Command {
+     async run() {
+         await this.checkForNSIS();
+         const { flags } = await this.parse(PackWin);
+-        const buildConfig = await Tarballs.buildConfig(flags.root);
++        const $targets = flags.targets ? flags.targets.split(',') : undefined;
++        const buildConfig = await Tarballs.buildConfig(flags.root, { targets: $targets });
+         const { config } = buildConfig;
+         await Tarballs.build(buildConfig, { platform: 'win32', pack: false, tarball: flags.tarball, parallel: true });
+         const arches = buildConfig.targets.filter(t => t.platform === 'win32').map(t => t.arch);
+@@ -225,7 +233,8 @@ class PackWin extends core_1.Command {
+                 fs.writeFile(path.join(installerBase, 'bin', `${flags['additional-cli']}`), scripts.sh({ bin: flags['additional-cli'] })),
+             ] : []));
+             await fs.move(buildConfig.workspace({ platform: 'win32', arch }), path.join(installerBase, 'client'));
+-            await exec(`makensis ${installerBase}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
++            const { msysExec, toMsysPath } = require("../../util");
++            await msysExec(`makensis ${toMsysPath(installerBase)}/${config.bin}.nsi | grep -v "\\[compress\\]" | grep -v "^File: Descending to"`);
+             const templateKey = (0, upload_util_1.templateShortKey)('win32', { bin: config.bin, version: config.version, sha: buildConfig.gitSha, arch });
+             const o = buildConfig.dist(`win32/${templateKey}`);
+             await fs.move(path.join(installerBase, 'installer.exe'), o);
+@@ -263,6 +272,10 @@ PackWin.flags = {
+         default: '.',
+         required: true,
+     }),
++    targets: core_1.Flags.string({
++        char: 't',
++        description: 'comma-separated targets to pack (e.g.: win32-x86,win32-x64)'
++    }),
+     'additional-cli': core_1.Flags.string({
+         description: `an Oclif CLI other than the one listed in config.bin that should be made available to the user
+ the CLI should already exist in a directory named after the CLI that is the root of the tarball produced by "oclif pack:tarballs"`,
+diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
+index 384ea4b..40998f6 100644
+--- a/node_modules/oclif/lib/tarballs/build.js
++++ b/node_modules/oclif/lib/tarballs/build.js
+@@ -21,7 +21,8 @@ const pack = async (from, to) => {
+         await exec(`tar cfJ ${to} ${(path.basename(from))}`, { cwd }));
+ };
+ async function build(c, options = {}) {
+-    const { xz, config } = c;
++    const { xz, config, tmp } = c;
++    console.error(`[debug] oclif cwd="${prevCwd}"\n c.root="${c.root}" c.workspace()="${c.workspace()}"`);
+     const packCLI = async () => {
+         const { stdout } = await exec('npm pack --unsafe-perm', { cwd: c.root });
+         return path.join(c.root, stdout.trim().split('\n').pop());
+@@ -30,7 +31,8 @@ async function build(c, options = {}) {
+         await fs.emptyDir(c.workspace());
+         const tarballNewLocation = path.join(c.workspace(), path.basename(tarball));
+         await fs.move(tarball, tarballNewLocation);
+-        await exec(`tar -xzf "${tarballNewLocation}"`, { cwd: c.workspace() });
++        const { msysExec, toMsysPath } = require("../util");
++        await msysExec(`tar -xzf ${toMsysPath(tarballNewLocation)}`);
+         await Promise.all((await fs.promises.readdir(path.join(c.workspace(), 'package'), { withFileTypes: true }))
+             .map(i => fs.move(path.join(c.workspace(), 'package', i.name), path.join(c.workspace(), i.name))));
+         await Promise.all([
+@@ -38,6 +40,13 @@ async function build(c, options = {}) {
+             fs.promises.rm(path.join(c.workspace(), path.basename(tarball)), { recursive: true }),
+             fs.remove(path.join(c.workspace(), 'bin', 'run.cmd')),
+         ]);
++        // rename the original balena-cli ./bin/balena entry point for oclif compatibility
++        await fs.move('bin/balena', 'bin/run');
++        // The oclif installers are a production installation, while the source
++        // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
++        // This has previously led to issues preventing the CLI from starting, so
++        // delete `.fast-boot.json` (if any) from the destination folder.
++        await fs.promises.rm('bin/.fast-boot.json');
+     };
+     const updatePJSON = async () => {
+         const pjsonPath = path.join(c.workspace(), 'package.json');
+@@ -49,34 +58,19 @@ async function build(c, options = {}) {
+         await fs.writeJSON(pjsonPath, pjson, { spaces: 2 });
+     };
+     const addDependencies = async () => {
+-        const yarnRoot = findYarnWorkspaceRoot(c.root) || c.root;
+-        if (fs.existsSync(path.join(yarnRoot, 'yarn.lock'))) {
+-            await fs.copy(path.join(yarnRoot, 'yarn.lock'), path.join(c.workspace(), 'yarn.lock'));
+-            const yarnVersion = (await exec('yarn -v')).stdout.charAt(0);
+-            if (yarnVersion === '1') {
+-                await exec('yarn --no-progress --production --non-interactive', { cwd: c.workspace() });
+-            }
+-            else if (yarnVersion === '2') {
+-                throw new Error('Yarn 2 is not supported yet. Try using Yarn 1, or Yarn 3');
+-            }
+-            else {
+-                try {
+-                    await exec('yarn workspaces focus --production', { cwd: c.workspace() });
+-                }
+-                catch (error) {
+-                    if (error instanceof Error && error.message.includes('Command not found')) {
+-                        throw new Error('Missing workspace tools. Run `yarn plugin import workspace-tools`.');
+-                    }
+-                    throw error;
+-                }
+-            }
+-        }
+-        else {
+-            const lockpath = fs.existsSync(path.join(c.root, 'package-lock.json')) ?
+-                path.join(c.root, 'package-lock.json') :
+-                path.join(c.root, 'npm-shrinkwrap.json');
+-            await fs.copy(lockpath, path.join(c.workspace(), path.basename(lockpath)));
+-            await exec('npm install --production', { cwd: c.workspace() });
++        const ws = c.workspace();
++        exec(`cd ${ws}`);
++        console.error(`[debug] oclif copying node_modules to "${ws}"`)
++        const source = path.join(c.root, 'node_modules');
++        if (process.platform === 'win32') {
++            await exec(`xcopy "${source}" "${ws}\\node_modules" /S /E /B /I /K /Q /Y`);
++        } else {
++            // use the shell's `cp` on macOS in order to preserve extended
++            // file attributes containing `codesign` digital signatures
++            await exec(`cp -pR "${source}" "${ws}"`);
++            console.error(`[debug] oclif running "npm prune --production" in "${ws}"`);
++            await exec('npm prune --production');
++            console.error(`[debug] oclif done`);
+         }
+     };
+     const pretarball = async () => {
+@@ -115,7 +109,8 @@ async function build(c, options = {}) {
+             output: path.join(workspace, 'bin', 'node'),
+             platform: target.platform,
+             arch: target.arch,
+-            tmp: path.join(config.root, 'tmp'),
++            tmp,
++            projectRootPath: c.root
+         });
+         if (options.pack === false)
+             return;
+diff --git a/node_modules/oclif/lib/tarballs/config.js b/node_modules/oclif/lib/tarballs/config.js
+index 3334d3f..a7348d9 100644
+--- a/node_modules/oclif/lib/tarballs/config.js
++++ b/node_modules/oclif/lib/tarballs/config.js
+@@ -24,7 +24,10 @@ async function gitSha(cwd, options = {}) {
+ }
+ exports.gitSha = gitSha;
+ async function Tmp(config) {
+-    const tmp = path.join(config.root, 'tmp');
++    const tmp = process.env.BUILD_TMP
++        ? path.join(process.env.BUILD_TMP, 'oclif')
++        : path.join(config.root, 'tmp');
++    console.error(`[debug] oclif tmp="${tmp}"`);
+     await fs.promises.mkdir(tmp, { recursive: true });
+     return tmp;
+ }
+@@ -61,7 +64,7 @@ async function buildConfig(root, options = {}) {
+         s3Config: updateConfig.s3,
+         nodeVersion,
+         workspace(target) {
+-            const base = path.join(config.root, 'tmp');
++            const base = tmp;
+             if (target && target.platform)
+                 return path.join(base, [target.platform, target.arch].join('-'), (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
+             return path.join(base, (0, upload_util_1.templateShortKey)('baseDir', { bin: config.bin }));
+diff --git a/node_modules/oclif/lib/tarballs/node.js b/node_modules/oclif/lib/tarballs/node.js
+index 1a4e09b..bb56759 100644
+--- a/node_modules/oclif/lib/tarballs/node.js
++++ b/node_modules/oclif/lib/tarballs/node.js
+@@ -11,9 +11,10 @@ const node_util_1 = require("node:util");
+ const got_1 = require("got");
+ const pipeline = (0, node_util_1.promisify)(node_stream_1.pipeline);
+ const exec = (0, node_util_1.promisify)(node_child_process_1.exec);
++const { isMSYS2, msysExec, toMsysPath } = require("../util");
+ async function checkFor7Zip() {
+     try {
+-        await exec('7z');
++        await msysExec('7z', { stdio: [0, null, 2] });
+     }
+     catch (error) {
+         if (error.code === 127)
+@@ -51,8 +52,10 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
+         const basedir = path.dirname(tarball);
+         await fs.promises.mkdir(basedir, { recursive: true });
+         await pipeline(got_1.default.stream(url), fs.createWriteStream(tarball));
+-        if (platform !== 'win32')
+-            await exec(`grep "${path.basename(tarball)}" "${shasums}" | shasum -a 256 -c -`, { cwd: basedir });
++        if (platform !== 'win32') {
++            const shaCmd = isMSYS2 ? 'sha256sum -c -' : 'shasum -a 256 -c -';
++            await msysExec(`grep ${path.basename(tarball)} ${toMsysPath(shasums)} | ${shaCmd}`, { cwd: basedir });
++        }
+     };
+     const extract = async () => {
+         (0, log_1.log)(`extracting ${nodeBase}`);
+@@ -60,7 +63,7 @@ async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {
+         await fs.promises.mkdir(nodeTmp, { recursive: true });
+         await fs.promises.mkdir(path.dirname(cache), { recursive: true });
+         if (platform === 'win32') {
+-            await exec(`7z x -bd -y "${tarball}"`, { cwd: nodeTmp });
++            await msysExec(`7z x -bd -y ${toMsysPath(tarball)} > /dev/null`);
+             await fs.move(path.join(nodeTmp, nodeBase, 'node.exe'), path.join(cache, 'node.exe'));
+         }
+         else {
+diff --git a/node_modules/oclif/lib/upload-util.js b/node_modules/oclif/lib/upload-util.js
+index 0d5f705..46e2445 100644
+--- a/node_modules/oclif/lib/upload-util.js
++++ b/node_modules/oclif/lib/upload-util.js
+@@ -31,10 +31,10 @@ options = { root: '.' }) {
+     const templates = {
+         baseDir: '<%- bin %>',
+         unversioned: '<%- bin %>-<%- platform %>-<%- arch %><%- ext %>',
+-        versioned: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %><%- ext %>',
+-        manifest: '<%- bin %>-v<%- version %>-<%- sha %>-<%- platform %>-<%- arch %>-buildmanifest',
+-        macos: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.pkg',
+-        win32: '<%- bin %>-v<%- version %>-<%- sha %>-<%- arch %>.exe',
++        versioned: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>',
++        manifest: '<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %>-buildmanifest',
++        macos: '<%- bin %>-v<%- version %>.pkg',
++        win32: '<%- bin %>-v<%- version %>-<%- arch %>.exe',
+         deb: '<%- bin %>_<%- versionShaRevision %>_<%- arch %>.deb',
+     };
+     return _.template(templates[type])(Object.assign({}, options));
+diff --git a/node_modules/oclif/lib/util.js b/node_modules/oclif/lib/util.js
+index 75bf3c6..ed5a92e 100644
+--- a/node_modules/oclif/lib/util.js
++++ b/node_modules/oclif/lib/util.js
+@@ -74,6 +74,50 @@ const sortVersionsObjectByKeysDesc = (input) => {
+     }
+     return result;
+ };
++
++// OSTYPE is 'msys' for MSYS 1.0 and for MSYS2, or 'cygwin' for Cygwin
++// but note that OSTYPE is not "exported" by default, so run: export OSTYPE=$OSTYPE
++// MSYSTEM is 'MINGW32' for MSYS 1.0, 'MSYS' for MSYS2, and undefined for Cygwin
++const isCygwin = process.env.OSTYPE === 'cygwin';
++const isMinGW = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MINGW');
++const isMSYS2 = process.env.MSYSTEM && process.env.MSYSTEM.startsWith('MSYS');
++const MSYSSHELLPATH = process.env.MSYSSHELLPATH ||
++    (isMSYS2 ? 'C:\\msys64\\usr\\bin\\bash.exe' :
++        (isMinGW ? 'C:\\MinGW\\msys\\1.0\\bin\\bash.exe' :
++            (isCygwin ? 'C:\\cygwin64\\bin\\bash.exe' : '/bin/sh')));
++
++exports.isCygwin = isCygwin;
++exports.isMinGW = isMinGW;
++exports.isMSYS2 = isMSYS2;
++console.error(`[debug] oclif MSYSSHELLPATH=${MSYSSHELLPATH} MSYSTEM=${process.env.MSYSTEM} OSTYPE=${process.env.OSTYPE} isMSYS2=${isMSYS2} isMingGW=${isMinGW} isCygwin=${isCygwin}`);
++
++const qq = require("qqjs");
++
++/* Convert a Windows path like 'C:\tmp' to a MSYS path like '/c/tmp' */
++function toMsysPath(windowsPath) {
++    // 'c:\myfolder' -> '/c/myfolder' or '/cygdrive/c/myfolder'
++    let msysPath = windowsPath.replace(/\\/g, '/');
++    if (isMSYS2 || isMinGW) {
++        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/$1');
++    } else if (isCygwin) {
++        msysPath = msysPath.replace(/^([a-zA-Z]):/, '/cygdrive/$1');
++    }
++    console.error(`[debug] oclif toMsysPath before="${windowsPath}" after="${msysPath}"`);
++    return msysPath;
++}
++exports.toMsysPath = toMsysPath;
++
++/* Like qqjs qq.x(), but using MSYS bash on Windows instead of cmd.exe */
++async function msysExec(cmd, options = {}) {
++    if (process.platform !== 'win32') {
++        return qq.x(cmd, options);
++    }
++    const sh = MSYSSHELLPATH;
++    const args = ['-c', cmd];
++    console.error(`[debug] oclif msysExec sh="${sh}" args=${JSON.stringify(args)} options=${JSON.stringify(options)}`);
++    return qq.x(sh, args, options);
++}
++exports.msysExec = msysExec;
+ exports.sortVersionsObjectByKeysDesc = sortVersionsObjectByKeysDesc;
+ const homeRegexp = new RegExp(`\\B${os.homedir().replace('/', '\\/')}`, 'g');
+ const curRegexp = new RegExp(`\\B${process.cwd()}`, 'g');

typings/docker-toolbelt/index.d.ts

@@ -1,23 +0,0 @@
-declare module 'docker-toolbelt' {
-	import * as Docker from 'dockerode';
-
-	interface ImageSpec {
-		registry?: string;
-		imageName: string;
-		tagName: string;
-		digest?: string;
-	}
-
-	type ProgressCallback = (event: any) => void;
-
-	class DockerToolbelt extends Docker {
-		public getRegistryAndName(image: string): Promise<ImageSpec>;
-		public createDeltaAsync(
-			src: string,
-			dest: string,
-			onProgress?: ProgressCallback,
-		): Promise<string>;
-	}
-
-	export = DockerToolbelt;
-}