Reduce generated bundle size

Change-type: patch

.eslintignore

@@ -1,2 +0,0 @@
-/completion/*
-/bin/*

.eslintrc.js

@@ -1,21 +0,0 @@
-module.exports = {
-	extends: ['./node_modules/@balena/lint/config/.eslintrc.js'],
-	parserOptions: {
-		project: 'tsconfig.dev.json',
-	},
-	root: true,
-	rules: {
-		ignoreDefinitionFiles: 0,
-		// to avoid the `warning  Forbidden non-null assertion  @typescript-eslint/no-non-null-assertion`
-		'@typescript-eslint/no-non-null-assertion': 'off',
-		'@typescript-eslint/no-shadow': 'off',
-		'@typescript-eslint/no-var-requires': 'off',
-		'no-restricted-imports': [
-			'error',
-			{
-				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
-			},
-		],
-		'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-	},
-};

.github/ISSUE_TEMPLATE.md

@@ -67,7 +67,7 @@ fixed it.
 - **Cloud backend: openBalena or balenaCloud?** If unsure, it will be balenaCloud
 - **Operating system version:** e.g. Windows 10, Ubuntu 18.04, macOS 10.14.5
 - **32/64 bit OS and processor:** e.g. 32-bit Windows on 64-bit Intel processor
-- **Install method:** npm or zip package or executable installer
+- **Install method:** npm or standalone package or executable installer
 - **If npm install, Node.js and npm version:** e.g. Node v8.16.0 and npm v6.4.1
 
 # Additional References

.github/actions/publish/action.yml

@@ -28,7 +28,7 @@ runs:
   using: 'composite'
   steps:
     - name: Download custom source artifact
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}
@@ -39,7 +39,7 @@ runs:
       run: tar -xf ${{ runner.temp }}/custom.tgz
 
     - name: Setup Node.js
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
@@ -48,7 +48,7 @@ runs:
       if: runner.os == 'macOS'
       uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
-        python-version: "3.11"
+        python-version: '3.11'
 
     - name: Install additional tools
       if: runner.os == 'Windows'
@@ -94,7 +94,7 @@ runs:
         runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
 
         if [[ $runner_os =~ darwin|macos|osx ]]; then
-            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+            CSC_KEY_PASSWORD='${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}'
             CSC_KEYCHAIN=signing_temp
             CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
 
@@ -112,8 +112,8 @@ runs:
             PATH="/c/Program Files/DigiCert/DigiCert One Signing Manager Tools:${PATH}"
             smksp_registrar.exe list
             smctl.exe keypair ls
+            smctl.exe windows certsync
             /c/Windows/System32/certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
-            smksp_cert_sync.exe
 
             # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
             PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
@@ -135,9 +135,11 @@ runs:
         XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ strategy.job-index }}
-        path: dist
+        path: |
+          dist
+          !dist/balena
         retention-days: 1
         if-no-files-found: error

.github/actions/test/action.yml

@@ -26,7 +26,7 @@ runs:
   steps:
     # https://github.com/actions/setup-node#caching-global-packages-data
     - name: Setup Node.js
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
       with:
         node-version: ${{ inputs.NODE_VERSION }}
         cache: npm
@@ -58,7 +58,7 @@ runs:
       run: tar --exclude-vcs -acf ${{ runner.temp }}/custom.tgz .
 
     - name: Upload custom artifact
-      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
         path: ${{ runner.temp }}/custom.tgz

.github/workflows/flowzone.yml

@@ -26,7 +26,7 @@ jobs:
           "os": [
             ["self-hosted", "X64"],
             ["self-hosted", "ARM64"],
-            ["macos-12"],
+            ["macos-13"],
             ["windows-2019"],
             ["macos-latest-xlarge"]
           ]
@@ -36,7 +36,7 @@ jobs:
           "os": [
             ["self-hosted", "X64"],
             ["self-hosted", "ARM64"],
-            ["macos-12"],
+            ["macos-13"],
             ["windows-2019"],
             ["macos-latest-xlarge"]
           ]

.mocharc.js

@@ -2,7 +2,7 @@ module.exports = {
 	reporter: 'spec',
 	require: 'ts-node/register/transpile-only',
 	file: './tests/config-tests',
-	timeout: 12000,
+	timeout: 48000,
 	// To test only, say, 'push.spec.ts', do it as follows so that
 	// requests are authenticated:
 	// spec: ['tests/auth/*.spec.ts', 'tests/**/deploy.spec.ts'],

CHANGELOG.md

@@ -4,6 +4,341 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 21.1.12 - 2025-05-16
+
+* Update @balena/compose dependency to fix error with build secrets. [Ken Bannister]
+
+## 21.1.11 - 2025-05-06
+
+* Fix typos in `os configure` and `config generate` help messages [myarmolinsky]
+
+## 21.1.10 - 2025-05-05
+
+* patch: fix windows signing [Edwin Joassart]
+
+## 21.1.9 - 2025-04-07
+
+
+<details>
+<summary> Update balena-config-json to rely on the balena-image-fs helpers [Thodoris Greasidis] </summary>
+
+> ### balena-config-json-4.2.7 - 2025-04-02
+> 
+> * Fix getBootPartition always warning that the boot partitions were not found [Thodoris Greasidis]
+> 
+> ### balena-config-json-4.2.6 - 2025-04-01
+> 
+> * write: Allow undefined as a value for the deprecated type parameter [Thodoris Greasidis]
+> 
+> <details>
+> <summary> Use the balena-image-fs findPartition() helper to find the boot partition [Thodoris Greasidis] </summary>
+> 
+>> #### balena-image-fs-7.5.0 - 2025-03-26
+>> 
+>> * Add function to find a partition by name/label [Ken Bannister]
+>> 
+>> #### balena-image-fs-7.4.1 - 2025-02-21
+>> 
+>> * bump ext2fs to 4.2.4 [Ryan Cooke]
+>> 
+> 
+> </details>
+> 
+> 
+> ### balena-config-json-4.2.5 - 2025-03-26
+> 
+> * Update @balena/lint to 9.1.4 [Thodoris Greasidis]
+> 
+> ### balena-config-json-4.2.4 - 2025-03-26
+> 
+> * Switch use ts-mocha instead of manually compiling the tests [Thodoris Greasidis]
+> * Update TypeScript to 5.8.2 [Thodoris Greasidis]
+> 
+> ### balena-config-json-4.2.3 - 2025-03-26
+> 
+> * Update chai to v5 [balena-renovate[bot]]
+> 
+> ### balena-image-fs-7.5.2 - 2025-04-02
+> 
+> * Update dependency jsdoc-to-markdown to v9 [balena-renovate[bot]]
+> 
+> ### balena-image-fs-7.5.1 - 2025-03-26
+> 
+> * Update @balena/lint to v9 [Thodoris Greasidis]
+> * Remove the no longer needed gpt detection helper [Thodoris Greasidis]
+> * Update TypeScript to 5.8.2 [Thodoris Greasidis]
+> * Drop the package-lock.json [Thodoris Greasidis]
+> 
+
+</details>
+
+## 21.1.8 - 2025-04-03
+
+* Update actions/download-artifact action to v4.1.9 [balena-renovate[bot]]
+
+## 21.1.7 - 2025-04-03
+
+* Update actions/upload-artifact digest to ea165f8 [balena-renovate[bot]]
+
+## 21.1.6 - 2025-04-03
+
+* Update actions/setup-node digest to cdca736 [balena-renovate[bot]]
+
+## 21.1.5 - 2025-04-03
+
+* Update dockerode/docker-modem dependencies for fixes [Ken Bannister]
+
+## 21.1.4 - 2025-04-02
+
+* Add comment with secure boot signature file example for preload [Ken Bannister]
+
+## 21.1.3 - 2025-03-28
+
+* Fix device detail for open balena [Otavio Jacobi]
+
+## 21.1.2 - 2025-03-27
+
+* Deny preload for an image with secure boot enabled [Ken Bannister]
+
+## 21.1.1 - 2025-03-26
+
+
+<details>
+<summary> Bump balena-sdk to 21.3.0 [Otavio Jacobi] </summary>
+
+> ### balena-sdk-21.3.0 - 2025-03-26
+> 
+> * device: add `changed_api_heartbeat_state_on__date` to typings [Otavio Jacobi]
+> 
+> ### balena-sdk-21.2.2 - 2025-03-26
+> 
+> * fix  linting [Otavio Jacobi]
+> 
+
+</details>
+
+## 21.1.0 - 2025-03-12
+
+* Add support for new requirement labels feature [Felipe Lalanne]
+
+## 21.0.0 - 2025-03-11
+
+* Drop support for OS versions <2.14.0 [myarmolinsky]
+* api-key generate: Add required argument `expiryDate` [myarmolinsky]
+* Update `balena-preload` to 18.0.1 [myarmolinsky]
+* Add dependency `date-fns` [myarmolinsky]
+* Update `balena-sdk` to 21.2.1 [myarmolinsky]
+
+## 20.2.10 - 2025-03-10
+
+* Update TypeScript to 5.8.2 [Thodoris Greasidis]
+
+## 20.2.9 - 2025-02-26
+
+* Fix CORS issue with X-Balena-Client header [Thodoris Greasidis]
+
+## 20.2.8 - 2025-02-26
+
+* Update balena-config-json dependency and fix test [Ken Bannister]
+
+## 20.2.7 - 2025-02-25
+
+* Use the CLI version in the X-Balena-Client header [Thodoris Greasidis]
+
+## 20.2.6 - 2025-02-25
+
+* Update actions/upload-artifact digest to 4cec3d8 [balena-renovate[bot]]
+
+## 20.2.5 - 2025-02-25
+
+* Update actions/setup-node digest to 1d0ff46 [balena-renovate[bot]]
+
+## 20.2.4 - 2025-02-25
+
+* Pin docker-modem and dockerode to avoid regression [Ken Bannister]
+
+## 20.2.3 - 2025-01-15
+
+* Remove unused old eslint version files [Otavio Jacobi]
+
+## 20.2.2 - 2025-01-12
+
+* Use the promises namespace of balena-image-fs [Thodoris Greasidis]
+
+<details>
+<summary> Update balena-device-init to 8.1.3 & balena-image-fs to 7.3.0 [Thodoris Greasidis] </summary>
+
+> ### balena-image-fs-7.3.0 - 2025-01-06
+> 
+> * Drop Bluebird from devDependencies [Thodoris Greasidis]
+> * flowzone: Remove empty with clause [Thodoris Greasidis]
+> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
+> 
+> ### balena-image-fs-7.2.2 - 2024-01-02
+> 
+> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
+> 
+> ### balena-image-fs-7.2.1 - 2023-12-19
+> 
+> * Remove repo config from flowzone.yml [Kyle Harding]
+> 
+> ### balena-image-fs-7.2.0 - 2023-01-20
+> 
+> * Add support for Node 18 [Akis Kesoglou]
+> 
+> ### balena-image-fs-7.1.2 - 2023-01-05
+> 
+> * Update dependencies [ab77]
+> 
+> ### balena-image-fs-7.1.1 - 2022-12-20
+> 
+> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
+> 
+> ### balena-image-fs-7.1.0 - 2022-12-13
+> 
+> * update dependencies [Zane Hitchcox]
+> 
+> ### balena-device-init-8.1.3 - 2025-01-09
+> 
+> * README: Remove the travisci badge [Thodoris Greasidis]
+> 
+> ### balena-device-init-8.1.2 - 2025-01-09
+> 
+> 
+> <details>
+> <summary> Use the promises namespace of balena-image-fs [Thodoris Greasidis] </summary>
+> 
+>> #### balena-image-fs-7.3.0 - 2025-01-06
+>> 
+>> * Drop Bluebird from devDependencies [Thodoris Greasidis]
+>> * flowzone: Remove empty with clause [Thodoris Greasidis]
+>> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
+>> 
+>> #### balena-image-fs-7.2.2 - 2024-01-02
+>> 
+>> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
+>> 
+>> #### balena-image-fs-7.2.1 - 2023-12-19
+>> 
+>> * Remove repo config from flowzone.yml [Kyle Harding]
+>> 
+>> #### balena-image-fs-7.2.0 - 2023-01-20
+>> 
+>> * Add support for Node 18 [Akis Kesoglou]
+>> 
+>> #### balena-image-fs-7.1.2 - 2023-01-05
+>> 
+>> * Update dependencies [ab77]
+>> 
+>> #### balena-image-fs-7.1.1 - 2022-12-20
+>> 
+>> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
+>> 
+>> #### balena-image-fs-7.1.0 - 2022-12-13
+>> 
+>> * update dependencies [Zane Hitchcox]
+>> 
+> 
+> </details>
+> 
+> 
+> ### balena-device-init-8.1.1 - 2025-01-06
+> 
+> * Convert some parts to async await and simplify [Thodoris Greasidis]
+> * Avoid unnecessary destructuring [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.2.1 - 2025-01-01
+
+
+<details>
+<summary> Update balena-preload to 17.0.0 [Thodoris Greasidis] </summary>
+
+> ### balena-preload-17.0.0 - 2024-10-21
+> 
+> * Improve typings [Thodoris Greasidis]
+> * Stop returning Bluebird promises & drop it from the dependencies [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.2.0 - 2024-12-31
+
+
+<details>
+<summary> os configure: Give precedence to the boot partition located in the image over the device-type.json contents [Thodoris Greasidis] </summary>
+
+> ### balena-device-init-8.1.0 - Invalid date
+> 
+> * Try to find the boot partition by inspecting the image [Thodoris Greasidis]
+> 
+> ### balena-device-init-8.0.1 - 2024-12-19
+> 
+> * Drop the unnecessary eslint.config.js [Thodoris Greasidis]
+> * packacke.json: Explicitly set type commonjs [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.1.6 - 2024-12-30
+
+* Add more realistic os configure tests [Thodoris Greasidis]
+
+## 20.1.5 - 2024-12-20
+
+* Update shrinkwrapped express to v4.21.2 [Oskar Williams]
+
+## 20.1.4 - 2024-12-20
+
+
+<details>
+<summary> Update balena-device-init to 8.0.0 [Thodoris Greasidis] </summary>
+
+> ### balena-device-init-8.0.0 - 2024-12-18
+> 
+> * Avoid running linting in the custom tests [Thodoris Greasidis]
+> * Stop returning Bluebird promises [Thodoris Greasidis]
+> * package: Publish only the build & typings folders [Thodoris Greasidis]
+> * Convert to TypeScript with es6 module notation [Thodoris Greasidis]
+> * Replace gulp, coffeelint & mochainon with tsc, @balena/lint, mocha, chai & sinon [Thodoris Greasidis]
+> * Drop support for node <20.6.0 [Thodoris Greasidis]
+> 
+> ### balena-device-init-7.0.2 - 2024-12-17
+> 
+> * flowzone: Update runner versions [Thodoris Greasidis]
+> * Pin etcher-sdk to 9.0.8 to match resin-device-operations and fix tests [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.1.3 - 2024-12-20
+
+* Update oclif to 4.17.0 and @oclif/core 4.1.0 [Otavio Jacobi]
+
+## 20.1.2 - 2024-12-17
+
+* Remove unnecessary `Promise.resolve` and `Promise.reject` [Pagan Gazzard]
+
+## 20.1.1 - 2024-12-16
+
+* Update @balena/lint to v9.1.3 [Otavio Jacobi]
+
+## 20.1.0 - 2024-12-12
+
+* `device os-update`: Add handling for updates that require takeover [myarmolinsky]
+* Update `balena-sdk` [myarmolinsky]
+* Update `@balena/compose` [myarmolinsky]
+
+## 20.0.9 - 2024-12-05
+
+* Update shrinkwrapped express to v4.21.1 [Oskar Williams]
+
+## 20.0.8 - 2024-12-04
+
+* Run test and publish with macos-13 [Otavio Jacobi]
+
 ## 20.0.7 - 2024-11-23
 
 * Update TypeScript to 5.7.2 [Thodoris Greasidis]

CONTRIBUTING.md

@@ -14,7 +14,7 @@ The balena CLI is an open source project and your contribution is welcome!
 In order to ease development:
 
 * `npm run build:fast` skips some of the build steps for interactive testing, or
-* `npm run test:source` skips testing the standalone zip packages (which is rather slow)
+* `npm run test:source` skips testing the standalone packages (which is rather slow)
 * `./bin/balena-dev` uses `ts-node/register` to transpile on the fly.
 
 Before opening a PR, test your changes with `npm test`. Keep compatibility in mind, as the CLI is

INSTALL-ADVANCED.md

@@ -8,8 +8,8 @@ There are 3 options to choose from to install balena's CLI:
 
 * [Executable Installer](#executable-installer): the easiest method on Windows and macOS, using the
   traditional graphical desktop application installers.
-* [Standalone Zip Package](#standalone-zip-package): these are plain zip files with the balena CLI
-  executable in them: extract and run. Available for all platforms: Linux, Windows, macOS.
+* [Standalone tar.gz Package](#standalone-targz-package): these are plain tar.gz files with the balena CLI
+  bundled within. Available for all platforms: Linux, Windows, macOS.
   Recommended also for scripted installation in CI (continuous integration) environments.
 * [NPM Installation](#npm-installation): recommended for Node.js developers who may be interested
   in integrating the balena CLI in their existing projects or workflow.
@@ -30,9 +30,9 @@ instructions:
 > If you would like to use WSL, follow the [installations instructions for
 > Linux](./INSTALL-LINUX.md) rather than Windows, as WSL consists of a Linux environment.
 
-If you had previously installed the CLI using a standalone zip package, it may be a good idea to
+If you had previously installed the CLI using a standalone tar package, it may be a good idea to
 check your system's `PATH` environment variable for duplicate entries, as the terminal will use the
-entry that comes first. Check the [Standalone Zip Package](#standalone-zip-package) instructions
+entry that comes first. Check the [Standalone tar.gz Package](#standalone-targz-package) instructions
 for how to modify the PATH variable.
 
 By default, the CLI is installed to the following folders:
@@ -42,18 +42,17 @@ OS  | Folders
 Windows: | `C:\Program Files\balena-cli\`
 macOS:   | `/usr/local/src/balena-cli/` <br> `/usr/local/bin/balena`
 
-## Standalone Zip Package
+## Standalone tar.gz Package
 
-1. Download the latest zip file from the [releases page](https://github.com/balena-io/balena-cli/releases).
+1. Download the latest tar.gz file from the [releases page](https://github.com/balena-io/balena-cli/releases).
    Look for a file name that ends with the word "standalone", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`  ← _also for the Windows Subsystem for Linux_  
-   `balena-cli-vX.Y.Z-macOS-x64-standalone.zip`  
-   `balena-cli-vX.Y.Z-windows-x64-standalone.zip`
+   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`  ← _also for the Windows Subsystem for Linux_  
+   `balena-cli-vX.Y.Z-macOS-x64-standalone.tar.gz`
+   `balena-cli-vX.Y.Z-windows-x64-standalone.tar.gz`
 
-2. Extract the zip file contents to any folder you choose. The extracted contents will include a
-   `balena-cli` folder.
+2. Extract the tar.gz file contents to any folder you choose. The extracted contents will be a `balena` folder containing a `bin` subdirectory.
 
-3. Add the `balena-cli` folder to the system's `PATH` environment variable.  
+3. Add the `balena/bin` folder to the system's `PATH` environment variable.
    See instructions for:
    [Linux](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix) |
    [macOS](https://www.architectryan.com/2012/10/02/add-to-the-path-on-mac-os-x-mountain-lion/#.Uydjga1dXDg) |
@@ -61,14 +60,14 @@ macOS:   | `/usr/local/src/balena-cli/` <br> `/usr/local/bin/balena`
 
 > * If you are using macOS 10.15 or later (Catalina, Big Sur), [check this known issue and
 >   workaround](https://github.com/balena-io/balena-cli/issues/2244).
-> * **Linux Alpine** and **Busybox:** the standalone zip package is not currently compatible with
+> * **Linux Alpine** and **Busybox:** the standalone tar.gz package is not currently compatible with
 >   these "compact" Linux distributions, because of the alternative C libraries they ship with.
 >   For these, consider the [NPM Installation](#npm-installation) option.
-> * Note that moving the `balena` executable out of the extracted `balena-cli` folder on its own
+> * Note that moving the `balena/bin/balena` executable out of the extracted `balena` folder on its own
 >   (e.g. moving it to `/usr/local/bin/balena`) will **not** work, as it depends on the other
->   folders and files also present in the `balena-cli` folder.
+>   folders and files also present in the `balena` folder.
 
-To update the CLI to a new version, download a new release zip file and replace the previous
+To update the CLI to a new version, download a new release tar.gz file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 

INSTALL-LINUX.md

@@ -8,15 +8,15 @@ method.
 
 Selected operating system: **Linux**
 
-1. Download the latest zip file from the [latest release
+1. Download the latest tar.gz file from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest). Look for a file name that ends
-   with "-standalone.zip", for example:  
-   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`
+   with "-standalone.tar.gz", for example:  
+   `balena-cli-vX.Y.Z-linux-x64-standalone.tar.gz`
 
-2. Extract the zip file contents to any folder you choose, for example `/home/james`.
-   The extracted contents will include a `balena-cli` folder.
+2. Extract the tar.gz file contents to any folder you choose, for example `/home/james`.
+   The extracted contents will include a `balena/bin` folder.
 
-3. Add that folder (e.g. `/home/james/balena-cli`) to the `PATH` environment variable.
+3. Add that folder (e.g. `/home/james/balena/bin`) to the `PATH` environment variable.
    Check this [StackOverflow
    post](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix)
    for instructions. Close and reopen the terminal window so that the changes to `PATH`
@@ -27,7 +27,7 @@ Selected operating system: **Linux**
    * `balena version` - should print the CLI's version
    * `balena help` - should print a list of available commands
 
-To update the balena CLI to a new version, download a new release zip file and replace the previous
+To update the balena CLI to a new version, download a new release tar.gz file and replace the previous
 installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
 as described above.
 

INSTALL-MAC.md

@@ -7,8 +7,8 @@ Selected operating system: **macOS**
 
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
-   Look for a file name that ends with "-installer.pkg":  
-   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`  
+   Look for a file name that ends with "-installer.pkg":
+   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.

INSTALL-WINDOWS.md

@@ -8,7 +8,7 @@ Selected operating system: **Windows**
 1. Download the installer from the [latest release
    page](https://github.com/balena-io/balena-cli/releases/latest).
    Look for a file name that ends with "-installer.exe":  
-   `balena-cli-vX.Y.Z-windows-x64-installer.exe`  
+   `balena-cli-vX.Y.Z-windows-x64-installer.exe`
 
 2. Double click on the downloaded file to run the installer and follow the installer's
    instructions.

TROUBLESHOOTING.md

@@ -115,7 +115,7 @@ If nothing seems to help, consider also using a different client-side terminal a
 ## "Docker seems to be unavailable" error when using Windows Subsystem for Linux (WSL)
 
 When running on WSL, the recommendation is to install a CLI release for Linux, like the standalone
-zip package for Linux. However, commands like "balena build" will, by default, attempt to reach the
+tar.gz package for Linux. However, commands like "balena build" will, by default, attempt to reach the
 Docker daemon at the Unix socket path `/var/run/docker.sock`, while Docker Desktop for Windows uses
 a Windows named pipe at `//./pipe/docker_engine` (which the Linux CLI on WSL cannot use). A
 solution is:

automation/build-bin.ts

@@ -15,29 +15,17 @@
  * limitations under the License.
  */
 
-import type { JsonVersions } from '../src/commands/version/index';
-
 import { run as oclifRun } from '@oclif/core';
-import * as archiver from 'archiver';
 import { exec, execFile } from 'child_process';
-import * as filehound from 'filehound';
 import type { Stats } from 'fs';
 import * as fs from 'fs-extra';
 import * as klaw from 'klaw';
 import * as path from 'path';
 import * as rimraf from 'rimraf';
-import * as semver from 'semver';
 import { promisify } from 'util';
 import { notarize } from '@electron/notarize';
 
-import { stripIndent } from '../build/utils/lazy';
-import {
-	diffLines,
-	loadPackageJson,
-	ROOT,
-	StdOutTap,
-	whichSpawn,
-} from './utils';
+import { loadPackageJson, ROOT, whichSpawn } from './utils';
 
 const execFileAsync = promisify(execFile);
 const execAsync = promisify(exec);
@@ -55,12 +43,6 @@ interface PathByPlatform {
 	[platform: string]: string;
 }
 
-const standaloneZips: PathByPlatform = {
-	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.zip`),
-	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.zip`),
-	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.zip`),
-};
-
 const getOclifInstallersOriginalNames = async (): Promise<PathByPlatform> => {
 	const { stdout } = await execAsync('git rev-parse --short HEAD');
 	const sha = stdout.trim();
@@ -75,260 +57,28 @@ const renamedOclifInstallers: PathByPlatform = {
 	win32: dPath(`balena-cli-${version}-windows-${arch}-installer.exe`),
 };
 
-export const finalReleaseAssets: { [platform: string]: string[] } = {
-	win32: [standaloneZips['win32'], renamedOclifInstallers['win32']],
-	darwin: [standaloneZips['darwin'], renamedOclifInstallers['darwin']],
-	linux: [standaloneZips['linux']],
+const getOclifStandaloneOriginalNames = async (): Promise<PathByPlatform> => {
+	const { stdout } = await execAsync('git rev-parse --short HEAD');
+	const sha = stdout.trim();
+	return {
+		linux: dPath(`balena-${version}-${sha}-linux-${arch}.tar.gz`),
+		darwin: dPath(`balena-${version}-${sha}-darwin-${arch}.tar.gz`),
+		win32: dPath(`balena-${version}-${sha}-win32-${arch}.tar.gz`),
+	};
 };
 
-/**
- * Given the output of `pkg` as a string (containing warning messages),
- * diff it against previously saved output of known "safe" warnings.
- * Throw an error if the diff is not empty.
- */
-async function diffPkgOutput(pkgOut: string) {
-	const { monochrome } = await import('../tests/helpers');
-	const relSavedPath = path.join(
-		'tests',
-		'test-data',
-		'pkg',
-		`expected-warnings-${process.platform}-${arch}.txt`,
-	);
-	const absSavedPath = path.join(ROOT, relSavedPath);
-	const ignoreStartsWith = [
-		'> pkg@',
-		'> Fetching base Node.js binaries',
-		'  fetched-',
-		'prebuild-install WARN install No prebuilt binaries found',
-	];
-	const modulesRE =
-		process.platform === 'win32'
-			? /(?<=[ '])([A-Z]:)?\\.+?\\node_modules(?=\\)/
-			: /(?<=[ '])\/.+?\/node_modules(?=\/)/;
-	const buildRE =
-		process.platform === 'win32'
-			? /(?<=[ '])([A-Z]:)?\\.+\\build(?=\\)/
-			: /(?<=[ '])\/.+\/build(?=\/)/;
-
-	const cleanLines = (chunks: string | string[]) => {
-		const lines = typeof chunks === 'string' ? chunks.split('\n') : chunks;
-		return lines
-			.map((line: string) => monochrome(line)) // remove ASCII colors
-			.filter((line: string) => !/^\s*$/.test(line)) // blank lines
-			.filter((line: string) =>
-				ignoreStartsWith.every((i) => !line.startsWith(i)),
-			)
-			.map((line: string) => {
-				// replace absolute paths with relative paths
-				let replaced = line.replace(modulesRE, 'node_modules');
-				if (replaced === line) {
-					replaced = line.replace(buildRE, 'build');
-				}
-				return replaced;
-			});
-	};
-
-	pkgOut = cleanLines(pkgOut).join('\n');
-	const { readFile } = (await import('fs')).promises;
-	const expectedOut = cleanLines(await readFile(absSavedPath, 'utf8')).join(
-		'\n',
-	);
-	if (expectedOut !== pkgOut) {
-		const sep =
-			'================================================================================';
-		const diff = diffLines(expectedOut, pkgOut);
-		const msg = `pkg output does not match expected output from "${relSavedPath}"
-Diff:
-${sep}
-${diff}
-${sep}
-Check whether the new or changed pkg warnings are safe to ignore, then update
-"${relSavedPath}"
-and share the result of your investigation as comments on the pull request.
-Hint: the fix is often a matter of updating the 'pkg.scripts' or 'pkg.assets'
-sections in the CLI's 'package.json' file, or a matter of updating the
-'buildPkg' function in 'automation/build-bin.ts'.  Sometimes it requires
-patching dependencies: See for example 'patches/all/open+7.0.2.patch'.
-${sep}
-`;
-		throw new Error(msg);
-	}
-}
-
-/**
- * Call `pkg.exec` to generate the standalone zip file, capturing its warning
- * messages (stdout and stderr) in order to call diffPkgOutput().
- */
-async function execPkg(...args: any[]) {
-	const { exec: pkgExec } = await import('@yao-pkg/pkg');
-	const outTap = new StdOutTap(true);
-	try {
-		outTap.tap();
-		await (pkgExec as any)(...args);
-	} catch (err) {
-		outTap.untap();
-		console.log(outTap.stdoutBuf.join(''));
-		console.error(outTap.stderrBuf.join(''));
-		throw err;
-	}
-	outTap.untap();
-	await diffPkgOutput(outTap.allBuf.join(''));
-}
-
-/**
- * Use the 'pkg' module to create a single large executable file with
- * the contents of 'node_modules' and the CLI's javascript code.
- * Also copy a number of native modules (binary '.node' files) that are
- * compiled during 'npm install' to the 'build-bin' folder, alongside
- * the single large executable file created by pkg. (This is necessary
- * because of a pkg limitation that does not allow binary executables
- * to be directly executed from inside another binary executable.)
- */
-async function buildPkg() {
-	// https://github.com/vercel/pkg#targets
-	let targets = `linux-${arch}`;
-	if (process.platform === 'darwin') {
-		targets = `macos-${arch}`;
-	}
-	// TBC: not yet possible to build for Windows arm64 on x64 nodes
-	if (process.platform === 'win32') {
-		targets = `win-x64`;
-	}
-	const args = [
-		'--targets',
-		targets,
-		'--output',
-		'build-bin/balena',
-		'package.json',
-	];
-	console.log('=======================================================');
-	console.log(`execPkg ${args.join(' ')}`);
-	console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
-	console.log('=======================================================');
-
-	await execPkg(args);
-
-	const paths: Array<[string, string[], string[]]> = [
-		// [platform, [source path], [destination path]]
-		['*', ['open', 'xdg-open'], ['xdg-open']],
-		['darwin', ['denymount', 'bin', 'denymount'], ['denymount']],
-	];
-	await Promise.all(
-		paths.map(([platform, source, dest]) => {
-			if (platform === '*' || platform === process.platform) {
-				// eg copy from node_modules/open/xdg-open to build-bin/xdg-open
-				return fs.copy(
-					path.join(ROOT, 'node_modules', ...source),
-					path.join(ROOT, 'build-bin', ...dest),
-				);
-			}
-		}),
-	);
-	const nativeExtensionPaths: string[] = await filehound
-		.create()
-		.paths(path.join(ROOT, 'node_modules'))
-		.ext(['node', 'dll'])
-		.find();
-
-	console.log(`\nCopying to build-bin:\n${nativeExtensionPaths.join('\n')}`);
-
-	await Promise.all(
-		nativeExtensionPaths.map((extPath) =>
-			fs.copy(
-				extPath,
-				extPath.replace(
-					path.join(ROOT, 'node_modules'),
-					path.join(ROOT, 'build-bin'),
-				),
-			),
-		),
-	);
-}
-
-/**
- * Run some basic tests on the built pkg executable.
- * TODO: test more than just `balena version -j`; integrate with the
- * existing mocha/chai CLI command testing.
- */
-async function testPkg() {
-	const pkgBalenaPath = path.join(
-		ROOT,
-		'build-bin',
-		process.platform === 'win32' ? 'balena.exe' : 'balena',
-	);
-	console.log(`Testing standalone package "${pkgBalenaPath}"...`);
-	// Run `balena version -j`, parse its stdout as JSON, and check that the
-	// reported Node.js major version matches semver.major(process.version)
-	let { stdout, stderr } = await execFileAsync(pkgBalenaPath, [
-		'version',
-		'-j',
-	]);
-	const { filterCliOutputForTests } = await import('../tests/helpers');
-	const filtered = filterCliOutputForTests({
-		err: stderr.split(/\r?\n/),
-		out: stdout.split(/\r?\n/),
-	});
-	stdout = filtered.out.join('\n');
-	stderr = filtered.err.join('\n');
-	let pkgNodeVersion = '';
-	let pkgNodeMajorVersion = 0;
-	try {
-		const balenaVersions: JsonVersions = JSON.parse(stdout);
-		pkgNodeVersion = balenaVersions['Node.js'];
-		pkgNodeMajorVersion = semver.major(pkgNodeVersion);
-	} catch (err) {
-		throw new Error(stripIndent`
-			Error parsing JSON output of "balena version -j": ${err}
-			Original output: "${stdout}"`);
-	}
-	if (semver.major(process.version) !== pkgNodeMajorVersion) {
-		throw new Error(
-			`Mismatched major version: built-in pkg Node version="${pkgNodeVersion}" vs process.version="${process.version}"`,
-		);
-	}
-	if (filtered.err.length > 0) {
-		const err = filtered.err.join('\n');
-		throw new Error(`"${pkgBalenaPath}": non-empty stderr "${err}"`);
-	}
-	console.log('Success! (standalone package test successful)');
-}
-
-/**
- * Create the zip file for the standalone 'pkg' bundle previously created
- * by the buildPkg() function in 'build-bin.ts'.
- */
-async function zipPkg() {
-	const outputFile = standaloneZips[process.platform];
-	if (!outputFile) {
-		throw new Error(
-			`Standalone installer unavailable for platform "${process.platform}"`,
-		);
-	}
-	await fs.mkdirp(path.dirname(outputFile));
-	await new Promise((resolve, reject) => {
-		console.log(`Zipping standalone package to "${outputFile}"...`);
-
-		const archive = archiver('zip', {
-			zlib: { level: 7 },
-		});
-		archive.directory(path.join(ROOT, 'build-bin'), 'balena-cli');
-
-		const outputStream = fs.createWriteStream(outputFile);
-
-		outputStream.on('close', resolve);
-		outputStream.on('error', reject);
-
-		archive.on('error', reject);
-		archive.on('warning', console.warn);
-
-		archive.pipe(outputStream);
-		archive.finalize().catch(reject);
-	});
-}
+const renamedOclifStandalone: PathByPlatform = {
+	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.tar.gz`),
+	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.tar.gz`),
+	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.tar.gz`),
+};
 
 export async function signFilesForNotarization() {
 	console.log('Signing files for notarization');
-	if (process.platform !== 'darwin') {
+	// If signFilesForNotarization is called on the test CI environment (which will not set CSC_LINK)
+	// then we skip the signing process.
+	if (process.platform !== 'darwin' || !process.env.CSC_LINK) {
+		console.log('Skipping signing for notarization');
 		return;
 	}
 	console.log('Deleting unneeded zip files...');
@@ -416,20 +166,39 @@ export async function signFilesForNotarization() {
 	]);
 }
 
-export async function buildStandaloneZip() {
-	console.log(`Building standalone zip package for CLI ${version}`);
+export async function buildStandalone() {
+	console.log(`Building standalone tarball for CLI ${version}`);
+	fs.rmSync('./tmp', { recursive: true, force: true });
+	fs.rmSync('./dist', { recursive: true, force: true });
+	fs.mkdirSync('./dist');
 	try {
-		await buildPkg();
-		await testPkg();
-		await zipPkg();
-		console.log(`Standalone zip package build completed`);
+		let packOpts = ['-r', ROOT, '--no-xz'];
+		if (process.platform === 'darwin') {
+			packOpts = packOpts.concat('--targets', `darwin-${arch}`);
+		} else if (process.platform === 'win32') {
+			packOpts = packOpts.concat('--targets', 'win32-x64');
+		} else if (process.platform === 'linux') {
+			packOpts = packOpts.concat('--targets', `linux-${arch}`);
+		}
+
+		console.log(`Building oclif installer for CLI ${version}`);
+		const packCmd = `pack:tarballs`;
+		console.log('=======================================================');
+		console.log(`oclif ${packCmd} ${packOpts.join(' ')}`);
+		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
+		console.log('=======================================================');
+		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
+		await oclifRun([packCmd].concat(...packOpts), oclifPath);
+		await renameStandalone();
+
+		console.log(`Standalone tarball package build completed`);
 	} catch (error) {
-		console.error(`Error creating or testing standalone zip package`);
+		console.error(`Error creating or testing standalone tarball package`);
 		throw error;
 	}
 }
 
-async function renameInstallerFiles() {
+async function renameInstallers() {
 	const oclifInstallers = await getOclifInstallersOriginalNames();
 	if (await fs.pathExists(oclifInstallers[process.platform])) {
 		await fs.rename(
@@ -439,6 +208,16 @@ async function renameInstallerFiles() {
 	}
 }
 
+async function renameStandalone() {
+	const oclifStandalone = await getOclifStandaloneOriginalNames();
+	if (await fs.pathExists(oclifStandalone[process.platform])) {
+		await fs.rename(
+			oclifStandalone[process.platform],
+			renamedOclifStandalone[process.platform],
+		);
+	}
+}
+
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
  * executable installer using Microsoft SignTool.exe (Sign Tool)
@@ -446,7 +225,7 @@ async function renameInstallerFiles() {
  */
 async function signWindowsInstaller() {
 	if (process.env.SM_CODE_SIGNING_CERT_SHA1_HASH) {
-		const exeName = renamedOclifInstallers[process.platform];
+		const exeName = (await getOclifInstallersOriginalNames())[process.platform];
 		console.log(`Signing installer "${exeName}"`);
 		// trust ...
 		await execFileAsync('signtool.exe', [
@@ -480,12 +259,14 @@ async function notarizeMacInstaller(): Promise<void> {
 	const appleId =
 		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
 	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
+	const appPath = (await getOclifInstallersOriginalNames())[process.platform];
+	console.log(`Notarizing file "${appPath}"`);
 
 	if (appleIdPassword && teamId) {
 		await notarize({
 			tool: 'notarytool',
 			teamId,
-			appPath: renamedOclifInstallers.darwin,
+			appPath,
 			appleId,
 			appleIdPassword,
 		});
@@ -525,7 +306,6 @@ export async function buildOclifInstaller() {
 		console.log('=======================================================');
 		const oclifPath = path.join(ROOT, 'node_modules', 'oclif');
 		await oclifRun([packCmd].concat(...packOpts), oclifPath);
-		await renameInstallerFiles();
 		// The Windows installer is explicitly signed here (oclif doesn't do it).
 		// The macOS installer is automatically signed by oclif (which runs the
 		// `pkgbuild` tool), using the certificate name given in package.json
@@ -537,6 +317,7 @@ export async function buildOclifInstaller() {
 			await notarizeMacInstaller(); // Notarize
 			console.log('Package notarized.');
 		}
+		await renameInstallers();
 		console.log(`oclif installer build completed`);
 	}
 }
@@ -572,4 +353,5 @@ export async function testShrinkwrap(): Promise<void> {
 	if (process.platform !== 'win32') {
 		await whichSpawn(path.resolve(__dirname, 'test-lock-deduplicated.sh'));
 	}
+	await Promise.resolve();
 }

automation/capitanodoc/capitanodoc.ts

@@ -145,7 +145,7 @@ export async function getCapitanoDoc(): Promise<typeof capitanoDoc> {
 				throw new Error(`Error parsing section title`);
 			}
 			// match[1] has the title, match[2] has the rest
-			return match && match[2];
+			return match?.[2];
 		}),
 		mdParser.getSectionOfTitle('Installation'),
 		mdParser.getSectionOfTitle('Choosing a shell (command prompt/terminal)'),

automation/run.ts

@@ -19,7 +19,7 @@ import * as _ from 'lodash';
 
 import {
 	buildOclifInstaller,
-	buildStandaloneZip,
+	buildStandalone,
 	catchUncommitted,
 	signFilesForNotarization,
 	testShrinkwrap,
@@ -36,7 +36,7 @@ process.env.DEBUG = ['0', 'no', 'false', '', undefined].includes(
  * Trivial command-line parser. Check whether the command-line argument is one
  * of the following strings, then call the appropriate functions:
  *     'build:installer'   (to build a native oclif installer)
- * 	   'build:standalone'  (to build a standalone pkg package)
+ * 	   'build:standalone'  (to build a standalone package)
  *
  * @param args Arguments to parse (default is process.argv.slice(2))
  */
@@ -49,7 +49,7 @@ async function parse(args?: string[]) {
 	}
 	const commands: { [cmd: string]: () => void | Promise<void> } = {
 		'build:installer': buildOclifInstaller,
-		'build:standalone': buildStandaloneZip,
+		'build:standalone': buildStandalone,
 		'sign:binaries': signFilesForNotarization,
 		'catch-uncommitted': catchUncommitted,
 		'test-shrinkwrap': testShrinkwrap,

automation/update-module.ts

@@ -3,7 +3,7 @@ import * as semver from 'semver';
 
 const changeTypes = ['major', 'minor', 'patch'] as const;
 
-const validateChangeType = (maybeChangeType: string = 'minor') => {
+const validateChangeType = (maybeChangeType = 'minor') => {
 	maybeChangeType = maybeChangeType.toLowerCase();
 	switch (maybeChangeType) {
 		case 'patch':
@@ -136,5 +136,4 @@ async function main() {
 	}
 }
 
-// eslint-disable-next-line @typescript-eslint/no-floating-promises
-main();
+void main();

automation/utils.ts

@@ -18,72 +18,10 @@
 import { spawn } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
-import { diffTrimmedLines } from 'diff';
+import * as whichMod from 'which';
 
 export const ROOT = path.join(__dirname, '..');
 
-/** Tap and buffer this process' stdout and stderr */
-export class StdOutTap {
-	public stdoutBuf: string[] = [];
-	public stderrBuf: string[] = [];
-	public allBuf: string[] = []; // both stdout and stderr
-
-	protected origStdoutWrite: typeof process.stdout.write;
-	protected origStderrWrite: typeof process.stdout.write;
-
-	constructor(protected printDots = false) {}
-
-	tap() {
-		this.origStdoutWrite = process.stdout.write;
-		this.origStderrWrite = process.stderr.write;
-
-		process.stdout.write = (chunk: string, ...args: any[]): boolean => {
-			this.stdoutBuf.push(chunk);
-			this.allBuf.push(chunk);
-			const str = this.printDots ? '.' : chunk;
-			return this.origStdoutWrite.call(process.stdout, str, ...args);
-		};
-
-		process.stderr.write = (chunk: string, ...args: any[]): boolean => {
-			this.stderrBuf.push(chunk);
-			this.allBuf.push(chunk);
-			const str = this.printDots ? '.' : chunk;
-			return this.origStderrWrite.call(process.stderr, str, ...args);
-		};
-	}
-
-	untap() {
-		process.stdout.write = this.origStdoutWrite;
-		process.stderr.write = this.origStderrWrite;
-		if (this.printDots) {
-			console.error('');
-		}
-	}
-}
-
-/**
- * Diff strings by line, using the 'diff' npm package:
- * https://www.npmjs.com/package/diff
- */
-export function diffLines(str1: string, str2: string): string {
-	const diffObjs = diffTrimmedLines(str1, str2);
-	const prefix = (chunk: string, char: string) =>
-		chunk
-			.split('\n')
-			.map((line: string) => `${char} ${line}`)
-			.join('\n');
-	const diffStr = diffObjs
-		.map((part: any) => {
-			return part.added
-				? prefix(part.value, '+')
-				: part.removed
-					? prefix(part.value, '-')
-					: prefix(part.value, ' ');
-		})
-		.join('\n');
-	return diffStr;
-}
-
 export function loadPackageJson() {
 	const packageJsonPath = path.join(ROOT, 'package.json');
 
@@ -101,7 +39,6 @@ export function loadPackageJson() {
  * @returns The program's full path, e.g. 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'
  */
 export async function which(program: string): Promise<string> {
-	const whichMod = await import('which');
 	let programPath: string;
 	try {
 		programPath = await whichMod(program);
@@ -132,7 +69,7 @@ export async function whichSpawn(
 					.on('error', reject)
 					.on('close', resolve);
 			} catch (err) {
-				reject(err);
+				reject(err as Error);
 			}
 		});
 	} catch (err) {

bin/dev.js

@@ -57,7 +57,10 @@ require('ts-node').register({
 	project: path.join(rootDir, 'tsconfig.json'),
 	transpileOnly: true,
 });
-require('../src/app').run(undefined, { dir: __dirname, development: true });
+void require('../src/app').run(undefined, {
+	dir: __dirname,
+	development: true,
+});
 
 // Modify package.json oclif paths from build/ -> src/, or vice versa
 function modifyOclifPaths(revert) {

bin/run.js

@@ -5,7 +5,7 @@
 process.env.UV_THREADPOOL_SIZE = '64';
 
 // Disable oclif registering ts-node
-process.env.OCLIF_TS_NODE = 0;
+process.env.OCLIF_TS_NODE = '0';
 
 async function run() {
 	// Use fast-boot to cache require lookups, speeding up startup
@@ -18,4 +18,4 @@ async function run() {
 	await require('../build/app').run(undefined, { dir: __dirname });
 }
 
-run();
+void run();

docs/balena-cli.md

@@ -326,6 +326,8 @@ or to authenticate requests to the API with an 'Authorization: Bearer <key>' hea
 Examples:
 
 	$ balena api-key generate "Jenkins Key"
+	$ balena api-key generate "Jenkins Key" 2025-10-30
+	$ balena api-key generate "Jenkins Key" never
 
 ### Arguments
 
@@ -333,6 +335,10 @@ Examples:
 
 the API key name
 
+#### EXPIRYDATE
+
+the expiry date of the API key as an ISO date string, or "never" for no expiry
+
 ## api-key list
 
 ### Aliases
@@ -568,9 +574,9 @@ Generate a config.json file for a device or fleet.
 The target balenaOS version must be specified with the --version option.
 
 The '--dev' option is used to configure balenaOS to operate in development mode,
-allowing anauthenticated root ssh access and exposing network ports such as
+allowing unauthenticated root ssh access and exposing network ports such as
 balenaEngine's 2375 (unencrypted). This option causes `"developmentMode": true`
-to be inserted in the 'config.json' file in the image's boot partion. Development
+to be inserted in the 'config.json' file in the image's boot partition. Development
 mode (as a configurable option) is applicable to balenaOS releases from early
 2022. Older releases have separate development and production balenaOS images
 that cannot be reconfigured through 'config.json' or the '--dev' option. Do not
@@ -2866,9 +2872,9 @@ The --device-type option is used to override the fleet's default device type,
 in case of a fleet with mixed device types.
 
 The '--dev' option is used to configure balenaOS to operate in development mode,
-allowing anauthenticated root ssh access and exposing network ports such as
+allowing unauthenticated root ssh access and exposing network ports such as
 balenaEngine's 2375 (unencrypted). This option causes `"developmentMode": true`
-to be inserted in the 'config.json' file in the image's boot partion. Development
+to be inserted in the 'config.json' file in the image's boot partition. Development
 mode (as a configurable option) is applicable to balenaOS releases from early
 2022. Older releases have separate development and production balenaOS images
 that cannot be reconfigured through 'config.json' or the '--dev' option. Do not

eslint.config.js

@@ -0,0 +1,32 @@
+const { FlatCompat } = require('@eslint/eslintrc');
+
+const compat = new FlatCompat({
+	baseDirectory: __dirname,
+});
+module.exports = [
+	...require('@balena/lint/config/eslint.config'),
+	...compat.config({
+		parserOptions: {
+			project: 'tsconfig.dev.json',
+		},
+		ignorePatterns: ['**/generate-completion.js', '**/bin/**/*'],
+		rules: {
+			ignoreDefinitionFiles: 0,
+			'@typescript-eslint/no-non-null-assertion': 'off',
+			'@typescript-eslint/no-shadow': 'off',
+			'@typescript-eslint/no-var-requires': 'off',
+			'@typescript-eslint/no-require-imports': 'off',
+			'@typescript-eslint/no-unnecessary-type-assertion': 'off',
+			'@typescript-eslint/prefer-nullish-coalescing': 'warn',
+
+			'no-restricted-imports': ['error', {
+				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
+			}],
+
+			'@typescript-eslint/no-unused-vars': ['error', {
+				argsIgnorePattern: '^_',
+				caughtErrorsIgnorePattern: '^_',
+			}],
+		},
+	}),
+];

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "20.0.7",
+  "version": "21.1.12",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -24,30 +24,10 @@
   "bin": {
     "balena": "./bin/run.js"
   },
-  "pkg": {
-    "scripts": [
-      "build/**/*.js",
-      "node_modules/balena-sdk/es2018/index.js",
-      "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
-      "node_modules/@balena/compose/dist/parse/schemas/*.json"
-    ],
-    "assets": [
-      "build/auth/pages/*.ejs",
-      "node_modules/balena-sdk/node_modules/balena-pine/**/*",
-      "node_modules/balena-pine/**/*",
-      "node_modules/pinejs-client-core/**/*",
-      "node_modules/open/xdg-open",
-      "node_modules/windosu/*.bat",
-      "node_modules/windosu/*.cmd",
-      "node_modules/axios/**/*",
-      "npm-shrinkwrap.json",
-      "oclif.manifest.json"
-    ]
-  },
   "scripts": {
     "postinstall": "node patches/apply-patches.js",
     "prebuild": "rimraf build/ build-bin/",
-    "pretarball": "ts-node --transpile-only ../../automation/run.ts sign:binaries",
+    "pretarball": "modclean && ts-node --transpile-only ../../automation/run.ts sign:binaries",
     "build": "npm run build:src && npm run catch-uncommitted",
     "build:t": "npm run lint && npm run build:fast && npm run build:test",
     "build:src": "npm run lint && npm run build:fast && npm run build:test && npm run build:doc && npm run build:completion",
@@ -58,6 +38,7 @@
     "build:completion": "node completion/generate-completion.js",
     "build:standalone": "ts-node --transpile-only automation/run.ts build:standalone",
     "build:installer": "ts-node --transpile-only automation/run.ts build:installer",
+    "deduplicate-dependencies": "npm dd && git add npm-shrinkwrap.json && git commit --message \"Deduplicate dependencies\"",
     "package": "npm run build:fast && npm run build:standalone && npm run build:installer",
     "pretest": "npm run build",
     "test": "npm run test:shrinkwrap && npm run test:core",
@@ -111,16 +92,14 @@
     }
   },
   "devDependencies": {
-    "@balena/lint": "^8.0.0",
+    "@balena/lint": "^9.1.3",
     "@electron/notarize": "^2.0.0",
-    "@types/archiver": "^6.0.2",
     "@types/bluebird": "^3.5.36",
     "@types/body-parser": "^1.19.2",
     "@types/chai": "^4.3.0",
     "@types/chai-as-promised": "^7.1.4",
     "@types/cli-truncate": "^2.0.0",
     "@types/common-tags": "^1.8.1",
-    "@types/diff": "^5.0.3",
     "@types/dockerode": "3.3.23",
     "@types/ejs": "^3.1.0",
     "@types/express": "^4.17.13",
@@ -159,16 +138,12 @@
     "@types/update-notifier": "^4.1.1",
     "@types/which": "^2.0.1",
     "@types/window-size": "^1.1.1",
-    "@yao-pkg/pkg": "^5.11.1",
-    "archiver": "^7.0.1",
     "catch-uncommitted": "^2.0.0",
     "chai": "^4.3.4",
     "chai-as-promised": "^7.1.1",
     "cross-env": "^7.0.3",
     "deep-object-diff": "^1.1.0",
-    "diff": "^5.0.0",
     "ent": "^2.2.0",
-    "filehound": "^1.17.5",
     "fs-extra": "^11.2.0",
     "http-proxy": "^1.18.1",
     "husky": "^9.1.5",
@@ -179,28 +154,29 @@
     "mocha": "^10.6.0",
     "mock-fs": "^5.2.0",
     "mock-require": "^3.0.3",
+    "modclean": "^3.0.0-beta.1",
     "nock": "^13.2.1",
-    "oclif": "^4.14.0",
+    "oclif": "^4.17.0",
     "rewire": "^7.0.0",
     "simple-git": "^3.14.1",
     "sinon": "^19.0.0",
     "string-to-stream": "^3.0.1",
     "ts-node": "^10.4.0",
-    "typescript": "^5.7.2"
+    "typescript": "^5.8.2"
   },
   "dependencies": {
-    "@balena/compose": "^5.0.0",
+    "@balena/compose": "^7.0.9",
     "@balena/dockerignore": "^1.0.2",
     "@balena/env-parsing": "^1.1.8",
     "@balena/es-version": "^1.0.1",
-    "@oclif/core": "^4.0.31",
+    "@oclif/core": "^4.1.0",
     "@sentry/node": "^6.16.1",
-    "balena-config-json": "^4.2.0",
-    "balena-device-init": "^7.0.1",
+    "balena-config-json": "^4.2.7",
+    "balena-device-init": "^8.1.3",
     "balena-errors": "^4.7.3",
-    "balena-image-fs": "^7.0.6",
-    "balena-preload": "^16.0.0",
-    "balena-sdk": "^20.3.0",
+    "balena-image-fs": "^7.5.2",
+    "balena-preload": "^18.0.1",
+    "balena-sdk": "^21.3.0",
     "balena-semver": "^2.3.0",
     "balena-settings-client": "^5.0.2",
     "balena-settings-storage": "^8.1.0",
@@ -211,10 +187,11 @@
     "cli-truncate": "^2.1.0",
     "color-hash": "^1.1.1",
     "common-tags": "^1.7.2",
+    "date-fns": "^4.1.0",
     "denymount": "^2.3.0",
-    "docker-modem": "^5.0.3",
+    "docker-modem": "^5.0.6",
     "docker-progress": "^5.1.3",
-    "dockerode": "^4.0.2",
+    "dockerode": "^4.0.5",
     "ejs": "^3.1.6",
     "etcher-sdk": "9.1.0",
     "express": "^4.17.2",
@@ -274,6 +251,6 @@
     }
   },
   "versionist": {
-    "publishedAt": "2024-11-23T17:38:06.077Z"
+    "publishedAt": "2025-05-16T18:54:50.104Z"
   }
 }

patches/all/oclif+4.17.0.dev.patch

@@ -1,8 +1,8 @@
 diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index ef7f90e..8264b7c 100644
+index bfe9205..482519e 100644
 --- a/node_modules/oclif/lib/commands/pack/win.js
 +++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -76,6 +76,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+@@ -86,6 +86,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
  ${customization}
  
  Section "${config.name} CLI \${VERSION}"
@@ -16,20 +16,18 @@ index ef7f90e..8264b7c 100644
    File /r bin
    File /r client
 diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index 14d5a6e..7b42a6f 100644
+index f0c8d95..a72400e 100644
 --- a/node_modules/oclif/lib/tarballs/build.js
 +++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -200,6 +200,13 @@ const extractCLI = async (tarball, c) => {
+@@ -218,6 +218,11 @@ const extractCLI = async (tarball, c) => {
          (0, promises_1.rm)(path.join(workspace, path.basename(tarball)), { recursive: true }),
          (0, fs_extra_1.remove)(path.join(workspace, 'bin', 'run.cmd')),
      ]);
-+
 +    // The oclif installers are a production installation, while the source
 +    // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
 +    // This has previously led to issues preventing the CLI from starting, so
 +    // delete `.fast-boot.json` (if any) from the destination folder.
 +    await (0, fs_extra_1.remove)(path.join(workspace, 'bin', '.fast-boot.json'));
-+
  };
  const buildTarget = async (target, c, options) => {
-     const workspace = c.workspace(target);
+     if (target.platform === 'win32' && target.arch === 'arm64' && (0, semver_1.lt)(c.nodeVersion, '20.0.0')) {

patches/all/open+7.4.2.patch

@@ -1,16 +0,0 @@
-diff --git a/node_modules/open/index.js b/node_modules/open/index.js
-index 13147d0..ff161dd 100644
---- a/node_modules/open/index.js
-+++ b/node_modules/open/index.js
-@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
- const pReadFile = promisify(fs.readFile);
- 
- // Path to included `xdg-open`.
--const localXdgOpenPath = path.join(__dirname, 'xdg-open');
-+const localXdgOpenPath = process.pkg
-+	? path.join(path.dirname(process.execPath), 'xdg-open')
-+	: path.join(__dirname, 'xdg-open');
-+
- 
- /**
- Get the mount point for fixed drives in WSL.

patches/unix/node-gyp-build+4.6.0.patch

@@ -1,14 +0,0 @@
-diff --git a/node_modules/node-gyp-build/node-gyp-build.js b/node_modules/node-gyp-build/node-gyp-build.js
-index 61b398e..3cc3be8 100644
---- a/node_modules/node-gyp-build/node-gyp-build.js
-+++ b/node_modules/node-gyp-build/node-gyp-build.js
-@@ -30,6 +30,9 @@ load.resolve = load.path = function (dir) {
-     if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD']
-   } catch (err) {}
- 
-+  // pkg fix: native node modules are located externally to the pkg executable
-+  dir = dir.replace(/^\/snapshot\/.+?\/node_modules\//, path.dirname(process.execPath) + path.sep)
-+
-   if (!prebuildsOnly) {
-     var release = getFirst(path.join(dir, 'build/Release'), matchBuild)
-     if (release) return release

patches/win32/windosu+0.3.0.patch

@@ -1,38 +0,0 @@
-diff --git a/node_modules/windosu/lib/pipe.js b/node_modules/windosu/lib/pipe.js
-index dc81fa5..a381cc7 100644
---- a/node_modules/windosu/lib/pipe.js
-+++ b/node_modules/windosu/lib/pipe.js
-@@ -42,7 +42,8 @@ function pipe(path, options) {
-     return d.promise;
- }
- module.exports = pipe;
--if (module === require.main) {
-+
-+function main() {
-     if (!process.argv[4]) {
-         console.error('Incorrect arguments!');
-         process.exit(-1);
-@@ -52,3 +53,8 @@ if (module === require.main) {
-         serve: process.argv[3] == 'server'
-     });
- }
-+module.exports.main = main;
-+
-+if (module === require.main) {
-+    main();
-+}
-diff --git a/node_modules/windosu/lib/windosu.js b/node_modules/windosu/lib/windosu.js
-index 6502812..dd0391a 100644
---- a/node_modules/windosu/lib/windosu.js
-+++ b/node_modules/windosu/lib/windosu.js
-@@ -16,7 +16,9 @@ module.exports.exec = function (command, options, callback) {
-                         temp: temp,
-                         command: command,
-                         cliWidth: cliWidth(),
--                        pipe: '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
-+                        pipe: process.pkg
-+                            ? '"' + process.execPath + '" pkgExec "' + path.join(__dirname, 'pipe.js') + '::main"'
-+                            : '"' + process.execPath + '" "' + path.join(__dirname, 'pipe.js') + '"',
-                         input: inputName = id + '-in',
-                         output: outputName = id + '-out',
-                         stderr_redir: process.stdout.isTTY ? '2>&1' : '2> %ERROR%'

repo.yml

@@ -6,6 +6,10 @@ upstream:
     url: 'https://github.com/balena-io/balena-sdk'
   - repo: 'balena-config-json'
     url: 'https://github.com/balena-io-modules/balena-config-json'
+  - repo: 'balena-image-fs'
+    url: 'https://github.com/balena-io-modules/balena-image-fs'
+  - repo: 'balena-device-init'
+    url: 'https://github.com/balena-io-modules/balena-device-init'
   - repo: 'balena-image-manager'
     url: 'https://github.com/balena-io-modules/balena-image-manager'
   - repo: 'balena-preload'

src/app.ts

@@ -101,11 +101,9 @@ async function init() {
 
 /** Execute the oclif parser and the CLI command. */
 async function oclifRun(command: string[], options: AppOptions) {
-	let deprecationPromise: Promise<void>;
+	let deprecationPromise: Promise<void> | undefined;
 	// check and enforce the CLI's deprecation policy
-	if (unsupportedFlag || process.env.BALENARC_UNSUPPORTED) {
-		deprecationPromise = Promise.resolve();
-	} else {
+	if (!(unsupportedFlag || process.env.BALENARC_UNSUPPORTED)) {
 		const { DeprecationChecker } = await import('./deprecation');
 		const deprecationChecker = new DeprecationChecker(packageJSON.version);
 		// warnAndAbortIfDeprecated uses previously cached data only
@@ -161,18 +159,12 @@ async function oclifRun(command: string[], options: AppOptions) {
 /** CLI entrypoint. Called by the `bin/run.js` and `bin/dev.js` scripts. */
 export async function run(cliArgs = process.argv, options: AppOptions) {
 	try {
-		const { setOfflineModeEnvVars, normalizeEnvVars, pkgExec } = await import(
+		const { setOfflineModeEnvVars, normalizeEnvVars } = await import(
 			'./utils/bootstrap'
 		);
 		setOfflineModeEnvVars();
 		normalizeEnvVars();
 
-		// The 'pkgExec' special/internal command provides a Node.js interpreter
-		// for use of the standalone zip package. See pkgExec function.
-		if (cliArgs.length > 3 && cliArgs[2] === 'pkgExec') {
-			return pkgExec(cliArgs[3], cliArgs.slice(4));
-		}
-
 		await init();
 
 		// Look for commands that have been removed and if so, exit with a notice

src/commands/api-key/generate.ts

@@ -17,7 +17,16 @@
 
 import { Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
-import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
+import {
+	formatDuration,
+	intervalToDuration,
+	isValid,
+	parseISO,
+} from 'date-fns';
+
+// In days
+const durations = [1, 7, 30, 90];
 
 async function isLoggedInWithJwt() {
 	const balena = getBalenaSdk();
@@ -41,13 +50,21 @@ export default class GenerateCmd extends Command {
 		This key can be used to log into the CLI using 'balena login --token <key>',
 		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
 `;
-	public static examples = ['$ balena api-key generate "Jenkins Key"'];
+	public static examples = [
+		'$ balena api-key generate "Jenkins Key"',
+		'$ balena api-key generate "Jenkins Key" 2025-10-30',
+		'$ balena api-key generate "Jenkins Key" never',
+	];
 
 	public static args = {
 		name: Args.string({
 			description: 'the API key name',
 			required: true,
 		}),
+		expiryDate: Args.string({
+			description:
+				'the expiry date of the API key as an ISO date string, or "never" for no expiry',
+		}),
 	};
 
 	public static authenticated = true;
@@ -55,9 +72,61 @@ export default class GenerateCmd extends Command {
 	public async run() {
 		const { args: params } = await this.parse(GenerateCmd);
 
+		let expiryDateResponse: string | number | undefined = params.expiryDate;
 		let key;
 		try {
-			key = await getBalenaSdk().models.apiKey.create(params.name);
+			if (!expiryDateResponse) {
+				expiryDateResponse = await getCliForm().ask({
+					message: 'Please pick an expiry date for the API key',
+					type: 'list',
+					choices: [...durations, 'custom', 'never'].map((duration) => ({
+						name:
+							duration === 'never'
+								? 'No expiration'
+								: typeof duration === 'number'
+									? formatDuration(
+											intervalToDuration({
+												start: 0,
+												end: duration * 24 * 60 * 60 * 1000,
+											}),
+										)
+									: 'Custom expiration',
+						value: duration,
+					})),
+				});
+			}
+			let expiryDate: Date | null;
+			if (expiryDateResponse === 'never') {
+				expiryDate = null;
+			} else if (expiryDateResponse === 'custom') {
+				do {
+					expiryDate = parseISO(
+						await getCliForm().ask({
+							message:
+								'Please enter an expiry date for the API key as an ISO date string',
+							type: 'input',
+						}),
+					);
+					if (!isValid(expiryDate)) {
+						console.error('Invalid date format');
+					}
+				} while (!isValid(expiryDate));
+			} else if (typeof expiryDateResponse === 'string') {
+				expiryDate = parseISO(expiryDateResponse);
+				if (!isValid(expiryDate)) {
+					throw new Error(
+						'Invalid date format, please use a valid ISO date string',
+					);
+				}
+			} else {
+				expiryDate = new Date(
+					Date.now() + expiryDateResponse * 24 * 60 * 60 * 1000,
+				);
+			}
+			key = await getBalenaSdk().models.apiKey.create({
+				name: params.name,
+				expiryDate: expiryDate === null ? null : expiryDate.toISOString(),
+			});
 		} catch (e) {
 			if (e.name === 'BalenaNotLoggedIn') {
 				if (await isLoggedInWithJwt()) {

src/commands/api-key/revoke.ts

@@ -50,9 +50,9 @@ export default class RevokeCmd extends Command {
 			return;
 		}
 		await Promise.all(
-			apiKeyIds.map(
-				async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
-			),
+			apiKeyIds.map(async (id) => {
+				await getBalenaSdk().models.apiKey.revoke(Number(id));
+			}),
 		);
 		console.log('Successfully revoked the given API keys');
 	}

src/commands/config/inject.ts

@@ -64,7 +64,12 @@ export default class ConfigInjectCmd extends Command {
 		);
 
 		const config = await import('balena-config-json');
-		await config.write(drive, '', configJSON);
+		await config.write(
+			drive,
+			// Will be removed in the next major of balena-config-json
+			undefined,
+			configJSON,
+		);
 
 		console.info('Done');
 	}

src/commands/config/read.ts

@@ -54,7 +54,7 @@ export default class ConfigReadCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive, '');
+		const configJSON = await config.read(drive);
 
 		if (options.json) {
 			console.log(JSON.stringify(configJSON, null, 4));

src/commands/config/reconfigure.ts

@@ -62,7 +62,7 @@ export default class ConfigReconfigureCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const { uuid } = await config.read(drive, '');
+		const { uuid } = await config.read(drive);
 		await safeUmount(drive);
 
 		if (!uuid) {

src/commands/config/write.ts

@@ -64,14 +64,19 @@ export default class ConfigWriteCmd extends Command {
 		await safeUmount(drive);
 
 		const config = await import('balena-config-json');
-		const configJSON = await config.read(drive, '');
+		const configJSON = await config.read(drive);
 
 		console.info(`Setting ${params.key} to ${params.value}`);
 		ConfigWriteCmd.updateConfigJson(configJSON, params.key, params.value);
 
 		await denyMount(drive, async () => {
 			await safeUmount(drive);
-			await config.write(drive, '', configJSON);
+			await config.write(
+				drive,
+				// Will be removed in the next major of balena-config-json
+				undefined,
+				configJSON,
+			);
 		});
 
 		console.info('Done');

src/commands/deploy/index.ts

@@ -368,6 +368,7 @@ ${dockerignoreHelp}
 					!opts.shouldUploadLogs,
 					composeOpts.projectPath,
 					opts.createAsDraft,
+					project.descriptors,
 				);
 			}
 

src/commands/device/detect.ts

@@ -91,7 +91,7 @@ export default class DeviceDetectCmd extends Command {
 				try {
 					await docker.ping();
 					return true;
-				} catch (err) {
+				} catch {
 					return false;
 				}
 			}),

src/commands/device/index.ts

@@ -77,45 +77,59 @@ export default class DeviceCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const device = (await balena.models.device.get(
-			params.uuid,
-			options.json
-				? {
-						$expand: {
-							device_tag: {
-								$select: ['tag_key', 'value'],
-							},
-							...expandForAppName.$expand,
+		let device: ExtendedDevice;
+		if (options.json) {
+			const [deviceBase, deviceComputed] = await Promise.all([
+				balena.models.device.get(params.uuid, {
+					$expand: {
+						device_tag: {
+							$select: ['tag_key', 'value'],
 						},
-					}
-				: {
-						$select: [
-							'device_name',
-							'id',
-							'overall_status',
-							'is_online',
-							'ip_address',
-							'mac_address',
-							'last_connectivity_event',
-							'uuid',
-							'supervisor_version',
-							'is_web_accessible',
-							'note',
-							'os_version',
-							'memory_usage',
-							'memory_total',
-							'public_address',
-							'storage_block_device',
-							'storage_usage',
-							'storage_total',
-							'cpu_usage',
-							'cpu_temp',
-							'cpu_id',
-							'is_undervolted',
-						],
-						...expandForAppName,
+						...expandForAppName.$expand,
 					},
-		)) as ExtendedDevice;
+				}),
+				balena.models.device.get(params.uuid, {
+					$select: [
+						'overall_status',
+						'overall_progress',
+						'should_be_running__release',
+					],
+				}),
+			]);
+
+			device = {
+				...deviceBase,
+				...deviceComputed,
+			} as ExtendedDevice;
+		} else {
+			device = (await balena.models.device.get(params.uuid, {
+				$select: [
+					'device_name',
+					'id',
+					'overall_status',
+					'is_online',
+					'ip_address',
+					'mac_address',
+					'last_connectivity_event',
+					'uuid',
+					'supervisor_version',
+					'is_web_accessible',
+					'note',
+					'os_version',
+					'memory_usage',
+					'memory_total',
+					'public_address',
+					'storage_block_device',
+					'storage_usage',
+					'storage_total',
+					'cpu_usage',
+					'cpu_temp',
+					'cpu_id',
+					'is_undervolted',
+				],
+				...expandForAppName,
+			})) as ExtendedDevice;
+		}
 
 		if (options.view) {
 			const open = await import('open');

src/commands/device/init.ts

@@ -155,7 +155,7 @@ export default class DeviceInitCmd extends Command {
 			try {
 				logger.logDebug(`Process failed, removing device ${device.uuid}`);
 				await balena.models.device.remove(device.uuid);
-			} catch (e) {
+			} catch {
 				// Ignore removal failures, and throw original error
 			}
 			throw e;

src/commands/device/logs.ts

@@ -135,7 +135,7 @@ export default class DeviceLogsCmd extends Command {
 			logger.logDebug('Checking we can access device');
 			try {
 				await deviceApi.ping();
-			} catch (e) {
+			} catch {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(
 					`Cannot access device at address ${params.device}.  Device may not be in local mode.`,

src/commands/device/os-update.ts

@@ -20,6 +20,7 @@ import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
+import { getExpandedProp } from '../../utils/pine';
 
 export default class DeviceOsUpdateCmd extends Command {
 	public static description = stripIndent`
@@ -126,20 +127,46 @@ export default class DeviceOsUpdateCmd extends Command {
 				);
 			}
 		} else {
+			const choices = await Promise.all(
+				hupVersionInfo.versions.map(async (version) => {
+					const takeoverRequired =
+						(await sdk.models.os.getOsUpdateType(
+							getExpandedProp(is_of__device_type, 'slug')!,
+							currentOsVersion,
+							version,
+						)) === 'takeover';
+
+					return {
+						name: `${version}${hupVersionInfo.recommended === version ? ' (recommended)' : ''}${takeoverRequired ? ' ADVANCED UPDATE: Requires disk re-partitioning with no rollback option' : ''}`,
+						value: version,
+					};
+				}),
+			);
 			targetOsVersion = await getCliForm().ask({
 				message: 'Target OS version',
 				type: 'list',
-				choices: hupVersionInfo.versions.map((version) => ({
-					name:
-						hupVersionInfo.recommended === version
-							? `${version} (recommended)`
-							: version,
-					value: version,
-				})),
+				choices,
 			});
 		}
 
+		const takeoverRequired =
+			(await sdk.models.os.getOsUpdateType(
+				getExpandedProp(is_of__device_type, 'slug')!,
+				currentOsVersion,
+				targetOsVersion,
+			)) === 'takeover';
 		const patterns = await import('../../utils/patterns');
+		// Warn the user if the update requires a takeover
+		if (takeoverRequired) {
+			await patterns.confirm(
+				options.yes || false,
+				stripIndent`Before you proceed, note that this update process is different from a regular HostOS Update:
+DATA LOSS: This update requires disk re-partitioning, which will erase all data stored on the device.
+NO ROLLBACK: Unlike our HostOS update mechanism, this process does not allow reverting to a previous version in case of failure.
+Make sure to back up all important data before continuing. For more details, check our documentation: https://docs.balena.io/reference/OS/updates/update-process/
+`,
+			);
+		}
 		// Confirm and start update
 		await patterns.confirm(
 			options.yes || false,

src/commands/device/register.ts

@@ -76,6 +76,6 @@ export default class DeviceRegisterCmd extends Command {
 			options.deviceType,
 		);
 
-		return result && result.uuid;
+		return result.uuid;
 	}
 }

src/commands/device/ssh.ts

@@ -82,7 +82,7 @@ export default class DeviceSSHCmd extends Command {
 				SSH server port number (default 22222) if the target is an IP address or .local
 				hostname. Otherwise, port number for the balenaCloud gateway (default 22).`,
 			char: 'p',
-			parse: async (p) => parseAsInteger(p, 'port'),
+			parse: (p) => parseAsInteger(p, 'port'),
 		}),
 		tty: Flags.boolean({
 			default: false,
@@ -110,13 +110,14 @@ export default class DeviceSSHCmd extends Command {
 		// Local connection
 		if (validateLocalHostnameOrIp(params.fleetOrDevice)) {
 			const { performLocalDeviceSSH } = await import('../../utils/device/ssh');
-			return await performLocalDeviceSSH({
+			await performLocalDeviceSSH({
 				hostname: params.fleetOrDevice,
 				port: options.port || 'local',
 				forceTTY: options.tty,
 				verbose: options.verbose,
 				service: params.service,
 			});
+			return;
 		}
 
 		// Remote connection
@@ -132,7 +133,7 @@ export default class DeviceSSHCmd extends Command {
 		const useProxy = !!proxyConfig && !options.noproxy;
 
 		// this will be a tunnelled SSH connection...
-		await checkNotUsingOfflineMode();
+		checkNotUsingOfflineMode();
 		await checkLoggedIn();
 		const deviceUuid = await getOnlineTargetDeviceUuid(
 			sdk,

src/commands/env/rename.ts

@@ -41,7 +41,7 @@ export default class EnvRenameCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: async (input) => parseAsInteger(input, 'id'),
+			parse: (input) => parseAsInteger(input, 'id'),
 		}),
 		value: Args.string({
 			required: true,

src/commands/env/rm.ts

@@ -46,7 +46,7 @@ export default class EnvRmCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: async (input) => parseAsInteger(input, 'id'),
+			parse: (input) => parseAsInteger(input, 'id'),
 		}),
 	};
 

src/commands/local/configure.ts

@@ -16,7 +16,6 @@
  */
 
 import { Args, Command } from '@oclif/core';
-import { promisify } from 'util';
 import { stripIndent } from '../../utils/lazy';
 
 export default class LocalConfigureCmd extends Command {
@@ -237,7 +236,7 @@ export default class LocalConfigureCmd extends Command {
 		const bootPartition = await getBootPartition(target);
 
 		const files = await imagefs.interact(target, bootPartition, async (_fs) => {
-			return await promisify(_fs.readdir)(this.CONNECTIONS_FOLDER);
+			return await _fs.promises.readdir(this.CONNECTIONS_FOLDER);
 		});
 
 		let connectionFileName;
@@ -246,13 +245,11 @@ export default class LocalConfigureCmd extends Command {
 		} else if (_.includes(files, 'resin-sample.ignore')) {
 			// Fresh image, new mode, accoding to https://github.com/balena-os/meta-balena/pull/770/files
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				const readFileAsync = promisify(_fs.readFile);
-				const writeFileAsync = promisify(_fs.writeFile);
-				const contents = await readFileAsync(
+				const contents = await _fs.promises.readFile(
 					`${this.CONNECTIONS_FOLDER}/resin-sample.ignore`,
 					{ encoding: 'utf8' },
 				);
-				return await writeFileAsync(
+				await _fs.promises.writeFile(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					contents,
 				);
@@ -269,13 +266,13 @@ export default class LocalConfigureCmd extends Command {
 		} else {
 			// In case there's no file at all (shouldn't happen normally, but the file might have been removed)
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				return await promisify(_fs.writeFile)(
+				await _fs.promises.writeFile(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					this.CONNECTION_FILE,
 				);
 			});
 		}
-		return await this.getConfigurationSchema(bootPartition, connectionFileName);
+		return this.getConfigurationSchema(bootPartition, connectionFileName);
 	}
 
 	async removeHostname(schema: any) {

src/commands/login/index.ts

@@ -132,7 +132,7 @@ export default class LoginCmd extends Command {
 		// We can safely assume this won't be undefined as doLogin will throw if this call fails
 		// We also don't need to worry too much about the amount of calls to whoami
 		// as these are cached by the SDK
-		const whoamiResult = (await balena.auth.whoami()) as WhoamiResult;
+		const whoamiResult = (await balena.auth.whoami())!;
 
 		if (whoamiResult.actorType !== 'user' && !options.hideExperimentalWarning) {
 			console.info(stripIndent`
@@ -168,7 +168,7 @@ ${messages.reachingOut}`);
 
 	async doLogin(
 		loginOptions: FlagsDef,
-		balenaUrl: string = 'balena-cloud.com',
+		balenaUrl = 'balena-cloud.com',
 		token?: string,
 	): Promise<void> {
 		// Token

src/commands/os/configure.ts

@@ -18,7 +18,6 @@
 import { Flags, Args, Command } from '@oclif/core';
 import type { Interfaces } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
-import { promisify } from 'util';
 import * as _ from 'lodash';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
@@ -292,7 +291,7 @@ export default class OsConfigureCmd extends Command {
 
 			for (const { name, content } of files) {
 				await imagefs.interact(image, bootPartition, async (_fs) => {
-					return await promisify(_fs.writeFile)(
+					await _fs.promises.writeFile(
 						path.join(CONNECTIONS_FOLDER, name),
 						content,
 					);

src/commands/preload/index.ts

@@ -37,6 +37,7 @@ import type {
 	Release,
 } from 'balena-sdk';
 import type { Preloader } from 'balena-preload';
+import type * as Fs from 'fs';
 
 export default class PreloadCmd extends Command {
 	public static description = stripIndent`
@@ -109,7 +110,7 @@ https://github.com/balena-io-examples/staged-releases\
 		'additional-space': Flags.integer({
 			description:
 				'expand the image by this amount of bytes instead of automatically estimating the required amount',
-			parse: async (x) => parseAsInteger(x, 'additional-space'),
+			parse: (x) => parseAsInteger(x, 'additional-space'),
 		}),
 		'add-certificate': Flags.string({
 			description: `\
@@ -126,7 +127,7 @@ Can be repeated to add multiple certificates.\
 		dockerPort: Flags.integer({
 			description:
 				'Docker daemon TCP port number (hint: 2375 for balena devices)',
-			parse: async (p) => parseAsInteger(p, 'dockerPort'),
+			parse: (p) => parseAsInteger(p, 'dockerPort'),
 		}),
 	};
 
@@ -155,12 +156,48 @@ Can be repeated to add multiple certificates.\
 					------------------------------------------------------------------------------
 					`);
 			}
-		} catch (error) {
+		} catch {
 			throw new ExpectedError(
 				`The provided image path does not exist: ${params.image}`,
 			);
 		}
 
+		// Verify that image is not enabled for secure boot. First, confirm it is
+		// a secure boot image with a .sig file in the /opt directory of the rootA
+		// partition. For example, below are contents for generic-amd64 device type:
+		// $ ls -l opt
+		// total 864696
+		// -rw-r--r-- 1 root root 2378170368 Mar 26 09:14 balena-image-generic-amd64.balenaos-img
+		// -rw-r--r-- 1 root root        512 Mar  9  2018 balena-image-generic-amd64.balenaos-img.sig
+		const { explorePartition, BalenaPartition } = await import(
+			'../../utils/image-contents'
+		);
+		const isSecureBoot = await explorePartition<boolean>(
+			params.image,
+			BalenaPartition.ROOTA,
+			async (fs: typeof Fs): Promise<boolean> => {
+				try {
+					const files = await fs.promises.readdir('/opt');
+					return files.some((el) => el.endsWith('balenaos-img.sig'));
+				} catch {
+					// Typically one of:
+					// - Error: No such file or directory
+					// - Error: Unsupported filesystem.
+					// - ErrnoException: node_ext2fs_open ENOENT (44) args: [5261576,5268064,"r",0]
+					return false;
+				}
+				return false;
+			},
+		);
+		// Next verify that config.json enables secureboot.
+		if (isSecureBoot) {
+			const { read } = await import('balena-config-json');
+			const config = await read(params.image);
+			if (config.installer?.secureboot === true) {
+				throw new ExpectedError("Can't preload image with secure boot enabled");
+			}
+		}
+
 		// balena-preload currently does not work with numerical app IDs
 		// Load app here, and use app slug from hereon
 		const fleetSlug: string | undefined = options.fleet
@@ -192,11 +229,11 @@ Can be repeated to add multiple certificates.\
 				event.name,
 			));
 			if (event.action === 'start') {
-				return spinner.start();
-			} else {
-				console.log();
-				return spinner.stop();
+				spinner.start();
+				return;
 			}
+			console.log();
+			spinner.stop();
 		};
 
 		const commit = this.isCurrentCommit(options.commit || '')
@@ -295,7 +332,7 @@ Can be repeated to add multiple certificates.\
 		owns__release: {
 			$select: ['id', 'commit', 'end_timestamp', 'composition'],
 			$expand: {
-				contains__image: {
+				release_image: {
 					$select: ['image'],
 					$expand: {
 						image: {

src/commands/release/index.ts

@@ -24,7 +24,7 @@ import { tryAsInteger } from '../../utils/validation';
 import { jsonInfo } from '../../utils/messages';
 
 export const commitOrIdArg = Args.custom({
-	parse: async (commitOrId: string) => tryAsInteger(commitOrId),
+	parse: tryAsInteger,
 });
 
 type FlagsDef = Interfaces.InferredFlags<typeof ReleaseCmd.flags>;
@@ -86,7 +86,7 @@ export default class ReleaseCmd extends Command {
 		balena: BalenaSdk.BalenaSDK,
 		options: FlagsDef,
 	) {
-		const fields: Array<keyof BalenaSdk.Release> = [
+		const fields = [
 			'id',
 			'commit',
 			'created_at',
@@ -96,7 +96,7 @@ export default class ReleaseCmd extends Command {
 			'build_log',
 			'start_timestamp',
 			'end_timestamp',
-		];
+		] satisfies BalenaSdk.PineOptions<BalenaSdk.Release>['$select'];
 
 		const release = await balena.models.release.get(commitOrId, {
 			...(!options.json && { $select: fields }),

src/commands/release/list.ts

@@ -56,14 +56,14 @@ export default class ReleaseListCmd extends Command {
 	public async run() {
 		const { args: params, flags: options } = await this.parse(ReleaseListCmd);
 
-		const fields: Array<keyof BalenaSdk.Release> = [
+		const fields = [
 			'id',
 			'commit',
 			'created_at',
 			'status',
 			'semver',
 			'is_final',
-		];
+		] satisfies BalenaSdk.PineOptions<BalenaSdk.Release>['$select'];
 
 		const balena = getBalenaSdk();
 		const { getFleetSlug } = await import('../../utils/sdk');

src/commands/ssh-key/index.ts

@@ -34,7 +34,7 @@ export default class SSHKeyCmd extends Command {
 	public static args = {
 		id: Args.integer({
 			description: 'balenaCloud ID for the SSH key',
-			parse: async (x) => parseAsInteger(x, 'id'),
+			parse: (x) => parseAsInteger(x, 'id'),
 			required: true,
 		}),
 	};

src/commands/ssh-key/rm.ts

@@ -40,7 +40,7 @@ export default class SSHKeyRmCmd extends Command {
 	public static args = {
 		id: Args.integer({
 			description: 'balenaCloud ID for the SSH key',
-			parse: async (x) => parseAsInteger(x, 'id'),
+			parse: (x) => parseAsInteger(x, 'id'),
 			required: true,
 		}),
 	};

src/commands/version/index.ts

@@ -69,10 +69,9 @@ export default class VersionCmd extends Command {
 		const { flags: options } = await this.parse(VersionCmd);
 		const versions: JsonVersions = {
 			'balena-cli': (await import('../../../package.json')).version,
-			'Node.js':
-				process.version && process.version.startsWith('v')
-					? process.version.slice(1)
-					: process.version,
+			'Node.js': process.version.startsWith('v')
+				? process.version.slice(1)
+				: process.version,
 		};
 		if (options.json) {
 			console.log(JSON.stringify(versions, null, 4));

src/errors.ts

@@ -93,7 +93,7 @@ function interpret(error: Error): string {
 
 	if (hasCode(error)) {
 		const errorCodeHandler = messages[error.code];
-		const message = errorCodeHandler && errorCodeHandler(error);
+		const message = errorCodeHandler?.(error);
 
 		if (message) {
 			return message;
@@ -229,7 +229,7 @@ async function sentryCaptureException(error: Error) {
 	Sentry.captureException(error);
 	try {
 		await Sentry.close(1000);
-	} catch (e) {
+	} catch {
 		if (process.env.DEBUG) {
 			console.error('[debug] Timeout reporting error to sentry.io');
 		}

src/help.ts

@@ -209,12 +209,12 @@ See: https://git.io/JRHUW#deprecation-policy`,
 		return indent(body, 2);
 	}
 
-	protected formatDescription(desc: string = '') {
+	protected formatDescription(desc = '') {
 		const chalk = getChalk();
 
 		desc = desc.split('\n')[0];
 		// Remove any ending .
-		if (desc[desc.length - 1] === '.') {
+		if (desc.endsWith('.')) {
 			desc = desc.substring(0, desc.length - 1);
 		}
 		// Lowercase first letter if second char is lowercase, to preserve e.g. 'SSH ...')

src/hooks/prerun.ts

@@ -103,7 +103,7 @@ const hook: Hook<'prerun'> = async function (options) {
 					.offlineCompatible ?? DEFAULT_OFFLINE_COMPATIBLE
 			)
 		) {
-			await checkNotUsingOfflineMode();
+			checkNotUsingOfflineMode();
 		}
 	} catch (error) {
 		this.error(error);

src/preparser.ts

@@ -48,7 +48,7 @@ export async function preparseArgs(argv: string[]): Promise<string[]> {
 		if (
 			cmdSlice.length > 1 &&
 			cmdSlice[0] === 'help' &&
-			cmdSlice[1][0] !== '-'
+			!cmdSlice[1].startsWith('-')
 		) {
 			cmdSlice.shift();
 			cmdSlice.push('--help');

src/utils/bootstrap.ts

@@ -83,43 +83,6 @@ export function setOfflineModeEnvVars() {
 	}
 }
 
-/**
- * Implements the 'pkgExec' command, used as a way to provide a Node.js
- * interpreter for child_process.spawn()-like operations when the CLI is
- * executing as a standalone zip package (built-in Node interpreter) and
- * the system may not have a separate Node.js installation. A present use
- * case is a patched version of the 'windosu' package that requires a
- * Node.js interpreter to spawn a privileged child process.
- *
- * @param modFunc Path to a JS module that will be executed via require().
- * The modFunc argument may optionally contain a function name separated
- * by '::', for example '::main' in:
- * 'C:\\snapshot\\balena-cli\\node_modules\\windosu\\lib\\pipe.js::main'
- * in which case that function is executed in the require'd module.
- * @param args Optional arguments to passed through process.argv and as
- * arguments to the function specified via modFunc.
- */
-export async function pkgExec(modFunc: string, args: string[]) {
-	const [modPath, funcName] = modFunc.split('::');
-	let replacedModPath = modPath;
-	const match = modPath
-		.replace(/\\/g, '/')
-		.match(/\/snapshot\/balena-cli\/(.+)/);
-	if (match) {
-		replacedModPath = `../${match[1]}`;
-	}
-	process.argv = [process.argv[0], process.argv[1], ...args];
-	try {
-		const mod: any = await import(replacedModPath);
-		if (funcName) {
-			await mod[funcName](...args);
-		}
-	} catch (err) {
-		console.error(`Error executing pkgExec "${modFunc}" [${args.join()}]`);
-		console.error(err);
-	}
-}
-
 export interface CachedUsername {
 	token: string;
 	username: string;

src/utils/cloud.ts

@@ -164,9 +164,8 @@ export async function downloadOSImage(
 	stream.on('progress', (state: any) => {
 		if (state != null) {
 			return bar.update(state);
-		} else {
-			return spinner.start();
 		}
+		spinner.start();
 	});
 
 	stream.on('end', () => {

src/utils/compose.ts

@@ -128,6 +128,7 @@ export const createRelease = async function (
 	draft: boolean,
 	semver: string | undefined,
 	contract: import('@balena/compose/dist/release/models').ReleaseModel['contract'],
+	imgDescriptors: ImageDescriptor[],
 ): Promise<Release> {
 	const _ = require('lodash') as typeof import('lodash');
 	const crypto = require('crypto') as typeof import('crypto');
@@ -167,6 +168,7 @@ export const createRelease = async function (
 		semver,
 		is_final: !draft,
 		contract,
+		imgDescriptors,
 	});
 
 	return {
@@ -240,7 +242,7 @@ export const getPreviousRepos = (
 					status: 'success',
 				},
 				$expand: {
-					contains__image: {
+					release_image: {
 						$select: 'image',
 						$expand: { image: { $select: 'is_stored_at__image_location' } },
 					},
@@ -252,7 +254,7 @@ export const getPreviousRepos = (
 		.then(function (release) {
 			// grab all images from the latest release, return all image locations in the registry
 			if (release.length > 0) {
-				const images = release[0].contains__image as Array<{
+				const images = release[0].release_image as Array<{
 					image: [SDK.Image];
 				}>;
 				const { getRegistryAndName } =
@@ -386,7 +388,7 @@ export class BuildProgressUI implements Renderer {
 			.map(function (service) {
 				const stream = through.obj(function (event, _enc, cb) {
 					eventHandler(service, event);
-					return cb();
+					cb();
 				});
 				stream.pipe(tty.stream, { end: false });
 				return [service, stream];
@@ -471,17 +473,20 @@ export class BuildProgressUI implements Renderer {
 				const { status, progress, error } = serviceToDataMap[service] ?? {};
 				if (error) {
 					return `${error}`;
-				} else if (progress) {
+				}
+
+				if (progress) {
 					const bar = renderProgressBar(progress, 20);
 					if (status) {
 						return `${bar} ${status}`;
 					}
-					return `${bar}`;
-				} else if (status) {
-					return `${status}`;
-				} else {
-					return 'Waiting...';
+					return bar;
 				}
+
+				if (status) {
+					return status;
+				}
+				return 'Waiting...';
 			})
 			.map((data, index) => [services[index], data])
 			.fromPairs()
@@ -552,7 +557,7 @@ export class BuildProgressInline implements Renderer {
 			.map(function (service) {
 				const stream = through.obj(function (event, _enc, cb) {
 					eventHandler(service, event);
-					return cb();
+					cb();
 				});
 				stream.pipe(outStream, { end: false });
 				return [service, stream];
@@ -606,11 +611,11 @@ export class BuildProgressInline implements Renderer {
 			const { status, error } = event;
 			if (error) {
 				return `${error}`;
-			} else if (status) {
-				return `${status}`;
-			} else {
-				return 'Waiting...';
 			}
+			if (status) {
+				return status;
+			}
+			return 'Waiting...';
 		})();
 
 		const prefix = _.padEnd(getChalk().bold(service), this._prefixWidth);

src/utils/compose_ts.ts

@@ -966,7 +966,7 @@ export async function makeBuildTasks(
 	deviceInfo: DeviceInfo,
 	logger: Logger,
 	projectName: string,
-	releaseHash: string = 'unavailable',
+	releaseHash = 'unavailable',
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
 	const multiBuild = await import('@balena/compose/dist/multibuild');
@@ -1375,6 +1375,7 @@ export async function deployProject(
 	skipLogUpload: boolean,
 	projectPath: string,
 	isDraft: boolean,
+	imgDescriptors: ImageDescriptor[],
 ): Promise<import('@balena/compose/dist/release/models').ReleaseModel> {
 	const releaseMod = await import('@balena/compose/dist/release');
 	const { createRelease, tagServiceImages } = await import('./compose');
@@ -1405,6 +1406,7 @@ export async function deployProject(
 				isDraft,
 				contract?.version,
 				contract,
+				imgDescriptors,
 			),
 	);
 	const { client: pineClient, release, serviceImages } = $release;
@@ -1492,7 +1494,7 @@ export function createRunLoop(tick: (...args: any[]) => void) {
 		},
 		end() {
 			clearInterval(timerId);
-			return runloop.onEnd();
+			runloop.onEnd();
 		},
 	};
 	return runloop;
@@ -1549,7 +1551,7 @@ function dropEmptyLinesStream() {
 		if (str.trim()) {
 			this.push(str);
 		}
-		return cb();
+		cb();
 	});
 }
 
@@ -1570,7 +1572,7 @@ function buildLogCapture(objectMode: boolean, buffer: string[]) {
 			buffer.push(data);
 		}
 
-		return cb(null, data);
+		cb(null, data);
 	});
 }
 
@@ -1585,14 +1587,16 @@ function buildProgressAdapter(inline: boolean) {
 
 	return through({ objectMode: true }, function (str, _enc, cb) {
 		if (str == null) {
-			return cb(null, str);
+			cb(null, str);
+			return;
 		}
 
 		if (inline) {
-			return cb(null, { status: str });
+			cb(null, { status: str });
+			return;
 		}
 
-		if (!/^Successfully tagged /.test(str)) {
+		if (!str.startsWith('Successfully tagged ')) {
 			const match = stepRegex.exec(str);
 			if (match) {
 				step = match[1];
@@ -1607,7 +1611,7 @@ function buildProgressAdapter(inline: boolean) {
 			}
 		}
 
-		return cb(null, { status: str, progress });
+		cb(null, { status: str, progress });
 	});
 }
 

src/utils/config.ts

@@ -14,7 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 import type * as BalenaSdk from 'balena-sdk';
-import * as semver from 'balena-semver';
 import { getBalenaSdk, stripIndent } from './lazy';
 
 export interface ImgConfig {
@@ -81,7 +80,7 @@ export async function generateApplicationConfig(
 	)) as ImgConfig;
 
 	// merge sshKeys to config, when they have been specified
-	if (options.os && options.os.sshKeys) {
+	if (options.os?.sshKeys) {
 		// Create config.os object if it does not exist
 		config.os = config.os ? config.os : {};
 		config.os.sshKeys = config.os.sshKeys
@@ -122,16 +121,10 @@ export function generateDeviceConfig(
 			// os.getConfig always returns a config for an app
 			delete config.apiKey;
 
-			if (deviceApiKey == null && semver.satisfies(options.version, '<2.0.3')) {
-				config.apiKey = await sdk.models.application.generateApiKey(
-					application.id,
-				);
-			} else {
-				config.deviceApiKey =
-					typeof deviceApiKey === 'string' && deviceApiKey
-						? deviceApiKey
-						: await sdk.models.device.generateDeviceKey(device.uuid);
-			}
+			config.deviceApiKey =
+				typeof deviceApiKey === 'string' && deviceApiKey
+					? deviceApiKey
+					: await sdk.models.device.generateDeviceKey(device.uuid);
 
 			return config;
 		})

src/utils/deploy-legacy.ts

@@ -86,7 +86,7 @@ const uploadToPromise = (uploadRequest: Request, logger: Logger) =>
 				obj = JSON.parse(data);
 			} catch (e) {
 				logger.logError('Error parsing reply from remote side');
-				reject(e);
+				reject(e as Error);
 				return;
 			}
 
@@ -232,7 +232,7 @@ export const deployLegacy = async function (
 			username,
 			appName,
 		]);
-		await uploadLogs(...args);
+		uploadLogs(...args);
 	}
 
 	return buildId;

src/utils/device/api.ts

@@ -74,7 +74,7 @@ export class DeviceAPI {
 	public constructor(
 		private logger: Logger,
 		addr: string,
-		port: number = 48484,
+		port = 48484,
 	) {
 		this.deviceAddress = `http://${addr}:${port}/`;
 	}
@@ -201,7 +201,7 @@ export class DeviceAPI {
 		return new Promise((resolve, reject) => {
 			const req = request.get(url);
 
-			req.on('error', reject).on('response', async (res) => {
+			req.on('error', reject).on('response', (res) => {
 				if (res.statusCode !== 200) {
 					reject(
 						new ApiErrors.DeviceAPIError(
@@ -213,7 +213,7 @@ export class DeviceAPI {
 				try {
 					res.socket.setKeepAlive(true, 1000);
 				} catch (error) {
-					reject(error);
+					reject(error as Error);
 				}
 				resolve(res);
 			});
@@ -238,7 +238,7 @@ export class DeviceAPI {
 			if (_.isObject(opts) && (opts as ObjectWithUrl).url != null) {
 				// the `as string` shouldn't be necessary, but the type system
 				// is getting a little confused
-				url = (opts as ObjectWithUrl).url as string;
+				url = (opts as ObjectWithUrl).url!;
 			} else if (typeof opts === 'string') {
 				url = opts;
 			}
@@ -252,21 +252,26 @@ export class DeviceAPI {
 			return await new Promise((resolve, reject) => {
 				return request(opts, (err, response, body) => {
 					if (err) {
-						return reject(err);
+						reject(err as Error);
+						return;
 					}
 					switch (response.statusCode) {
-						case 200:
-							return resolve(body);
-						case 400:
-							return reject(
-								new ApiErrors.BadRequestDeviceAPIError(body.message),
-							);
-						case 503:
-							return reject(
-								new ApiErrors.ServiceUnavailableAPIError(body.message),
-							);
-						default:
-							return reject(new ApiErrors.DeviceAPIError(body.message));
+						case 200: {
+							resolve(body);
+							return;
+						}
+						case 400: {
+							reject(new ApiErrors.BadRequestDeviceAPIError(body.message));
+							return;
+						}
+						case 503: {
+							reject(new ApiErrors.ServiceUnavailableAPIError(body.message));
+							return;
+						}
+						default: {
+							reject(new ApiErrors.DeviceAPIError(body.message));
+							return;
+						}
 					}
 				});
 			});

src/utils/device/deploy.ts

@@ -74,11 +74,11 @@ interface ParsedEnvironment {
 	[serviceName: string]: { [key: string]: string };
 }
 
-async function environmentFromInput(
+function environmentFromInput(
 	envs: string[],
 	serviceNames: string[],
 	logger: Logger,
-): Promise<ParsedEnvironment> {
+): ParsedEnvironment {
 	// A normal environment variable regex, with an added part
 	// to find a colon followed servicename at the start
 	const varRegex = /^(?:([^\s:]+):)?([^\s]+?)=(.*)$/;
@@ -143,7 +143,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	try {
 		globalLogger.logDebug('Checking we can access device');
 		await api.ping();
-	} catch (e) {
+	} catch {
 		throw new ExpectedError(stripIndent`
 			Could not communicate with device supervisor at address ${opts.deviceHost}:${port}.
 			Device may not have local mode enabled. Check with:
@@ -191,10 +191,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	});
 
 	// Attempt to attach to the device's docker daemon
-	const docker = connectToDocker(
-		opts.deviceHost,
-		opts.devicePort != null ? opts.devicePort : 2375,
-	);
+	const docker = connectToDocker(opts.deviceHost, opts.devicePort ?? 2375);
 
 	await checkBuildSecretsRequirements(docker, opts.source);
 	globalLogger.logDebug('Tarring all non-ignored files...');
@@ -231,7 +228,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	// Print a newline to clearly separate build time and runtime
 	console.log();
 
-	const envs = await environmentFromInput(
+	const envs = environmentFromInput(
 		opts.env,
 		Object.getOwnPropertyNames(project.composition.services),
 		globalLogger,
@@ -388,7 +385,7 @@ async function performBuilds(
 	);
 
 	// Check for failures
-	await inspectBuildResults(localImages);
+	inspectBuildResults(localImages);
 
 	const imagesToRemove: string[] = [];
 
@@ -497,7 +494,7 @@ export async function rebuildSingleTask(
 	}
 
 	await assignDockerBuildOpts(docker, [task], opts);
-	await assignOutputHandlers([task], logger, logHandler);
+	assignOutputHandlers([task], logger, logHandler);
 
 	const [localImage] = await multibuild.performBuilds(
 		[task],
@@ -568,7 +565,7 @@ async function assignDockerBuildOpts(
 	globalLogger.logDebug(`Using ${images.length} on-device images for cache...`);
 
 	await Promise.all(
-		buildTasks.map(async (task: BuildTask) => {
+		buildTasks.map((task: BuildTask) => {
 			task.dockerOpts = {
 				...(task.dockerOpts || {}),
 				...{
@@ -666,7 +663,7 @@ export function generateTargetState(
 	return targetState;
 }
 
-async function inspectBuildResults(images: LocalImage[]): Promise<void> {
+function inspectBuildResults(images: LocalImage[]): void {
 	const failures: LocalPushErrors.BuildFailure[] = [];
 
 	_.each(images, (image) => {
@@ -679,6 +676,6 @@ async function inspectBuildResults(images: LocalImage[]): Promise<void> {
 	});
 
 	if (failures.length > 0) {
-		throw new LocalPushErrors.BuildError(failures).toString();
+		throw new LocalPushErrors.BuildError(failures);
 	}
 }

src/utils/device/live.ts

@@ -191,8 +191,8 @@ export class LivepushManager {
 					);
 					const eventQueue = this.updateEventsWaiting[$serviceName];
 					eventQueue.push(changedPath);
-					// eslint-disable-next-line @typescript-eslint/no-floating-promises
-					this.getDebouncedEventHandler($serviceName)();
+
+					void this.getDebouncedEventHandler($serviceName)();
 				};
 
 				const monitor = this.setupFilesystemWatcher(
@@ -252,7 +252,7 @@ export class LivepushManager {
 					try {
 						// sync because chokidar defines a sync interface
 						stats = fs.lstatSync(filePath);
-					} catch (err) {
+					} catch {
 						// OK: the file may have been deleted. See also:
 						// https://github.com/paulmillr/chokidar/blob/3.4.3/lib/fsevents-handler.js#L326-L328
 						// https://github.com/paulmillr/chokidar/blob/3.4.3/lib/nodefs-handler.js#L364
@@ -267,15 +267,15 @@ export class LivepushManager {
 				return dockerignore.ignores(relPath);
 			},
 		});
-		monitor.on('add', (changedPath: string) =>
-			changedPathHandler(serviceName, changedPath),
-		);
-		monitor.on('change', (changedPath: string) =>
-			changedPathHandler(serviceName, changedPath),
-		);
-		monitor.on('unlink', (changedPath: string) =>
-			changedPathHandler(serviceName, changedPath),
-		);
+		monitor.on('add', (changedPath: string) => {
+			changedPathHandler(serviceName, changedPath);
+		});
+		monitor.on('change', (changedPath: string) => {
+			changedPathHandler(serviceName, changedPath);
+		});
+		monitor.on('unlink', (changedPath: string) => {
+			changedPathHandler(serviceName, changedPath);
+		});
 		return monitor;
 	}
 

src/utils/docker.ts

@@ -57,7 +57,7 @@ export const dockerConnectionCliFlags = {
 		description:
 			'Docker daemon TCP port number (hint: 2375 for balena devices)',
 		char: 'p',
-		parse: async (p) => parseAsInteger(p, 'dockerPort'),
+		parse: (p) => parseAsInteger(p, 'dockerPort'),
 	}),
 	ca: Flags.string({
 		description: 'Docker host TLS certificate authority file',
@@ -169,9 +169,7 @@ export async function isBalenaEngine(docker: dockerode): Promise<boolean> {
 	// version of balenaEngine, but it was at one point (mis)spelt 'balaena':
 	// https://github.com/balena-os/balena-engine/pull/32/files
 	const dockerVersion = (await docker.version()) as BalenaEngineVersion;
-	return !!(
-		dockerVersion.Engine && dockerVersion.Engine.match(/balena|balaena/)
-	);
+	return !!dockerVersion.Engine?.match(/balena|balaena/);
 }
 
 export async function getDocker(

src/utils/eol-conversion.ts

@@ -84,7 +84,7 @@ export async function readFileWithEolConversion(
 	}
 
 	// Analyse encoding
-	const encoding = await detectEncoding(fileBuffer);
+	const encoding = detectEncoding(fileBuffer);
 
 	// Skip further processing of non-convertible encodings
 	if (!CONVERTIBLE_ENCODINGS.includes(encoding)) {
@@ -132,10 +132,10 @@ export async function readFileWithEolConversion(
  * @param fileBuffer File contents whose encoding should be detected
  * @param bytesRead Optional "file size" if smaller than the buffer size
  */
-export async function detectEncoding(
+export function detectEncoding(
 	fileBuffer: Buffer,
 	bytesRead = fileBuffer.length,
-): Promise<string> {
+): string {
 	// empty file
 	if (bytesRead === 0) {
 		return '';

src/utils/helpers.ts

@@ -110,6 +110,27 @@ export async function getManifest(
 	const init = await import('balena-device-init');
 	const sdk = getBalenaSdk();
 	const manifest = await init.getImageManifest(image);
+	if (manifest != null) {
+		const config = manifest.configuration?.config;
+		if (config?.partition != null) {
+			const { getBootPartition } = await import('balena-config-json');
+			// Find the device-type.json property that holds the boot partition number for
+			// this device type (config.partition or config.partition.primary) and overwrite it
+			// with the boot partition number that was found by inspecting the image.
+			// since it's deprecated & no longer updated for newer releases.
+			if (typeof config.partition === 'number') {
+				config.partition = await getBootPartition(image);
+			} else if (config.partition.primary != null) {
+				config.partition.primary = await getBootPartition(image);
+			}
+			// TODO: Add handling for when we no longer include a `config.partition` at all.
+		}
+	} else {
+		// TODO: Change this in the next major to throw, after confirming that this works for all supported OS versions.
+		console.error(
+			`[warn] Error while finding a device-type.json on the provided image path. Attempting to fetch from the API.`,
+		);
+	}
 	if (
 		manifest != null &&
 		manifest.slug !== deviceType &&
@@ -281,8 +302,7 @@ export function isWindowsComExeShell() {
 		// neither bash nor sh (e.g. not MSYS, MSYS2, Cygwin, WSL)
 		process.env.SHELL == null &&
 		// Windows cmd.exe or PowerShell
-		process.env.ComSpec != null &&
-		process.env.ComSpec.endsWith('cmd.exe')
+		process.env.ComSpec?.endsWith('cmd.exe')
 	);
 }
 
@@ -366,7 +386,7 @@ export function getProxyConfig(): ProxyConfig | undefined {
 			let url: InstanceType<typeof URL>;
 			try {
 				url = new URL(proxyUrl);
-			} catch (_e) {
+			} catch {
 				return;
 			}
 			return {
@@ -469,7 +489,7 @@ export function pickAndRename<T extends Dictionary<any>>(
 		let renameFrom = f;
 		let renameTo = f;
 		const match = f.match(/(?<from>\S+)\s+=>\s+(?<to>\S+)/);
-		if (match && match.groups) {
+		if (match?.groups) {
 			renameFrom = match.groups.from;
 			renameTo = match.groups.to;
 		}

src/utils/image-contents.ts

@@ -0,0 +1,69 @@
+/**
+ * @license
+ * Copyright 2025 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Utilities to explore the contents in a balenaOS image.
+
+import * as imagefs from 'balena-image-fs';
+import * as filedisk from 'file-disk';
+import { getPartitions } from 'partitioninfo';
+import type * as Fs from 'fs';
+
+/**
+ * @summary IDs for the standard balenaOS partitions
+ * @description Values are the base name for a partition on disk
+ */
+export enum BalenaPartition {
+	BOOT = 'boot',
+	ROOTA = 'rootA',
+	ROOTB = 'rootB',
+	STATE = 'state',
+	DATA = 'data',
+}
+
+/**
+ * @summary Allow a provided function to explore the contents of one of the well-known
+ * partitions of a balenaOS image
+ *
+ * @param {string} imagePath - pathname of image for search
+ * @param {BalenaPartition} partitionId - partition to find
+ * @param {(fs) => Promise<T>} - function for exploration
+ * @returns {T}
+ */
+export async function explorePartition<T>(
+	imagePath: string,
+	partitionId: BalenaPartition,
+	exploreFn: (fs: typeof Fs) => Promise<T>,
+): Promise<T> {
+	return await filedisk.withOpenFile(imagePath, 'r', async (handle) => {
+		const disk = new filedisk.FileDisk(handle, true, false, false);
+		const partitionInfo = await getPartitions(disk, {
+			includeExtended: false,
+			getLogical: true,
+		});
+
+		const findResult = await imagefs.findPartition(disk, partitionInfo, [
+			`resin-${partitionId}`,
+			`flash-${partitionId}`,
+			`balena-${partitionId}`,
+		]);
+		if (findResult == null) {
+			throw new Error(`Can't find partition for ${partitionId}`);
+		}
+
+		return await imagefs.interact<T>(disk, findResult.index, exploreFn);
+	});
+}

src/utils/image-manager.ts

@@ -76,38 +76,28 @@ export const getImagePath = async (deviceType: string, version?: string) => {
 };
 
 /**
- * @summary Determine if a device image is fresh
+ * @summary Determine if a device image is cached
  *
  * @description
  * If the device image does not exist, return false.
  *
  * @param {String} deviceType - device type slug or alias
  * @param {String} version - the exact balenaOS version number
- * @returns {Promise<Boolean>} is image fresh
+ * @returns {Promise<Boolean>} is image cached
  *
  * @example
- * isImageFresh('raspberry-pi', '1.2.3').then (isFresh) ->
- * 	if isFresh
- * 		console.log('The Raspberry Pi image v1.2.3 is fresh!')
+ * isImageCached ('raspberry-pi', '1.2.3').then (isCached) ->
+ * 	if isCached
+ * 		console.log('The Raspberry Pi image v1.2.3 is cached!')
  */
-export const isImageFresh = async (deviceType: string, version: string) => {
+export const isImageCached = async (deviceType: string, version: string) => {
 	const imagePath = await getImagePath(deviceType, version);
-	let createdDate;
 	try {
-		createdDate = await getFileCreatedDate(imagePath);
+		const createdDate = await getFileCreatedDate(imagePath);
+		return createdDate != null;
 	} catch {
-		// Swallow errors from getFileCreatedTime.
-	}
-	if (createdDate == null) {
 		return false;
 	}
-
-	const balena = getBalenaSdk();
-	const lastModifiedDate = await balena.models.os.getLastModified(
-		deviceType,
-		version,
-	);
-	return lastModifiedDate < createdDate;
 };
 
 /**
@@ -118,7 +108,7 @@ export const isImageFresh = async (deviceType: string, version: string) => {
  */
 export const isESR = (version: string) => {
 	const match = version.match(/^v?(\d+)\.\d+\.\d+/);
-	const major = parseInt((match && match[1]) || '', 10);
+	const major = parseInt(match?.[1] || '', 10);
 	return major >= 2018; // note: (NaN >= 2018) is false
 };
 
@@ -286,7 +276,7 @@ export const getStream = async (
 		versionOrRange = 'latest';
 	}
 	const version = await resolveVersion(deviceType, versionOrRange);
-	const isFresh = await isImageFresh(deviceType, version);
+	const isFresh = await isImageCached(deviceType, version);
 	const $stream = isFresh
 		? await getImage(deviceType, version)
 		: await doDownload({ ...options, deviceType, version });

src/utils/lazy.ts

@@ -21,6 +21,7 @@ import type { Chalk } from 'chalk';
 import type * as visuals from 'resin-cli-visuals';
 import type * as CliForm from 'resin-cli-form';
 import type { ux } from '@oclif/core';
+import { version } from '../../package.json';
 
 // Equivalent of _.once but avoiding the need to import lodash for lazy deps
 const once = <T>(fn: () => T) => {
@@ -43,9 +44,26 @@ export const onceAsync = <T>(fn: () => Promise<T>) => {
 	};
 };
 
-export const getBalenaSdk = once(() =>
-	(require('balena-sdk') as typeof BalenaSdk).fromSharedOptions(),
-);
+const cliXBalenaClientHeaderInterceptor: BalenaSdk.Interceptor = {
+	request($request) {
+		if ($request.headers['X-Balena-Client']) {
+			// We intentionally overwrite the sdk version string from the header
+			// to conserve bandwidth. We only do that when the SDK already has specified
+			// the X-Balena-Client header, since that signals that this is a safe url to
+			// include the extra header and will not cause CORS errors.
+			$request.headers['X-Balena-Client'] = `balena-cli/${version}`;
+		}
+		return $request;
+	},
+};
+
+export const getBalenaSdk = once(() => {
+	const sdk = (require('balena-sdk') as typeof BalenaSdk).fromSharedOptions();
+	if (!sdk.interceptors.includes(cliXBalenaClientHeaderInterceptor)) {
+		sdk.interceptors.push(cliXBalenaClientHeaderInterceptor);
+	}
+	return sdk;
+});
 
 export const getVisuals = once(
 	() => require('resin-cli-visuals') as typeof visuals,

src/utils/messages.ts

@@ -159,9 +159,9 @@ especially discouraged in scripts (e.g. CI environments).`;
 
 export const devModeInfo = `\
 The '--dev' option is used to configure balenaOS to operate in development mode,
-allowing anauthenticated root ssh access and exposing network ports such as
+allowing unauthenticated root ssh access and exposing network ports such as
 balenaEngine's 2375 (unencrypted). This option causes \`"developmentMode": true\`
-to be inserted in the 'config.json' file in the image's boot partion. Development
+to be inserted in the 'config.json' file in the image's boot partition. Development
 mode (as a configurable option) is applicable to balenaOS releases from early
 2022. Older releases have separate development and production balenaOS images
 that cannot be reconfigured through 'config.json' or the '--dev' option. Do not

src/utils/normalization.ts

@@ -39,7 +39,7 @@ export async function disambiguateReleaseParam(
 
 	// Accepting short hashes of 7,8,9 chars.
 	const possibleUuidHashLength = [7, 8, 9, 32, 40, 62].includes(release.length);
-	const hasLeadingZero = release[0] === '0';
+	const hasLeadingZero = release.startsWith('0');
 	const isOnlyNumerical = /^[0-9]+$/.test(release);
 
 	// Reject non-numerical values with invalid uuid/hash lengths
@@ -75,17 +75,19 @@ export async function disambiguateReleaseParam(
 	return (await balena.models.release.get(release, { $select: 'id' })).id;
 }
 
+/* eslint-disable @typescript-eslint/require-await -- oclif parse functions require a Promise return */
 /**
  * Convert to lowercase if looks like slug
  */
 export async function lowercaseIfSlug(s: string) {
+	/* eslint-enable @typescript-eslint/require-await */
 	return s.includes('/') ? s.toLowerCase() : s;
 }
 
 export function normalizeOsVersion(version: string) {
 	// Note that `version` may also be 'latest', 'recommended', 'default'
 	if (/^v?\d+\.\d+\.\d+/.test(version)) {
-		if (version[0] === 'v') {
+		if (version.startsWith('v')) {
 			version = version.slice(1);
 		}
 	}

src/utils/oclif-utils.ts

@@ -25,7 +25,7 @@ export function capitanoizeOclifUsage(
 		.toLowerCase();
 }
 
-export async function getCommandsFromManifest() {
+export function getCommandsFromManifest() {
 	const manifest = require('../../oclif.manifest.json');
 
 	if (manifest.commands == null) {

src/utils/patterns.ts

@@ -119,7 +119,7 @@ export const checkLoggedInIf = async (doCheck: boolean) => {
  *
  * @throws {NotAvailableInOfflineModeError}
  */
-export const checkNotUsingOfflineMode = async () => {
+export const checkNotUsingOfflineMode = () => {
 	if (process.env.BALENARC_OFFLINE_MODE) {
 		throw new NotAvailableInOfflineModeError(stripIndent`
 	This command requires an internet connection, and cannot be used in offline mode.

src/utils/promote.ts

@@ -390,13 +390,12 @@ async function createApplication(
 	try {
 		const userInfo = await sdk.auth.getUserInfo();
 		username = userInfo.username;
-	} catch (err) {
+	} catch {
 		throw new sdk.errors.BalenaNotLoggedIn();
 	}
 
 	// eslint-disable-next-line no-async-promise-executor
 	const applicationName = await new Promise<string>(async (resolve, reject) => {
-		// eslint-disable-next-line no-constant-condition
 		while (true) {
 			try {
 				const appName = await getCliForm().ask({
@@ -418,11 +417,13 @@ async function createApplication(
 						'You already have a fleet with that name; please choose another.',
 					);
 					continue;
-				} catch (err) {
-					return resolve(appName);
+				} catch {
+					resolve(appName);
+					return;
 				}
 			} catch (err) {
-				return reject(err);
+				reject(err as Error);
+				return;
 			}
 		}
 	});
@@ -452,9 +453,7 @@ async function generateApplicationConfig(
 	const manifest = await sdk.models.config.getDeviceTypeManifestBySlug(
 		app.is_for__device_type[0].slug,
 	);
-	const opts =
-		manifest.options &&
-		manifest.options.filter((opt) => opt.name !== 'network');
+	const opts = manifest.options?.filter((opt) => opt.name !== 'network');
 
 	const override = {
 		appUpdatePollInterval: options.appUpdatePollInterval,

src/utils/qemu.ts

@@ -50,7 +50,7 @@ export function copyQemu(context: string, arch: string) {
 		.then(() => getQemuPath(arch))
 		.then(
 			(qemu) =>
-				new Promise(function (resolve, reject) {
+				new Promise<void>(function (resolve, reject) {
 					const read = fs.createReadStream(qemu);
 					const write = fs.createWriteStream(binPath);
 
@@ -114,7 +114,7 @@ async function installQemu(arch: string, qemuPath: string) {
 						stream.resume();
 					}
 				} catch (err) {
-					reject(err);
+					reject(err as Error);
 				}
 			});
 			request(qemuUrl)

src/utils/remote-build.ts

@@ -110,7 +110,7 @@ export async function startRemoteBuild(
 	const [buildRequest, stream] = await getRemoteBuildStream(build);
 
 	// Setup CTRL-C handler so the user can interrupt the build
-	let cancellationPromise = Promise.resolve();
+	let cancellationPromise: Promise<void> | undefined;
 	const sigintHandler = () => {
 		process.exitCode = 130;
 		console.error('\nReceived SIGINT, cleaning up. Please wait.');
@@ -246,7 +246,8 @@ function getBuilderMessageHandler(
 			console.error(`[debug] handling message: ${JSON.stringify(obj)}`);
 		}
 		if (obj.type != null && obj.type === 'metadata') {
-			return handleBuilderMetadata(obj, build);
+			handleBuilderMetadata(obj, build);
+			return;
 		}
 		if (obj.message) {
 			readline.clearLine(process.stdout, 0);
@@ -423,10 +424,20 @@ async function getRemoteBuildStream(
 		stream = buildRequest.pipe(JSONStream.parse('*')) as NodeJS.ReadStream;
 	}
 	stream = stream
-		.once('error', () => uploadSpinner.stop())
-		.once('close', () => uploadSpinner.stop())
-		.once('data', () => uploadSpinner.stop())
-		.once('end', () => uploadSpinner.stop())
-		.once('finish', () => uploadSpinner.stop());
+		.once('error', () => {
+			uploadSpinner.stop();
+		})
+		.once('close', () => {
+			uploadSpinner.stop();
+		})
+		.once('data', () => {
+			uploadSpinner.stop();
+		})
+		.once('end', () => {
+			uploadSpinner.stop();
+		})
+		.once('finish', () => {
+			uploadSpinner.stop();
+		});
 	return [buildRequest, stream];
 }

src/utils/ssh.ts

@@ -73,7 +73,7 @@ export function sshArgsForRemoteCommand({
 		...['-o', 'LogLevel=ERROR'],
 		...['-o', 'StrictHostKeyChecking=no'],
 		...['-o', 'UserKnownHostsFile=/dev/null'],
-		...(proxyCommand && proxyCommand.length
+		...(proxyCommand?.length
 			? ['-o', `ProxyCommand=${proxyCommand.join(' ')}`]
 			: []),
 		`${username}@${hostname}`,
@@ -155,9 +155,9 @@ export async function runRemoteCommand({
 		[exitCode, exitSignal] = await new Promise((resolve, reject) => {
 			const ps = spawn(program, args, { stdio })
 				.on('error', reject)
-				.on('close', (code, signal) =>
-					resolve([code ?? undefined, signal ?? undefined]),
-				);
+				.on('close', (code, signal) => {
+					resolve([code ?? undefined, signal ?? undefined]);
+				});
 
 			if (ps.stdin && stdin && typeof stdin !== 'string') {
 				stdin.pipe(ps.stdin);
@@ -272,7 +272,7 @@ export async function getLocalDeviceCmdStdout(
 export const isRootUserGood = _.memoize(async (hostname: string, port) => {
 	try {
 		await runRemoteCommand({ cmd: 'exit 0', hostname, port, ...stdioIgnore });
-	} catch (e) {
+	} catch {
 		return false;
 	}
 	return true;

src/utils/streams.ts

@@ -29,7 +29,11 @@ export function buffer(
 			new Promise(function (resolve, reject) {
 				const fstream = fs.createReadStream(bufferFile);
 
-				fstream.on('open', () => resolve(fstream)).on('error', reject);
+				fstream
+					.on('open', () => {
+						resolve(fstream);
+					})
+					.on('error', reject);
 			}),
 	);
 }

src/utils/sudo.ts

@@ -105,7 +105,7 @@ async function spawnAndPipe(
 	});
 }
 
-async function windosuExec(
+function windosuExec(
 	escapedArgs: string[],
 	stderr?: NodeJS.WritableStream,
 ): Promise<void> {

src/utils/tty.ts

@@ -42,9 +42,9 @@ export = (stream: NodeJS.WriteStream = process.stdout) => {
 
 	const showCursor = () => stream.write('\u001B[?25h');
 
-	const cursorUp = (rows: number = 0) => stream.write(`\u001B[${rows}A`);
+	const cursorUp = (rows = 0) => stream.write(`\u001B[${rows}A`);
 
-	const cursorDown = (rows: number = 0) => stream.write(`\u001B[${rows}B`);
+	const cursorDown = (rows = 0) => stream.write(`\u001B[${rows}B`);
 
 	const write = (str: string) => stream.write(str);
 

src/utils/tunnel.ts

@@ -61,11 +61,11 @@ export const tunnelConnectionToDevice = (
 					client.pipe(remote);
 					remote.pipe(client);
 					remote.on('error', (err) => {
-						console.error('Remote: ' + err);
+						console.error(`Remote: ${err}`);
 						client.end();
 					});
 					client.on('error', (err) => {
-						console.error('Client: ' + err);
+						console.error(`Client: ${err}`);
 						remote.end();
 					});
 					remote.on('close', () => {

src/utils/validation.ts

@@ -87,7 +87,8 @@ export function looksLikeInteger(input: string) {
 	return /^(?:0|[1-9][0-9]*)$/.test(input);
 }
 
-export function parseAsInteger(input: string, paramName?: string) {
+// eslint-disable-next-line @typescript-eslint/require-await -- oclif parse functions require a Promise return
+export async function parseAsInteger(input: string, paramName?: string) {
 	if (!looksLikeInteger(input)) {
 		const message =
 			paramName == null
@@ -100,14 +101,15 @@ export function parseAsInteger(input: string, paramName?: string) {
 	return Number(input);
 }
 
-export function tryAsInteger(input: string): number | string {
+export async function tryAsInteger(input: string): Promise<number | string> {
 	try {
-		return parseAsInteger(input);
+		return await parseAsInteger(input);
 	} catch {
 		return input;
 	}
 }
 
+// eslint-disable-next-line @typescript-eslint/require-await -- oclif parse functions require a Promise return
 export async function parseAsLocalHostnameOrIp(input: string) {
 	if (input && !validateLocalHostnameOrIp(input)) {
 		throw new ExpectedError(

tests/auth/server.spec.ts

@@ -31,7 +31,7 @@ chai.use(chaiAsPromised);
 
 const { expect } = chai;
 
-async function getPage(name: string): Promise<string> {
+function getPage(name: string): string {
 	const pagePath = path.join(
 		__dirname,
 		'..',
@@ -88,7 +88,7 @@ describe('Login server:', function () {
 						expect(body).to.equal(opt.expectedBody);
 						resolve();
 					} catch (err) {
-						reject(err);
+						reject(err as Error);
 					}
 				},
 			);
@@ -134,7 +134,7 @@ describe('Login server:', function () {
 	describe('given the token authenticates with the server', function () {
 		beforeEach(function () {
 			this.loginIfTokenValidStub = sinon.stub(utils, 'loginIfTokenValid');
-			this.loginIfTokenValidStub.returns(Promise.resolve(true));
+			this.loginIfTokenValidStub.resolves(true);
 		});
 
 		afterEach(function () {
@@ -143,7 +143,7 @@ describe('Login server:', function () {
 
 		it('should eventually be the token', async () => {
 			await testLogin({
-				expectedBody: await getPage('success'),
+				expectedBody: getPage('success'),
 				expectedStatusCode: 200,
 				expectedToken: tokens.johndoe.token,
 			});
@@ -153,7 +153,7 @@ describe('Login server:', function () {
 	describe('given the token does not authenticate with the server', function () {
 		beforeEach(function () {
 			this.loginIfTokenValidStub = sinon.stub(utils, 'loginIfTokenValid');
-			return this.loginIfTokenValidStub.returns(Promise.resolve(false));
+			return this.loginIfTokenValidStub.resolves(false);
 		});
 
 		afterEach(function () {
@@ -162,7 +162,7 @@ describe('Login server:', function () {
 
 		it('should be rejected', async () => {
 			await testLogin({
-				expectedBody: await getPage('error'),
+				expectedBody: getPage('error'),
 				expectedStatusCode: 401,
 				expectedToken: tokens.johndoe.token,
 				expectedErrorMsg: 'Invalid token',
@@ -171,7 +171,7 @@ describe('Login server:', function () {
 
 		it('should be rejected if no token', async () => {
 			await testLogin({
-				expectedBody: await getPage('error'),
+				expectedBody: getPage('error'),
 				expectedStatusCode: 401,
 				expectedToken: '',
 				expectedErrorMsg: 'No token',
@@ -180,7 +180,7 @@ describe('Login server:', function () {
 
 		it('should be rejected if token is malformed', async () => {
 			await testLogin({
-				expectedBody: await getPage('error'),
+				expectedBody: getPage('error'),
 				expectedStatusCode: 401,
 				expectedToken: 'asdf',
 				expectedErrorMsg: 'Invalid token',

tests/commands/build.spec.ts

@@ -267,15 +267,15 @@ describe('balena build', function () {
 				...fsMod,
 				promises: {
 					...fsMod.promises,
-					access: async (p: string) =>
+					access: (p: string) =>
 						p === qemuBinPath ? undefined : fsMod.promises.access(p),
-					stat: async (p: string) =>
+					stat: (p: string) =>
 						p === qemuBinPath ? { size: 1 } : fsMod.promises.stat(p),
 				},
 			});
 			mock(qemuModPath, {
 				...qemuMod,
-				copyQemu: async () => '',
+				copyQemu: () => '',
 			});
 			mock.reRequire('../../build/utils/qemu');
 			docker.expectGetInfo({ OperatingSystem: 'balenaOS 2.44.0+rev1' });

tests/commands/device/device.spec.ts

@@ -114,6 +114,14 @@ describe('balena device', function () {
 				'Content-Type': 'application/json',
 			});
 
+		api.scope
+			.get(
+				/^\/v\d+\/device\?.+&\$select=overall_status,overall_progress,should_be_running__release$/,
+			)
+			.replyWithFile(200, path.join(apiResponsePath, 'device.json'), {
+				'Content-Type': 'application/json',
+			});
+
 		const { out, err } = await runCommand('device 27fda508c --json');
 		expect(err).to.be.empty;
 		const json = JSON.parse(out.join(''));

tests/commands/device/ssh.spec.ts

@@ -169,8 +169,12 @@ async function startMockSshServer(): Promise<[Server, number]> {
 				console.error(`[debug] mock ssh server: ${msg}`);
 			}
 		};
-		c.on('error', (err) => handler(err.message));
-		c.on('end', () => handler('client disconnected'));
+		c.on('error', (err) => {
+			handler(err.message);
+		});
+		c.on('end', () => {
+			handler('client disconnected');
+		});
 		c.end();
 	});
 	server.on('error', (err) => {

tests/commands/os/configure.spec.ts

@@ -21,6 +21,8 @@ import * as process from 'process';
 import { runCommand } from '../../helpers';
 import { promisify } from 'util';
 import * as tmp from 'tmp';
+import type * as $imagefs from 'balena-image-fs';
+import * as stripIndent from 'common-tags/lib/stripIndent';
 
 tmp.setGracefulCleanup();
 const tmpNameAsync = promisify(tmp.tmpName);
@@ -29,30 +31,94 @@ import { BalenaAPIMock } from '../../nock/balena-api-mock';
 
 if (process.platform !== 'win32') {
 	describe('balena os configure', function () {
+		let imagefs: typeof $imagefs;
 		let api: BalenaAPIMock;
-		let tmpPath: string;
+		let tmpDummyPath: string;
+		let tmpMatchingDtJsonPartitionPath: string;
+		let tmpNonMatchingDtJsonPartitionPath: string;
 
-		beforeEach(async () => {
+		before(async function () {
+			// We conditionally import balena-image-fs, since when imported on top level then unrelated tests on win32 failed with:
+			// EPERM: operation not permitted, rename 'C:\Users\RUNNER~1\AppData\Local\Temp\tmp-<...>.inprogress' -> 'C:\Users\RUNNER~1\AppData\Local\Temp\tmp-<...>'
+			//    at async Object.rename (node:internal/fs/promises:782:10) {
+			imagefs = await import('balena-image-fs');
+			tmpDummyPath = (await tmpNameAsync()) as string;
+			await fs.copyFile('./tests/test-data/dummy.img', tmpDummyPath);
+			tmpMatchingDtJsonPartitionPath = (await tmpNameAsync()) as string;
+			await fs.copyFile(
+				'./tests/test-data/mock-jetson-nano-6.0.13.with-boot-partition-12.img',
+				tmpMatchingDtJsonPartitionPath,
+			);
+
+			tmpNonMatchingDtJsonPartitionPath = (await tmpNameAsync()) as string;
+			// Create an image with a device-type.json that mentions a non matching boot partition.
+			// We copy the pre-existing image and modify it, since including a separate one
+			// would add 18MB more to the repository.
+			await fs.copyFile(
+				'./tests/test-data/mock-jetson-nano-6.0.13.with-boot-partition-12.img',
+				tmpNonMatchingDtJsonPartitionPath,
+			);
+			await imagefs.interact(
+				tmpNonMatchingDtJsonPartitionPath,
+				12,
+				async (_fs) => {
+					const dtJson = JSON.parse(
+						await _fs.promises.readFile('/device-type.json', {
+							encoding: 'utf8',
+						}),
+					);
+					expect(dtJson).to.have.nested.property(
+						'configuration.config.partition',
+						12,
+					);
+					dtJson.configuration.config.partition = 999;
+					await _fs.promises.writeFile(
+						'/device-type.json',
+						JSON.stringify(dtJson),
+					);
+
+					await _fs.promises.writeFile(
+						'/os-release',
+						stripIndent`
+							ID="balena-os"
+							NAME="balenaOS"
+							VERSION="6.1.25"
+							VERSION_ID="6.1.25"
+							PRETTY_NAME="balenaOS 6.1.25"
+							DISTRO_CODENAME="kirkstone"
+							MACHINE="jetson-nano"
+							META_BALENA_VERSION="6.1.25"`,
+					);
+				},
+			);
+		});
+
+		beforeEach(() => {
 			api = new BalenaAPIMock();
 			api.expectGetWhoAmI({ optional: true, persist: true });
-			tmpPath = (await tmpNameAsync()) as string;
-			await fs.copyFile('./tests/test-data/dummy.img', tmpPath);
 		});
 
-		afterEach(async () => {
+		afterEach(() => {
 			api.done();
-			await fs.unlink(tmpPath);
 		});
 
-		it('should inject a valid config.json file', async () => {
+		after(async () => {
+			await fs.unlink(tmpDummyPath);
+			await fs.unlink(tmpMatchingDtJsonPartitionPath);
+			await fs.unlink(tmpNonMatchingDtJsonPartitionPath);
+		});
+
+		it('should detect the OS version and inject a valid config.json file to a 6.0.13 image with partition 12 as boot & matching device-type.json', async () => {
 			api.expectGetApplication();
-			api.expectGetConfigDeviceTypes();
+			api.expectGetDeviceTypes();
+			// It should not reach to /config or /device-types/v1 but instead find
+			// everything required from the device-type.json in the image.
+			// api.expectGetConfigDeviceTypes();
 			api.expectDownloadConfig();
 
 			const command: string[] = [
-				`os configure ${tmpPath}`,
-				'--device-type raspberrypi3',
-				'--version 2.47.0+rev1',
+				`os configure ${tmpMatchingDtJsonPartitionPath}`,
+				'--device-type jetson-nano',
 				'--fleet testApp',
 				'--config-app-update-poll-interval 10',
 				'--config-network ethernet',
@@ -65,9 +131,124 @@ if (process.platform !== 'win32') {
 			expect(err.join('')).to.equal('');
 
 			// confirm the image contains a config.json...
-			const imagefs = await import('balena-image-fs');
-			const config = await imagefs.interact(tmpPath, 1, async (_fs) => {
-				return await promisify(_fs.readFile)('/config.json');
+			const config = await imagefs.interact(
+				tmpMatchingDtJsonPartitionPath,
+				12,
+				async (_fs) => {
+					const dtJson = JSON.parse(
+						await _fs.promises.readFile('/device-type.json', {
+							encoding: 'utf8',
+						}),
+					);
+					// confirm that the device-type.json mentions the expected partition
+					expect(dtJson).to.have.nested.property(
+						'configuration.config.partition',
+						12,
+					);
+					return await _fs.promises.readFile('/config.json');
+				},
+			);
+			expect(config).to.not.be.empty;
+
+			// confirm the image has the correct config.json values...
+			const configObj = JSON.parse(config.toString('utf8'));
+			expect(configObj).to.have.property('deviceType', 'jetson-nano');
+			expect(configObj).to.have.property('initialDeviceName', 'testDeviceName');
+		});
+
+		it('should detect the OS version and inject a valid config.json file to a 6.1.25 image with partition 12 as boot & a non-matching device-type.json', async () => {
+			api.expectGetApplication();
+			api.expectGetDeviceTypes();
+			// It should not reach to /config or /device-types/v1 but instead find
+			// everything required from the device-type.json in the image.
+			// api.expectGetConfigDeviceTypes();
+			api.expectDownloadConfig();
+
+			const command: string[] = [
+				`os configure ${tmpNonMatchingDtJsonPartitionPath}`,
+				'--device-type jetson-nano',
+				'--fleet testApp',
+				'--config-app-update-poll-interval 10',
+				'--config-network ethernet',
+				'--initial-device-name testDeviceName',
+				'--provisioning-key-name testKey',
+				'--provisioning-key-expiry-date 2050-12-12',
+			];
+
+			const { err } = await runCommand(command.join(' '));
+			expect(err.join('')).to.equal('');
+
+			// confirm the image contains a config.json...
+			const config = await imagefs.interact(
+				tmpNonMatchingDtJsonPartitionPath,
+				12,
+				async (_fs) => {
+					const dtJson = JSON.parse(
+						await _fs.promises.readFile('/device-type.json', {
+							encoding: 'utf8',
+						}),
+					);
+					// confirm that the device-type.json mentions the expected partition
+					expect(dtJson).to.have.nested.property(
+						'configuration.config.partition',
+						999,
+					);
+					return await _fs.promises.readFile('/config.json');
+				},
+			);
+			expect(config).to.not.be.empty;
+
+			// confirm the image has the correct config.json values...
+			const configObj = JSON.parse(config.toString('utf8'));
+			expect(configObj).to.have.property('deviceType', 'jetson-nano');
+			expect(configObj).to.have.property('initialDeviceName', 'testDeviceName');
+		});
+
+		// TODO: In the next major consider just failing when we can't find a device-types.json in the image.
+		it('should inject a valid config.json file to a dummy image', async () => {
+			api.expectGetApplication();
+			// Since the dummy image doesn't include a device-type.json
+			// we have to reach to the API to fetch the manifest of the device type.
+			api.expectGetConfigDeviceTypes();
+			api.expectDownloadConfig();
+
+			const command: string[] = [
+				`os configure ${tmpDummyPath}`,
+				'--device-type raspberrypi3',
+				'--version 2.47.0+rev1',
+				'--fleet testApp',
+				'--config-app-update-poll-interval 10',
+				'--config-network ethernet',
+				'--initial-device-name testDeviceName',
+				'--provisioning-key-name testKey',
+				'--provisioning-key-expiry-date 2050-12-12',
+			];
+
+			const { err } = await runCommand(command.join(' '));
+			// Once we replace the dummy.img with one that includes a os-release & device-type.json
+			// then we should be able to change this to expect no errors.
+			expect(
+				err.flatMap((line) => line.split('\n')).filter((line) => line !== ''),
+			).to.deep.equal(
+				stripIndent`
+					[warn] "${tmpDummyPath}":
+					[warn]   Found partition table with 1 partitions,
+					[warn]   but none with a name/label in ['resin-boot', 'flash-boot', 'balena-boot'].
+					[warn]   Will scan all partitions for contents.
+					[warn] "${tmpDummyPath}":
+					[warn]   1 partition(s) found, but none containing file "/device-type.json".
+					[warn]   Assuming default boot partition number '1'.
+					[warn] "${tmpDummyPath}":
+					[warn]   Could not find a previous "/config.json" file in partition '1'.
+					[warn]   Proceeding anyway, but this is unexpected.
+					[warn] Error while finding a device-type.json on the provided image path. Attempting to fetch from the API.`.split(
+					'\n',
+				),
+			);
+
+			// confirm the image contains a config.json...
+			const config = await imagefs.interact(tmpDummyPath, 1, async (_fs) => {
+				return await _fs.promises.readFile('/config.json');
 			});
 			expect(config).to.not.be.empty;
 

tests/commands/push.spec.ts

@@ -462,7 +462,13 @@ describe('balena push', function () {
 		tmp.setGracefulCleanup();
 		const projectPath = await new Promise<string>((resolve, reject) => {
 			const opts = { template: 'tmp-XXXXXX', unsafeCleanup: true };
-			tmp.dir(opts, (e, p) => (e ? reject(e) : resolve(p)));
+			tmp.dir(opts, (e, p) => {
+				if (e) {
+					reject(e);
+				} else {
+					resolve(p);
+				}
+			});
 		});
 		console.error(`[debug] Temp project dir: ${projectPath}`);
 
@@ -475,7 +481,7 @@ describe('balena push', function () {
 			try {
 				server.listen(socketPath, resolve);
 			} catch (e) {
-				reject(e);
+				reject(e as Error);
 			}
 		});
 		console.error(`[debug] Checking existence of socket at '${socketPath}'`);
@@ -505,7 +511,13 @@ describe('balena push', function () {
 
 		// Terminate Unix Domain Socket server
 		await new Promise<void>((resolve, reject) => {
-			server.close((e) => (e ? reject(e) : resolve()));
+			server.close((e) => {
+				if (e) {
+					reject(e);
+				} else {
+					resolve();
+				}
+			});
 		});
 
 		expect(await exists(socketPath), 'Socket existence').to.be.false;

tests/commands/release.spec.ts

@@ -82,7 +82,7 @@ describe('balena release', function () {
 		expect(err).to.be.empty;
 		const json = JSON.parse(out.join(''));
 		expect(json[0].commit).to.equal('90247b54de4fa7a0a3cbc85e73c68039');
-		expect(json[0].contains__image[0].image[0].start_timestamp).to.equal(
+		expect(json[0].release_image[0].image[0].start_timestamp).to.equal(
 			'2020-01-04T01:13:08.583Z',
 		);
 	});

tests/commands/whoami.spec.ts

@@ -26,7 +26,7 @@ describe('balena whoami', function () {
 		api = new BalenaAPIMock();
 	});
 
-	this.afterEach(async () => {
+	this.afterEach(() => {
 		// Check all expected api calls have been made and clean up.
 		api.done();
 	});

tests/docker-build.ts

@@ -26,7 +26,6 @@ import * as tar from 'tar-stream';
 import { streamToBuffer } from 'tar-utils';
 import { URL } from 'url';
 import { diff } from 'deep-object-diff';
-
 import { makeImageName } from '../build/utils/compose_ts';
 import { stripIndent } from '../build/utils/lazy';
 import type { BuilderMock } from './nock/builder-mock';
@@ -77,13 +76,13 @@ export async function inspectTarStream(
 						type: header.type,
 					};
 					const expected = expectedFiles[header.name];
-					if (expected && expected.testStream) {
+					if (expected?.testStream) {
 						await expected.testStream(header, stream, expected);
 					} else {
 						await defaultTestStream(header, stream, expected, projectPath);
 					}
 				} catch (err) {
-					reject(err);
+					reject(err as Error);
 				}
 				next();
 			},
@@ -144,9 +143,8 @@ export async function expectStreamNoCRLF(
 	_header: tar.Headers,
 	stream: Readable,
 ): Promise<void> {
-	const chai = await import('chai');
 	const buf = await streamToBuffer(stream);
-	await chai.expect(buf.includes('\r\n')).to.be.false;
+	expect(buf.includes('\r\n')).to.be.false;
 }
 
 /**
@@ -184,7 +182,7 @@ export async function testDockerBuildStream(o: {
 
 		o.dockerMock.expectPostBuild({
 			...o,
-			checkURI: async (uri: string) => {
+			checkURI: (uri: string) => {
 				const url = new URL(uri, 'http://test.net/');
 				const queryParams = Array.from(url.searchParams.entries());
 				expect(deepJsonParse(queryParams)).to.have.deep.members(
@@ -241,7 +239,7 @@ export async function testPushBuildStream(o: {
 
 	o.builderMock.expectPostBuild({
 		...o,
-		checkURI: async (uri: string) => {
+		checkURI: (uri: string) => {
 			const url = new URL(uri, 'http://test.net/');
 			const queryParams = Array.from(url.searchParams.entries());
 			expect(deepJsonParse(queryParams)).to.have.deep.members(

tests/helpers.ts

@@ -17,13 +17,21 @@
 
 import * as _ from 'lodash';
 import * as path from 'path';
+import * as fs from 'fs';
+import { createGunzip } from 'zlib';
 
 import * as packageJSON from '../package.json';
 import { getNodeEngineVersionWarn } from '../build/utils/messages';
 import { warnify } from '../build/utils/messages';
 
-const balenaExe = process.platform === 'win32' ? 'balena.exe' : 'balena';
-const standalonePath = path.resolve(__dirname, '..', 'build-bin', balenaExe);
+const standalonePath = path.resolve(
+	__dirname,
+	'..',
+	'dist',
+	'balena',
+	'bin',
+	'balena',
+);
 
 export interface TestOutput {
 	err: string[]; // stderr
@@ -164,11 +172,11 @@ async function runCommandInSubprocess(
 		// override default proxy exclusion to allow proxying of requests to 127.0.0.1
 		BALENARC_DO_PROXY: '127.0.0.1,localhost',
 	};
-	const { execFile } = await import('child_process');
+	const { exec } = await import('child_process');
+
 	await new Promise<void>((resolve) => {
-		const child = execFile(
-			standalonePath,
-			cmd.split(' ').filter((c) => c),
+		const child = exec(
+			`${standalonePath} ${cmd}`,
 			{ env: { ...process.env, ...addedEnvs } },
 			($error, $stdout, $stderr) => {
 				stderr = $stderr || '';
@@ -213,6 +221,67 @@ ${$error}`;
 	};
 }
 
+async function extractTarStream() {
+	if (
+		fs.existsSync(path.join(__dirname, '..', 'dist', 'balena', 'bin', 'balena'))
+	) {
+		return;
+	}
+
+	const tar = await import('tar-stream');
+
+	const version = 'v' + packageJSON.version;
+	const arch = process.arch;
+	const platform =
+		process.platform === 'win32'
+			? 'windows'
+			: process.platform === 'darwin'
+				? 'macOS'
+				: process.platform;
+
+	const sourceFile = path.join(
+		__dirname,
+		'..',
+		'dist',
+		`balena-cli-${version}-${platform}-${arch}-standalone.tar.gz`,
+	);
+	const destinationDir = path.join(__dirname, '..', 'dist');
+
+	const extract = tar.extract();
+
+	return new Promise((resolve, reject) => {
+		extract.on('entry', (header, stream, next) => {
+			const outputPath = path.join(destinationDir, header.name);
+
+			if (header.type === 'directory') {
+				fs.mkdirSync(outputPath, { recursive: true });
+				next();
+			} else {
+				fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+				const fileStream = fs.createWriteStream(outputPath);
+
+				stream.pipe(fileStream);
+
+				fileStream.on('close', () => {
+					if (header.mode) {
+						fs.chmodSync(outputPath, header.mode); // Set file permissions
+					}
+					next();
+				});
+				fileStream.on('error', reject);
+			}
+		});
+
+		extract.on('finish', resolve);
+		extract.on('error', reject);
+
+		fs.createReadStream(sourceFile)
+			.pipe(createGunzip())
+			.pipe(extract)
+			.on('error', reject);
+	});
+}
+
 /**
  * Run a CLI command and capture its stdout, stderr and exit code for testing.
  * If the BALENA_CLI_TEST_TYPE env var is set to 'standalone', then the command
@@ -223,6 +292,7 @@ ${$error}`;
  */
 export async function runCommand(cmd: string): Promise<TestOutput> {
 	if (process.env.BALENA_CLI_TEST_TYPE === 'standalone') {
+		await extractTarStream();
 		const semver = await import('semver');
 		if (semver.lt(process.version, '10.16.0')) {
 			throw new Error(
@@ -287,15 +357,14 @@ export function monochrome(text: string): string {
  */
 export function fillTemplate(
 	templateString: string,
-	templateVars: object,
+	templateVars: Record<string, unknown>,
 ): string {
-	const escaped = templateString.replace(/\\/g, '\\\\').replace(/`/g, '\\`');
-	const resolved = new Function(
-		...Object.keys(templateVars),
-		`return \`${escaped}\`;`,
-	).call(null, ...Object.values(templateVars));
-	const unescaped = resolved.replace(/\\`/g, '`').replace(/\\\\/g, '\\');
-	return unescaped;
+	return templateString.replace(/\$\{(\w+)\}/g, (_, key) => {
+		if (key in templateVars) {
+			return String(templateVars[key]);
+		}
+		throw new Error(`Missing template variable: ${key}`);
+	});
 }
 
 /**