Objective

Revert commit dbb466214aa5a524b015b5f39a7b0b933bb77822 (this commit only) to remove the vendored make.com file and instead download it from the Internet with SHA verification.

Specific Changes Required

1. Revert the commit changes:

Based on commit dbb466214aa5a524b015b5f39a7b0b933bb77822, you need to:

In packages/test/test-assets/.gitignore:

• Add back make.com to the gitignore file (it was removed in the commit)

In packages/test/test-assets/package.json:

Current state (after the commit):

"build:pre": "npm run build:pre:local-dependencies && npm run build:pre:watch",
"build:pre:local-dependencies": "../../../scripts/npm/build-local-dependencies.sh",
"build:pre:watch": "../../../scripts/npm/build-watch.sh",
"build:run": "./make.com clean all",

Change it to download make.com from the Internet:

"build:pre": "npm run build:pre:setup && npm run build:pre:local-dependencies && npm run build:pre:watch",
"build:pre:local-dependencies": "../../../scripts/npm/build-local-dependencies.sh",
"build:pre:setup": "command -v make >/dev/null 2>&1 || { [ -x ./make.com ] || { curl -fsSL -o make.com https://cosmo.zip/pub/cosmos/bin/make && chmod +x make.com; }; }",
"build:pre:watch": "../../../scripts/npm/build-watch.sh",
"build:run": "MAKE_BIN=$(command -v make || echo ./make.com) && \"$MAKE_BIN\" clean all",

Delete the vendored file:

• Remove packages/test/test-assets/make.com file (SHA: 78f9ae2104e65edd796820da072fde1205da828f)

2. Add SHA verification:

In packages/test/test-assets/package.json, add a new field to track the expected SHA-256 hash of the downloaded make.com file:

{
  "name": "@msinternal/test-assets",
  "version": "0.0.0-0",
  "description": "",
  "private": true,
  "author": "Microsoft Corporation",
  "license": "MIT",
  "engines": {
    "node": ">= 14.0.0"
  },
  "makeComSha256": "PLACEHOLDER_SHA256_TO_BE_CALCULATED",
  "scripts": {
    ...
  }
}

3. Implement SHA verification:

Modify the build:pre:setup script to verify the SHA-256 hash after downloading:

"build:pre:setup": "command -v make >/dev/null 2>&1 || { [ -x ./make.com ] || { curl -fsSL -o make.com https://cosmo.zip/pub/cosmos/bin/make && chmod +x make.com && EXPECTED_SHA=$(node -p 'require(\"./package.json\").makeComSha256') && ACTUAL_SHA=$(shasum -a 256 make.com | cut -d' ' -f1) && [ \"$EXPECTED_SHA\" = \"$ACTUAL_SHA\" ] || { echo \"ERROR: make.com SHA mismatch! Expected: $EXPECTED_SHA, Got: $ACTUAL_SHA\" >&2; rm make.com; exit 1; }; }; }",

4. Calculate and hardcode the actual SHA:

You need to:

1. Download the file from https://cosmo.zip/pub/cosmos/bin/make
2. Calculate its SHA-256 hash
3. Replace PLACEHOLDER_SHA256_TO_BE_CALCULATED with the actual hash value

To calculate the SHA-256 hash, you can use:

curl -fsSL -o make.com https://cosmo.zip/pub/cosmos/bin/make
shasum -a 256 make.com

5. Add documentation:

Add a comment or note in the package.json file indicating the source code location:

{
  "name": "@msinternal/test-assets",
  "description": "Uses make.com from Cosmopolitan Libc. Source code available at: https://github.com/jart/cosmopolitan/tree/master/third_party/make",
  ...
}

Summary

This change will:

1. Revert the vendoring of make.com
2. Download it from https://cosmo.zip/pub/cosmos/bin/make instead
3. Verify the downloaded file against a hardcoded SHA-256 hash
4. Alert developers if the remote file changes (SHA mismatch)
5. Document the source code location

The SHA verification ensures that if the remote make.com file changes, the build will fail with a clear error message, notifying developers of the change.