Repository navigation
Publish as @runonflux/bitcore-message 2.0.0 on Node 24 - #4
Merged
Merged
Conversation
The gulp 3 and bitcore-build pipeline does not run on current Node, and its browser bundle tasks have no consumer. scripts/test.js runs each test file in its own mocha process and checks every outcome against test/inherited-failures.json: the 4 tests that fail at ec2fb0a with bitcore-lib 8f5453f, which verify Bitcoin testnet addresses. 15 tests pass, as at ec2fb0a. bitcore-lib is pinned to a commit instead of following master. npm 12 fetches git dependencies only with allow-git set. Node 24 or later is required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
test/differential.js loads bitcore-message ec2fb0a with bitcore-lib 8f5453f, a devDependency, beside this package and requires identical magic hashes, signatures (with the random nonce fixed), verification results and errors, across livenet and testnet, compressed and uncompressed keys and messages up to 65536 bytes, and cross verifies each version's signatures with the other. For a signature whose R is off the curve both throw from verify; bitcore-lib 8f5453f fails validating the key it recovers from R, and later bitcore-lib rejects R with 'Point does not lie on the curve'. The Buffer constructor is deprecated (DEP0005). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The package is published to npm under the runonflux scope and takes @runonflux/bitcore-lib ^0.16.0 from npm. It ships index.js and lib only. The README installs and requires it by that name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The differential test's devDependency bitcore-message-ec2fb0a, and the bitcore-lib 8f5453f it runs on, are tarballs in test/fixtures (index.js, lib, package.json and LICENSE at those commits), so installing the repo fetches nothing from git and needs no .npmrc. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI runs the tests on every push and pull request. A published GitHub release sets the package version from its tag, runs the tests and stages that version on npm through trusted publishing: it stays unpublished until a maintainer approves it on npmjs.com with 2FA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
npm verifies a provenance-signed publish by comparing repository.url with the GitHub repository the workflow ran in, case-sensitively. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes
@runonflux/bitcore-message2.0.0 on@runonflux/bitcore-lib, with a differential test against ec2fb0a.The suite matches its manifest exactly: 19 passing, 4 inherited failures as listed. Running on labnet (the lab's own Flux chain): the API answers identically to 1.3.0, the React UI works against it in a browser, live updates arrive over the websocket, and a transaction sent through
/api/tx/sendwas mined.Publishing. This package is released through npm's staged publishing. Publishing a
GitHub release (tag
vX.Y.Z) runs CI, which sets the version from the tag, runs the tests andstages that version on npm through trusted publishing (GitHub's OIDC; no npm token is stored).
A staged version is not public: nobody can install it until a maintainer approves it on
npmjs.com, or with
npm stage approve, which requires 2FA. Each package needs a trustedpublisher on npmjs.com for this repository's
ci.yml, allowing staged publishing only.Order: each layer is published before the one above it. The packages depend on each other
by version, so they are released lowest first, each approved before the next:
bitcoind-rpcandbitcore-libbitcore-messagebitcore-node,insight-apiandinsight-uiUntil the packages below this one are on npm, this PR's CI cannot install them and fails; that
is the order, not a broken change. Once they are published, this PR refreshes its
package-lock.jsonagainst npm in one commit, and CI passes.🤖 Generated with Claude Code