feat: harden recording lifecycle and refresh fnOS UI

scripts/build-fnos-package.sh

@@ -2,9 +2,7 @@
 set -euo pipefail
 
 ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-VERSION=1.1.0
-NODE_VERSION=22.18.0
-NODE_ARCHIVE_SHA256=c1bfeecf1d7404fa74728f9db72e697decbd8119ccc6f5a294d795756dfcfca7
+VERSION=1.2.13
 OUTPUT="${1:-$ROOT_DIR/artifacts/fnos/liverecorder-${VERSION}-x86_64.fpk}"
 WORKSPACE_CACHE=$(CDPATH= cd -- "$ROOT_DIR/.." && pwd)
 DOTNET_BIN="${DOTNET:-$WORKSPACE_CACHE/.dotnet8/dotnet}"
@@ -26,7 +24,7 @@ FNPACK_BIN=$(command -v "$FNPACK_BIN") || {
     exit 1
 }
 
-for command_name in npm apt-get curl dpkg-deb readelf realpath find install sha256sum tar xz node; do
+for command_name in npm apt-get curl dpkg-deb readelf realpath find install sha256sum tar node; do
     command -v "$command_name" >/dev/null 2>&1 || {
         printf 'required build command is missing: %s\n' "$command_name" >&2
         exit 1
@@ -45,8 +43,7 @@ EXTRACT_ROOT="$WORK_DIR/debian-root"
 RUNTIME_ROOT="$STAGE/app/runtime"
 
 mkdir -p "$STAGE/app/server" "$RUNTIME_ROOT/bin" "$RUNTIME_ROOT/lib" \
-    "$RUNTIME_ROOT/usr/lib/postgresql/15/bin" "$RUNTIME_ROOT/usr/lib/postgresql/15/lib" \
-    "$RUNTIME_ROOT/usr/share/postgresql/15" "$RUNTIME_ROOT/etc/ssl/certs" \
+    "$RUNTIME_ROOT/etc/ssl/certs" \
     "$PACKED_ROOT" "$FNPACK_TMP_ROOT" "$EXTRACT_ROOT"
 cp -a "$ROOT_DIR/fnos/." "$STAGE/"
 
@@ -102,8 +99,6 @@ apt-get "${APT_OPTIONS[@]}" \
     --no-install-recommends \
     --yes \
     install \
-    postgresql-15 \
-    postgresql-client-15 \
     curl \
     ca-certificates
 
@@ -143,44 +138,7 @@ copy_extracted_file() {
     install -m "$mode" "$resolved" "$destination"
 }
 
-copy_dereferenced_tree() {
-    local source_root=$1 destination_root=$2 relative source mode
-    [ -d "$source_root" ] || { printf 'missing extracted runtime directory: %s\n' "$source_root" >&2; return 1; }
-    while IFS= read -r -d '' relative; do
-        mkdir -p "$destination_root/${relative#./}"
-    done < <(cd "$source_root" && find . -type d -print0)
-    while IFS= read -r -d '' relative; do
-        source="$source_root/${relative#./}"
-        mode=0644
-        [ -x "$source" ] && mode=0755
-        copy_extracted_file "$source" "$destination_root/${relative#./}" "$mode"
-    done < <(cd "$source_root" && find . \( -type f -o -type l \) -print0)
-}
-
 printf 'Assembling minimal relocatable runtime...\n'
-for source in "$EXTRACT_ROOT/usr/lib/postgresql/15/bin/"*; do
-    [ -f "$source" ] || [ -L "$source" ] || continue
-    copy_extracted_file "$source" "$RUNTIME_ROOT/usr/lib/postgresql/15/bin/$(basename -- "$source")" 0755
-done
-copy_dereferenced_tree \
-    "$EXTRACT_ROOT/usr/share/postgresql/15" \
-    "$RUNTIME_ROOT/usr/share/postgresql/15"
-
-for source in "$EXTRACT_ROOT/usr/lib/postgresql/15/lib/"*.so*; do
-    [ -f "$source" ] || [ -L "$source" ] || continue
-    copy_extracted_file "$source" "$RUNTIME_ROOT/usr/lib/postgresql/15/lib/$(basename -- "$source")" 0755
-done
-
-NODE_ARCHIVE="$WORK_DIR/node-v${NODE_VERSION}-linux-x64.tar.xz"
-NODE_DIST_ROOT="$WORK_DIR/node-dist"
-printf 'Downloading pinned official Node.js %s runtime...\n' "$NODE_VERSION"
-curl --fail --location --retry 3 \
-    "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
-    --output "$NODE_ARCHIVE"
-printf '%s  %s\n' "$NODE_ARCHIVE_SHA256" "$NODE_ARCHIVE" | sha256sum --check --status
-mkdir -p "$NODE_DIST_ROOT"
-tar -xJf "$NODE_ARCHIVE" -C "$NODE_DIST_ROOT" --strip-components=1
-install -m 0755 "$NODE_DIST_ROOT/bin/node" "$RUNTIME_ROOT/bin/node"
 copy_extracted_file "$EXTRACT_ROOT/usr/bin/curl" "$RUNTIME_ROOT/bin/curl" 0755
 
 CA_CONFIG="$EXTRACT_ROOT/etc/ca-certificates.conf"
@@ -209,7 +167,7 @@ while IFS= read -r -d '' elf_file; do
     if readelf -h "$elf_file" >/dev/null 2>&1; then
         ELF_QUEUE+=("$elf_file")
     fi
-done < <(find "$RUNTIME_ROOT/bin" "$RUNTIME_ROOT/usr/lib/postgresql/15/bin" "$RUNTIME_ROOT/usr/lib/postgresql/15/lib" -type f -print0)
+done < <(find "$RUNTIME_ROOT/bin" -type f -print0)
 
 is_system_glibc_library() {
     case "$1" in
@@ -241,10 +199,6 @@ while [ "$queue_index" -lt "${#ELF_QUEUE[@]}" ]; do
 done
 
 for required_file in \
-    "$RUNTIME_ROOT/usr/lib/postgresql/15/bin/postgres" \
-    "$RUNTIME_ROOT/usr/lib/postgresql/15/bin/initdb" \
-    "$RUNTIME_ROOT/usr/lib/postgresql/15/bin/pg_ctl" \
-    "$RUNTIME_ROOT/bin/node" \
     "$RUNTIME_ROOT/bin/curl"; do
     test -x "$required_file" || { printf 'native runtime file is missing: %s\n' "$required_file" >&2; exit 1; }
 done
@@ -263,5 +217,6 @@ mv "$PACKED_ROOT/liverecorder.fpk" "$OUTPUT"
     sha256sum "$(basename -- "$OUTPUT")" >"$(basename -- "$OUTPUT").sha256"
 )
 
-"$ROOT_DIR/scripts/verify-fnos-package.sh" "$OUTPUT"
+LIVERECORDER_VERIFY_TMPDIR="${LIVERECORDER_VERIFY_TMPDIR:-$BUILD_TMP_ROOT}" \
+    "$ROOT_DIR/scripts/verify-fnos-package.sh" "$OUTPUT"
 printf 'Built %s\n' "$OUTPUT"