Matter Binding Requirements

[digitaldan]

Hi, for the 5.0 release, the Matter Binding requires a version of nodejs (18.1+) in order to operate. If not found, the binding will download an official binary on windows, mac and relatively recent Linux versions. Unfortunately this does not work on Alpine due to libc dependencies, and so there is not a NodeJS distro we can download and run.

@wborn i wanted to get your thoughts here on options. Installing nodejs/npm will increase the distro size on alpine by ~30–50 MB and if we did the same on Debian, it might be ~22–30 MB. This would be the easiest and most foolproof way forward, but of course increases the size for everyone.

If there are alternative ideas i would love to hear them. I have a couple thoughts as i type this.

It would be great if we could "apt get" / "apk add" the package at runtime, but since the openHAB process is not run under root, i can't do that from the binding.

One thought is to use a script a boot up to see if matter is installed and install nodejs before starting openHAB, but this would require a restart after installing the binding.

Another option might be if there is something we could set or call from openHAB that would be picked up by a script looking/watching for it that would install the package as root? Maybe we could use this to create a white list of packages that bindings are allowed to install using some mechanism (so send a package name to a local pipe or file, this would be picked up by a watcher that checks if the package is allowed, and installs it)

I think the Matter binding is going to be very, very popular in the coming months and years, and i think we need a way to support it out of the box with our docker distros.

[digitaldan]

As a little test, here is a helper bash script which listens to a fifo file for commands to install packages, checks the package against a whitelist, and if allowed installs it and returns "OK", and "DENIED" if not allowed. It also detects if the system is APK or APT based.

#!/bin/sh
set -euxo pipefail

OH_USER=${OH_USER:-openhab}
PKGDIR=/run/pkgctl
FIFO_REQ=$PKGDIR/req

mkdir -p "$PKGDIR"
chmod 1777 "$PKGDIR"
chown root:root "$PKGDIR"

# detect apk / apt …
if command -v apk >/dev/null 2>&1; then PM=apk
elif command -v apt-get >/dev/null 2>&1; then PM=apt
else echo "[pkgctl] no package manager!" >&2; exit 1; fi

echo "[pkgctl] user=$OH_USER  pm=$PM  dir=$PKGDIR" >&2

rm -f "$FIFO_REQ"; mkfifo "$FIFO_REQ"; chown "$OH_USER:$OH_USER" "$FIFO_REQ"

while read -r line <"$FIFO_REQ"; do
    reqid=$(echo "$line" | awk '{print $1}')
    pkg=$(  echo "$line" | awk '{print $2}')
    RESP="$PKGDIR/$reqid"
    if [ ! -p "$RESP" ]; then
        mkfifo "$RESP"
    fi

    chown $OH_USER:$OH_USER "$RESP"
    chmod 660 "$RESP"

    if ! grep -Fxq "$pkg" /etc/pkg-whitelist 2>/dev/null; then
        printf 'DENIED %s\n' "$pkg" >"$RESP"
        continue
    fi

    case $PM in
      apk) if apk add --no-cache "$pkg" >/dev/null 2>&1; then r=OK; else r=FAIL; fi ;;
      apt) export DEBIAN_FRONTEND=noninteractive
           if apt-get update -qq && apt-get install -y --no-install-recommends "$pkg" \
                 >/dev/null 2>&1; then
               r=OK; apt-get clean && rm -rf /var/lib/apt/lists/*
           else r=FAIL; fi ;;
    esac
    # open FD 3 read-write 
    exec 3<> "$RESP"                       
    printf '%s %s\n' "$r" "$pkg" >&3       
    # close FD 3
    exec 3>&-
done

And a little test client in bash (the real client would be java)

#!/bin/sh
PKGDIR=/run/pkgctl
FIFO_REQ=$PKGDIR/req
uuid() { cat /proc/sys/kernel/random/uuid; }

id=$(uuid); resp=$PKGDIR/$id; mkfifo "$resp"; chmod 600 "$resp"
printf '%s %s\n' "$id" "$1" >"$FIFO_REQ"
read -r ans <"$resp" && echo "$ans"
rm -f "$resp"

pkg-whitelist

nodejs
npm
ffmpeg

[wborn]

Hi @digitaldan! Thanks for all your nice work on the Matter Binding! 🙂 It's going to be a very popular binding so it would be nice if it works easily in Docker as well.

There's already #454 for installing Node.js on Alpine. My plan was to merge it when openhab/openhab-addons#18486 gets merged so it doesn't unnecessary bloat images and increase build times.

If not found, the binding will download an official binary on windows, mac and relatively recent Linux versions.

Do you know if this works in the Debian container? If it works it is probably not strictly necessary to install Node.js in the Debian container but we could still do it to keep the experience consistent.

Is Node.js also preinstalled in openHABian @openhab/openhabian-maintainers?

As a little test, here is a helper bash script which listens to a fifo file for commands to install packages, checks the package against a whitelist, and if allowed installs it and returns "OK", and "DENIED" if not allowed. It also detects if the system is APK or APT based.

That kind of mechanism would be nice to have as well. Especially for add-ons that are not frequently used and have huge dependencies. Might make more sense to add this separately and also make it work in other distributions such as openHABian.

[mstormi]

openHABian has a node.js install routine which is used by some 3rd party tools like frontail but it's not installed by default.

[digitaldan]

Thanks @wborn , i totally missed that PR (but now i do remember @florian-h05 saying he opened a PR!). That will do nicely!

Do you know if this works in the Debian container? If it works it is probably not strictly necessary to install Node.js in the Debian container but we could still do it to keep the experience consistent.

It does, but i think it would be much nicer to have nodejs already installed, makes the first time use that much nicer. So yes, i would vote for consistency and install on both.

Thanks!!!!

[florian-h05]

Should we also install NodeJS on Debian or leave it to the binding to pull the binary later.

[wborn]

If you can create a similar PR for Debian we can merge it as well. 🙂

[florian-h05]

Done, see #464.