Merge branch 'main' into merogge/aria

.vscode/notebooks/api.github-issues

@@ -7,7 +7,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$repo=repo:microsoft/vscode\n$milestone=milestone:\"November 2023\"\n"
+    "value": "$REPO=repo:microsoft/vscode\n$MILESTONE=milestone:\"December / January 2024\"\n"
   },
   {
     "kind": 1,
@@ -17,7 +17,7 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$repo $milestone label:api-finalization\n"
+    "value": "$REPO $MILESTONE label:api-finalization\n"
   },
   {
     "kind": 1,
@@ -27,6 +27,6 @@
   {
     "kind": 2,
     "language": "github-issues",
-    "value": "$repo $milestone is:open label:api-proposal sort:created-asc\n"
+    "value": "$REPO $MILESTONE is:open label:api-proposal sort:created-asc\n"
   }
 ]

build/azure-pipelines/common/computeNodeModulesCacheKey.ts

@@ -10,7 +10,7 @@ const { dirs } = require('../../npm/dirs');
 
 const ROOT = path.join(__dirname, '../../../');
 
-const shasum = crypto.createHash('sha1');
+const shasum = crypto.createHash('sha256');
 
 shasum.update(fs.readFileSync(path.join(ROOT, 'build/.cachesalt')));
 shasum.update(fs.readFileSync(path.join(ROOT, '.yarnrc')));

build/azure-pipelines/common/publish.ts

@@ -11,8 +11,6 @@ import { pipeline } from 'node:stream/promises';
 import * as yauzl from 'yauzl';
 import * as crypto from 'crypto';
 import { retry } from './retry';
-import { BlobServiceClient, BlockBlobParallelUploadOptions, StorageRetryPolicyType } from '@azure/storage-blob';
-import * as mime from 'mime';
 import { CosmosClient } from '@azure/cosmos';
 import { ClientSecretCredential } from '@azure/identity';
 import * as cp from 'child_process';
@@ -627,36 +625,6 @@ function getRealType(type: string) {
 	}
 }
 
-async function uploadAssetLegacy(log: (...args: any[]) => void, quality: string, commit: string, filePath: string): Promise<string> {
-	const fileName = path.basename(filePath);
-	const blobName = commit + '/' + fileName;
-
-	const credential = new ClientSecretCredential(e('AZURE_TENANT_ID'), e('AZURE_CLIENT_ID'), e('AZURE_CLIENT_SECRET'));
-	const blobServiceClient = new BlobServiceClient(`https://vscode.blob.core.windows.net`, credential, { retryOptions: { retryPolicyType: StorageRetryPolicyType.FIXED, tryTimeoutInMs: 2 * 60 * 1000 } });
-	const containerClient = blobServiceClient.getContainerClient(quality);
-	const blobClient = containerClient.getBlockBlobClient(blobName);
-
-	const blobOptions: BlockBlobParallelUploadOptions = {
-		blobHTTPHeaders: {
-			blobContentType: mime.lookup(filePath),
-			blobContentDisposition: `attachment; filename="${fileName}"`,
-			blobCacheControl: 'max-age=31536000, public'
-		}
-	};
-
-	log(`Checking for blob in Azure...`);
-
-	if (await blobClient.exists()) {
-		log(`Blob ${quality}, ${blobName} already exists, not publishing again.`);
-	} else {
-		log(`Uploading blobs to Azure storage...`);
-		await blobClient.uploadFile(filePath, blobOptions);
-		log('Blob successfully uploaded to Azure storage.');
-	}
-
-	return `${e('AZURE_CDN_URL')}/${quality}/${blobName}`;
-}
-
 async function processArtifact(artifact: Artifact, artifactFilePath: string): Promise<void> {
 	const log = (...args: any[]) => console.log(`[${artifact.name}]`, ...args);
 	const match = /^vscode_(?<product>[^_]+)_(?<os>[^_]+)_(?<arch>[^_]+)_(?<unprocessedType>[^_]+)$/.exec(artifact.name);
@@ -673,26 +641,23 @@ async function processArtifact(artifact: Artifact, artifactFilePath: string): Pr
 	const type = getRealType(unprocessedType);
 	const size = fs.statSync(artifactFilePath).size;
 	const stream = fs.createReadStream(artifactFilePath);
-	const [sha1hash, sha256hash] = await Promise.all([hashStream('sha1', stream), hashStream('sha256', stream)]);
-
-	const [assetUrl, prssUrl] = await Promise.all([
-		uploadAssetLegacy(log, quality, commit, artifactFilePath),
-		releaseAndProvision(
-			log,
-			e('RELEASE_TENANT_ID'),
-			e('RELEASE_CLIENT_ID'),
-			e('RELEASE_AUTH_CERT_SUBJECT_NAME'),
-			e('RELEASE_REQUEST_SIGNING_CERT_SUBJECT_NAME'),
-			e('PROVISION_TENANT_ID'),
-			e('PROVISION_AAD_USERNAME'),
-			e('PROVISION_AAD_PASSWORD'),
-			commit,
-			quality,
-			artifactFilePath
-		)
-	]);
-
-	const asset: Asset = { platform, type, url: assetUrl, hash: sha1hash, mooncakeUrl: prssUrl, prssUrl, sha256hash, size, supportsFastUpdate: true };
+	const [hash, sha256hash] = await Promise.all([hashStream('sha1', stream), hashStream('sha256', stream)]); // CodeQL [SM04514] Using SHA1 only for legacy reasons, we are actually only respecting SHA256
+
+	const url = await releaseAndProvision(
+		log,
+		e('RELEASE_TENANT_ID'),
+		e('RELEASE_CLIENT_ID'),
+		e('RELEASE_AUTH_CERT_SUBJECT_NAME'),
+		e('RELEASE_REQUEST_SIGNING_CERT_SUBJECT_NAME'),
+		e('PROVISION_TENANT_ID'),
+		e('PROVISION_AAD_USERNAME'),
+		e('PROVISION_AAD_PASSWORD'),
+		commit,
+		quality,
+		artifactFilePath
+	);
+
+	const asset: Asset = { platform, type, url, hash, sha256hash, size, supportsFastUpdate: true };
 	log('Creating asset...', JSON.stringify(asset));
 
 	await retry(async (attempt) => {

build/azure-pipelines/product-build.yml

@@ -128,8 +128,6 @@ variables:
     value: c24324f7-e65f-4c45-8702-ed2d4c35df99
   - name: PRSS_PROVISION_TENANT_ID
     value: 72f988bf-86f1-41af-91ab-2d7cd011db47
-  - name: AZURE_CDN_URL
-    value: https://az764295.vo.msecnd.net
   - name: AZURE_DOCUMENTDB_ENDPOINT
     value: https://vscode.documents.azure.com:443/
   - name: VSCODE_MIXIN_REPO

build/gulpfile.vscode.js

@@ -184,7 +184,7 @@ function computeChecksum(filename) {
 	const contents = fs.readFileSync(filename);
 
 	const hash = crypto
-		.createHash('md5')
+		.createHash('sha256')
 		.update(contents)
 		.digest('base64')
 		.replace(/=+$/, '');

build/linux/debian/install-sysroot.ts

@@ -45,6 +45,7 @@ function getElectronVersion(): Record<string, string> {
 }
 
 function getSha(filename: fs.PathLike): string {
+	// CodeQL [SM04514] Hash logic cannot be changed due to external dependency, also the code is only used during build.
 	const hash = createHash('sha1');
 	// Read file 1 MB at a time
 	const fd = fs.openSync(filename, 'r');

cli/src/bin/code/legacy_args.rs

@@ -60,6 +60,7 @@ pub fn try_parse_legacy(
 
 	// Now translate them to subcommands.
 	// --list-extensions        -> ext list
+	// --update-extensions      -> update
 	// --install-extension=id   -> ext install <id>
 	// --uninstall-extension=id -> ext uninstall <id>
 	// --status                 -> status
@@ -87,6 +88,14 @@ pub fn try_parse_legacy(
 			})),
 			..Default::default()
 		})
+	} else if let Some(_exts) = args.remove("update-extensions") {
+		Some(CliCore {
+			subcommand: Some(Commands::Extension(ExtensionArgs {
+				subcommand: ExtensionSubcommand::Update,
+				desktop_code_options,
+			})),
+			..Default::default()
+		})
 	} else if let Some(exts) = args.remove("uninstall-extension") {
 		Some(CliCore {
 			subcommand: Some(Commands::Extension(ExtensionArgs {

cli/src/commands/args.rs

@@ -254,6 +254,8 @@ pub enum ExtensionSubcommand {
 	Install(InstallExtensionArgs),
 	/// Uninstall an extension.
 	Uninstall(UninstallExtensionArgs),
+	/// Update the installed extensions.
+	Update,
 }
 
 impl ExtensionSubcommand {
@@ -284,6 +286,9 @@ impl ExtensionSubcommand {
 					target.push(format!("--uninstall-extension={}", id));
 				}
 			}
+			ExtensionSubcommand::Update => {
+				target.push("--update-extensions".to_string());
+			}
 		}
 	}
 }

cli/src/tunnels/code_server.rs

@@ -58,6 +58,7 @@ pub struct CodeServerArgs {
 	// extension management
 	pub install_extensions: Vec<String>,
 	pub uninstall_extensions: Vec<String>,
+	pub update_extensions: bool,
 	pub list_extensions: bool,
 	pub show_versions: bool,
 	pub category: Option<String>,
@@ -129,6 +130,9 @@ impl CodeServerArgs {
 		for extension in &self.uninstall_extensions {
 			args.push(format!("--uninstall-extension={}", extension));
 		}
+		if self.update_extensions {
+			args.push(String::from("--update-extensions"));
+		}
 		if self.list_extensions {
 			args.push(String::from("--list-extensions"));
 			if self.show_versions {