fix(sea): silence benign LIEF warnings during postject injection (#265)

* fix(sea): silence benign LIEF warnings during postject injection

LIEF (inside postject) prints "signature seems corrupted" and
"Can't find string offset for section name '.note.100'" to stderr
after postject expands the ELF section table to make room for
NODE_SEA_BLOB. The messages are cosmetic — the injection succeeds
and macOS binaries are re-signed afterwards — but users reasonably
assume something is wrong.

Wrap the postject.inject() call in a tiny stderr filter that drops
only those specific lines. Everything else passes through
unchanged, and the original process.stderr.write is restored in a
finally block.

* refactor(sea): tighten typing of postject stderr filter

Replace `unknown` + `...rest: unknown[]` (which forced two `as` casts
and a runtime `rest.find` to locate the callback) with the actual
write() overload parameters: `chunk: string | Uint8Array`,
`encodingOrCb?: BufferEncoding | WriteCallback`, `cb?: WriteCallback`.

Disambiguate the pass-through call so the right write() overload is
dispatched, and handle plain Uint8Array chunks explicitly.

Whitelist `BufferEncoding` as a global in the TS ESLint block,
mirroring how `NodeJS` is already handled — both are type-only
identifiers that `no-undef` can't resolve on its own.

* fix(sea): restore original stderr.write reference, not a bound wrapper

Keep the unbound write function for restoration so process.stderr.write
regains its exact prior identity after the call. Use a separate bound
copy internally for calling from the filter.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

Author: robertsLando

eslint.config.js

@@ -80,6 +80,7 @@ module.exports = [
       globals: {
         ...require('globals').node,
         NodeJS: 'readonly',
+        BufferEncoding: 'readonly',
       },
     },
     rules: {

lib/sea.ts

@@ -62,6 +62,67 @@ const exists = async (path: string) => {
   }
 };
 
+/**
+ * Benign LIEF messages printed by postject during SEA blob injection.
+ *
+ * LIEF re-parses the Node binary after postject expands the section
+ * table to make room for `NODE_SEA_BLOB`, and the pre-existing
+ * build-id / `.note.*` section-name offsets no longer resolve cleanly
+ * through `.shstrtab` — so LIEF falls back to synthetic names like
+ * `.note.100` and warns. On Mach-O the analogous "signature seems
+ * corrupted" line is also cosmetic: we re-sign the binary with
+ * `codesign` after injection (see signMachOExecutable).
+ *
+ * The warnings have no bearing on correctness of the produced
+ * executable but users reasonably assume something is wrong, so we
+ * filter them out of stderr just for the duration of the inject call.
+ */
+const BENIGN_POSTJECT_STDERR =
+  /^warning: (?:The signature seems corrupted!|Can't find string offset for section name '\.note)/;
+
+type StderrWrite = typeof process.stderr.write;
+type WriteCallback = (err?: Error | null) => void;
+
+/**
+ * Run `fn` with `process.stderr.write` wrapped to drop known-benign
+ * postject/LIEF messages. Anything that doesn't match the allow-list
+ * pattern passes through unchanged, so real errors are never hidden.
+ * The original `write` is restored in a `finally` block regardless of
+ * whether `fn` resolves or rejects.
+ */
+async function withFilteredPostjectStderr<T>(fn: () => Promise<T>): Promise<T> {
+  const original: StderrWrite = process.stderr.write;
+  const bound: StderrWrite = original.bind(process.stderr);
+  const filtered = ((
+    chunk: string | Uint8Array,
+    encodingOrCb?: BufferEncoding | WriteCallback,
+    cb?: WriteCallback,
+  ): boolean => {
+    const text =
+      typeof chunk === 'string'
+        ? chunk
+        : Buffer.isBuffer(chunk)
+          ? chunk.toString('utf8')
+          : Buffer.from(chunk).toString('utf8');
+    if (BENIGN_POSTJECT_STDERR.test(text)) {
+      const callback = typeof encodingOrCb === 'function' ? encodingOrCb : cb;
+      if (callback) process.nextTick(callback);
+      return true;
+    }
+    // The write() overloads accept either an encoding or a callback in
+    // slot 2; disambiguate here so the correct overload is dispatched.
+    return typeof encodingOrCb === 'function'
+      ? bound(chunk, encodingOrCb)
+      : bound(chunk, encodingOrCb, cb);
+  }) as StderrWrite;
+  process.stderr.write = filtered;
+  try {
+    return await fn();
+  } finally {
+    process.stderr.write = original;
+  }
+}
+
 export type GetNodejsExecutableOptions = {
   useLocalNode?: boolean;
   nodePath?: string;
@@ -398,11 +459,13 @@ async function bake(
   // This avoids two CI issues:
   // 1. "Text file busy" race condition from concurrent npx invocations
   // 2. "Argument is not a constructor" from npx downloading incompatible versions
-  await postjectInject(outPath, 'NODE_SEA_BLOB', blobData, {
-    sentinelFuse: SEA_SENTINEL_FUSE,
-    machoSegmentName: target.platform === 'macos' ? 'NODE_SEA' : undefined,
-    overwrite: true,
-  });
+  await withFilteredPostjectStderr(() =>
+    postjectInject(outPath, 'NODE_SEA_BLOB', blobData, {
+      sentinelFuse: SEA_SENTINEL_FUSE,
+      machoSegmentName: target.platform === 'macos' ? 'NODE_SEA' : undefined,
+      overwrite: true,
+    }),
+  );
 }
 
 /**