[pull] master from gchq:master

.github/workflows/cla-close-stale.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Close stale unsigned-CLA PRs
-        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 #v10.4.0
+        uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 #v11.0.0
         with:
           # ---- Guards: only act on PRs carrying the CLA label ----
           only-labels: 'awaiting cla'

.github/workflows/releases.yml

@@ -77,7 +77,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Log in to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.REGISTRY_USER }}

Gruntfile.js

@@ -1,10 +1,13 @@
 "use strict";
 
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
 const webpack = require("webpack");
 const HtmlWebpackPlugin = require("html-webpack-plugin");
 const BundleAnalyzerPlugin = require("webpack-bundle-analyzer").BundleAnalyzerPlugin;
 const glob = require("glob");
-const path = require("path");
 
 const nodeFlags = "--no-warnings --no-deprecation";
 
@@ -29,7 +32,7 @@ module.exports = function (grunt) {
         "Creates a production-ready build. Use the --msg flag to add a compile message.",
         [
             "eslint", "clean:prod", "clean:config", "exec:generateConfig", "findModules", "webpack:web",
-            "copy:standalone", "zip:standalone", "clean:standalone", "exec:calcDownloadHash", "chmod"
+            "copy:standalone", "zip:standalone", "clean:standalone", "calcDownloadHash", "chmod"
         ]);
 
     grunt.registerTask("node",
@@ -60,7 +63,7 @@ module.exports = function (grunt) {
 
     grunt.registerTask("findModules",
         "Finds all generated modules and updates the entry point list for Webpack",
-        function(arg1, arg2) {
+        function (arg1, arg2) {
             const moduleEntryPoints = listEntryModules();
 
             grunt.log.writeln(`Found ${Object.keys(moduleEntryPoints).length} modules.`);
@@ -71,6 +74,26 @@ module.exports = function (grunt) {
                 }, moduleEntryPoints));
         });
 
+    grunt.registerTask("calcDownloadHash", "Compute download hash", function () {
+        const done = this.async();
+
+        const hash = crypto.createHash("sha256");
+
+        // Use online algorithm to calculate hash, prevents reading the entire 75+ MB zip file into memory
+        fs.createReadStream(`build/prod/${downloadZipFilename}`)
+            .on("data", (chunk) => hash.update(chunk))
+            .on("end", () => {
+                const digest = hash.digest("hex");
+                fs.writeFileSync("build/prod/sha256digest.txt", `${digest}\n`, { encoding: "utf8" });
+
+                const index = fs.readFileSync("build/prod/index.html", { encoding: "utf8" });
+                fs.writeFileSync("build/prod/index.html", index.replace(/DOWNLOAD_HASH_PLACEHOLDER/g, digest), { encoding: "utf8" });
+
+                done(true);
+            })
+            .on("error", (err) => done(false));
+    });
+
 
     // Load tasks provided by each plugin
     grunt.loadNpmTasks("grunt-eslint");
@@ -114,7 +137,7 @@ module.exports = function (grunt) {
                 output: {
                     path: __dirname + "/build/prod",
                     filename: chunkData => {
-                        return chunkData.chunk.name === "main" ? "assets/[name].js": "[name].js";
+                        return chunkData.chunk.name === "main" ? "assets/[name].js" : "[name].js";
                     },
                     globalObject: "this"
                 },
@@ -333,22 +356,6 @@ module.exports = function (grunt) {
             }
         },
         exec: {
-            calcDownloadHash: {
-                command: function () {
-                    switch (process.platform) {
-                        case "darwin":
-                            return chainCommands([
-                                `shasum -a 256 build/prod/${downloadZipFilename} | awk '{print $1;}' > build/prod/sha256digest.txt`,
-                                `sed -i '' -e "s/DOWNLOAD_HASH_PLACEHOLDER/$(cat build/prod/sha256digest.txt)/" build/prod/index.html`
-                            ]);
-                        default:
-                            return chainCommands([
-                                `sha256sum build/prod/${downloadZipFilename} | awk '{print $1;}' > build/prod/sha256digest.txt`,
-                                `sed -i -e "s/DOWNLOAD_HASH_PLACEHOLDER/$(cat build/prod/sha256digest.txt)/" build/prod/index.html`
-                            ]);
-                    }
-                },
-            },
             repoSize: {
                 command: chainCommands([
                     "git ls-files | wc -l | xargs printf '\n%b\ttracked files\n'",