install-apt: bootstrap Node 22 via NodeSource when distro nodejs is too old (#1)

The package depends on nodejs (>= 22.12), but Debian 13 ships Node 20 and
Ubuntu 24.04 ships Node 18, so a fresh container failed apt-get install
with an unmet dependency. install-apt.sh now checks whether any configured
apt source can satisfy the requirement and, if not, adds the NodeSource
Node 22 repository before installing. README documents the behaviour and
the manual equivalent.

Verified on fresh debian:13 and ubuntu:24.04 containers: one-line setup,
apt-get install stoke, stoke --version all succeed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -32,6 +32,15 @@ sudo apt-get update && sudo apt-get install stoke
 
 Upgrades then arrive through regular `apt-get upgrade`.
 
+The package depends on `nodejs (>= 22.12)`, which the distro archives of Debian 13 (Node 20) and Ubuntu 24.04 (Node 18) cannot satisfy. `install-apt.sh` handles this automatically by adding the [NodeSource](https://deb.nodesource.com) Node 22 repository when no configured apt source offers a new-enough nodejs. If you follow the manual steps instead, make sure such a source is available before `apt-get install stoke`:
+
+```bash
+curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+  | sudo tee /etc/apt/keyrings/nodesource.asc >/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_22.x nodistro main" \
+  | sudo tee /etc/apt/sources.list.d/nodesource.list
+```
+
 Note: apt releases that verify OpenPGP with `sqv` (Debian 13+, apt >= 2.9) currently reject the signature Forgejo generates for its Debian registry (an upstream signing bug). `install-apt.sh` detects this and falls back to a `[trusted=yes]` source — integrity then relies on HTTPS to the forge. The script prefers the signed source, so setups heal automatically once the forge is fixed.
 
 As a fallback, each release also has the `.deb` attached for direct install: `sudo dpkg -i stoke_<version>_all.deb`.

scripts/install-apt.sh

@@ -28,13 +28,38 @@ if [ "$(id -u)" -ne 0 ]; then
   SUDO="sudo"
 fi
 
-update_only_this_source() {
+update_only_source() {
   $SUDO apt-get update \
-    -o Dir::Etc::sourcelist="$LIST" \
+    -o Dir::Etc::sourcelist="$1" \
     -o Dir::Etc::sourceparts=/dev/null \
     -o APT::Get::List-Cleanup=0
 }
 
+# stoke needs Node.js >= 22.12 (commander 15), but the distro archives of
+# Debian 13 (nodejs 20.x) and Ubuntu 24.04 (nodejs 18.x) cannot satisfy
+# that, which would make `apt-get install stoke` fail with an unmet
+# dependency. When no configured source offers a new-enough nodejs, add the
+# NodeSource repository for Node 22 so the dependency resolves.
+NODE_MIN="22.12"
+node_candidate_ok() {
+  local candidate
+  candidate="$(apt-cache policy nodejs 2>/dev/null | sed -n 's/^  Candidate: //p')"
+  [ -n "$candidate" ] && [ "$candidate" != "(none)" ] || return 1
+  dpkg --compare-versions "${candidate#*:}" ge "$NODE_MIN"
+}
+
+ensure_nodejs_source() {
+  node_candidate_ok && return 0
+  echo "No apt source provides nodejs >= $NODE_MIN; adding NodeSource (Node 22) ..."
+  local ns_keyring="/etc/apt/keyrings/nodesource.asc"
+  local ns_list="/etc/apt/sources.list.d/nodesource.list"
+  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | $SUDO tee "$ns_keyring" >/dev/null
+  echo "deb [signed-by=$ns_keyring] https://deb.nodesource.com/node_22.x nodistro main" \
+    | $SUDO tee "$ns_list" >/dev/null
+  update_only_source "$ns_list"
+  node_candidate_ok || { echo "error: still no nodejs >= $NODE_MIN available after adding NodeSource" >&2; exit 1; }
+}
+
 echo "Adding APT source for $FORGE_URL/$OWNER ..."
 $SUDO install -d -m 0755 /etc/apt/keyrings
 curl -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
@@ -46,7 +71,7 @@ echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTI
 # in the upstream signing library). Try the properly signed source first so
 # this heals automatically once the forge is fixed; otherwise fall back to
 # [trusted=yes] — package integrity then relies on HTTPS to our own forge.
-if ! update_only_this_source; then
+if ! update_only_source "$LIST"; then
   echo
   echo "WARNING: signature verification failed (known Forgejo registry issue" >&2
   echo "with sqv-based apt). Falling back to [trusted=yes]; transport" >&2
@@ -54,9 +79,11 @@ if ! update_only_this_source; then
   echo
   echo "deb [trusted=yes] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
     | $SUDO tee "$LIST" >/dev/null
-  update_only_this_source
+  update_only_source "$LIST"
 fi
 
+ensure_nodejs_source
+
 $SUDO apt-get install -y stoke
 
 echo