README.md

@@ -32,6 +32,15 @@ sudo apt-get update && sudo apt-get install stoke
 
 Upgrades then arrive through regular `apt-get upgrade`.
 
+The package depends on `nodejs (>= 22.12)`, which the distro archives of Debian 13 (Node 20) and Ubuntu 24.04 (Node 18) cannot satisfy. `install-apt.sh` handles this automatically by adding the [NodeSource](https://deb.nodesource.com) Node 22 repository when no configured apt source offers a new-enough nodejs. If you follow the manual steps instead, make sure such a source is available before `apt-get install stoke`:
+
+```bash
+curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+  | sudo tee /etc/apt/keyrings/nodesource.asc >/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/nodesource.asc] https://deb.nodesource.com/node_22.x nodistro main" \
+  | sudo tee /etc/apt/sources.list.d/nodesource.list
+```
+
 Note: apt releases that verify OpenPGP with `sqv` (Debian 13+, apt >= 2.9) currently reject the signature Forgejo generates for its Debian registry (an upstream signing bug). `install-apt.sh` detects this and falls back to a `[trusted=yes]` source — integrity then relies on HTTPS to the forge. The script prefers the signed source, so setups heal automatically once the forge is fixed.
 
 As a fallback, each release also has the `.deb` attached for direct install: `sudo dpkg -i stoke_<version>_all.deb`.

scripts/install-apt.sh

@@ -28,13 +28,38 @@ if [ "$(id -u)" -ne 0 ]; then
   SUDO="sudo"
 fi
 
-update_only_this_source() {
+update_only_source() {
   $SUDO apt-get update \
-    -o Dir::Etc::sourcelist="$LIST" \
+    -o Dir::Etc::sourcelist="$1" \
     -o Dir::Etc::sourceparts=/dev/null \
     -o APT::Get::List-Cleanup=0
 }
 
+# stoke needs Node.js >= 22.12 (commander 15), but the distro archives of
+# Debian 13 (nodejs 20.x) and Ubuntu 24.04 (nodejs 18.x) cannot satisfy
+# that, which would make `apt-get install stoke` fail with an unmet
+# dependency. When no configured source offers a new-enough nodejs, add the
+# NodeSource repository for Node 22 so the dependency resolves.
+NODE_MIN="22.12"
+node_candidate_ok() {
+  local candidate
+  candidate="$(apt-cache policy nodejs 2>/dev/null | sed -n 's/^  Candidate: //p')"
+  [ -n "$candidate" ] && [ "$candidate" != "(none)" ] || return 1
+  dpkg --compare-versions "${candidate#*:}" ge "$NODE_MIN"
+}
+
+ensure_nodejs_source() {
+  node_candidate_ok && return 0
+  echo "No apt source provides nodejs >= $NODE_MIN; adding NodeSource (Node 22) ..."
+  local ns_keyring="/etc/apt/keyrings/nodesource.asc"
+  local ns_list="/etc/apt/sources.list.d/nodesource.list"
+  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | $SUDO tee "$ns_keyring" >/dev/null
+  echo "deb [signed-by=$ns_keyring] https://deb.nodesource.com/node_22.x nodistro main" \
+    | $SUDO tee "$ns_list" >/dev/null
+  update_only_source "$ns_list"
+  node_candidate_ok || { echo "error: still no nodejs >= $NODE_MIN available after adding NodeSource" >&2; exit 1; }
+}
+
 echo "Adding APT source for $FORGE_URL/$OWNER ..."
 $SUDO install -d -m 0755 /etc/apt/keyrings
 curl -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
@@ -46,7 +71,7 @@ echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTI
 # in the upstream signing library). Try the properly signed source first so
 # this heals automatically once the forge is fixed; otherwise fall back to
 # [trusted=yes] — package integrity then relies on HTTPS to our own forge.
-if ! update_only_this_source; then
+if ! update_only_source "$LIST"; then
   echo
   echo "WARNING: signature verification failed (known Forgejo registry issue" >&2
   echo "with sqv-based apt). Falling back to [trusted=yes]; transport" >&2
@@ -54,9 +79,11 @@ if ! update_only_this_source; then
   echo
   echo "deb [trusted=yes] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
     | $SUDO tee "$LIST" >/dev/null
-  update_only_this_source
+  update_only_source "$LIST"
 fi
 
+ensure_nodejs_source
+
 $SUDO apt-get install -y stoke
 
 echo