PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

feat(KAN-65): add signed macOS updates and DMG distribution
CI/CD / preconditions (pull_request) Successful in 2s
Details
Native JavaScript checks / Native launcher and release tests (pull_request) Successful in 1m0s
Details
CI/CD / test_and_check_app (pull_request) Successful in 7m2s
Details
CI/CD / Publish immutable image (pull_request) Skipped
Details
macOS checks / Native Rust tests and unsigned build (pull_request) Successful in 1m35s
Details

Browse Source
This commit is contained in:
Twyco
2026-09-27 21:40:23 +02:00
parent 3e5c316b8f
commit 20f9314659
28 changed files with 2454 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files
native/publish-macos.mjs
+121 -4
View File
@@ -13,6 +13,12 @@ import process from 'node:process';
import { setTimeout } from 'node:timers/promises';
import { pathToFileURL } from 'node:url';
import { execute, releaseMetadata } from './macos-ci.mjs';
import {
compareVersions,
updateManifest,
updateSource,
verifyUpdateSignature,
} from './update-manifest.mjs';
export function storageConfiguration(env = process.env) {
const region = env.S3_REGION;
@@ -64,8 +70,15 @@ export async function publishMacos({
run = execute,
fetchPublic = fetch,
wait = setTimeout,
publicKey = updateSource.publicKey,
feedBase = updateSource.baseUrl,
} = {}) {
const storage = storageConfiguration(env);
if (`${storage.publicBase}/${storage.prefix}` !== feedBase) {
throw new Error(
'Release storage does not match the update source bundled in the app.',
);
}
if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
throw new Error(
'Set the dedicated S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY release secrets.',
@@ -79,6 +92,21 @@ export async function publishMacos({
if (checksumFile.toString() !== `${checksum} ${metadata.filename}\n`) {
throw new Error('Release archive does not match its SHA-256 file.');
}
const updater = readFileSync(join(directory, metadata.updaterFilename));
const signature = readFileSync(
join(directory, `${metadata.updaterFilename}.sig`),
'utf8',
);
verifyUpdateSignature(updater, signature, publicKey);
const updateChecksum = readFileSync(
join(directory, `${metadata.updaterFilename}.sha256`),
);
if (
updateChecksum.toString() !==
`${sha256(updater)} ${metadata.updaterFilename}\n`
) {
throw new Error('Updater archive does not match its SHA-256 file.');
}
const common = [
'--endpoint-url',
storage.endpoint,
@@ -124,11 +152,11 @@ export async function publishMacos({
const staging = mkdtempSync(join(tmpdir(), 'kanbangit-s3-'));
const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
async function verifyPublic(name, contents) {
async function verifyPublic(name, contents, prefix = publicPrefix) {
for (let attempt = 1; attempt <= 5; attempt++) {
let response;
try {
response = await fetchPublic(`${publicPrefix}/${name}`, {
response = await fetchPublic(`${prefix}/${name}`, {
redirect: 'error',
signal: AbortSignal.timeout(60000),
});
@@ -199,7 +227,18 @@ export async function publishMacos({
}
try {
const files = [
[metadata.filename, archive, 'application/zip'],
[metadata.filename, archive, 'application/x-apple-diskimage'],
[metadata.updaterFilename, updater, 'application/gzip'],
[
`${metadata.updaterFilename}.sig`,
Buffer.from(signature),
'text/plain; charset=utf-8',
],
[
`${metadata.updaterFilename}.sha256`,
updateChecksum,
'text/plain; charset=utf-8',
],
[
`${metadata.filename}.sha256`,
checksumFile,
@@ -210,7 +249,7 @@ export async function publishMacos({
putImmutable(name, contents, type);
await verifyPublic(name, contents);
}
// This completion record is written only after both public downloads match.
// Completion metadata is written only after every public artifact matches.
const manifest = Buffer.from(
JSON.stringify(
{
@@ -226,6 +265,84 @@ export async function publishMacos({
);
putImmutable('release.json', manifest, 'application/json');
await verifyPublic('release.json', manifest);
const latest = Buffer.from(
JSON.stringify(
updateManifest(
metadata,
publicPrefix,
signature,
metadata.notes,
),
null,
2,
) + '\n',
);
putImmutable('update.json', latest, 'application/json');
await verifyPublic('update.json', latest);
const latestPrefix = `${storage.prefix}/${metadata.target}`;
const latestKey = `${latestPrefix}/latest.json`;
const latestFile = join(staging, 'latest.json');
writeFileSync(latestFile, latest);
function publishLatest(condition) {
s3('put-object', [
'--key',
latestKey,
'--body',
latestFile,
...condition,
'--content-type',
'application/json',
'--cache-control',
'no-cache, max-age=0, must-revalidate',
'--content-md5',
createHash('md5').update(latest).digest('base64'),
]);
}
try {
publishLatest(['--if-none-match', '*']);
} catch (error) {
if (!/\(PreconditionFailed\)|\(412\)/.test(error.message)) {
throw error;
}
const previousFile = join(staging, 'previous-latest.json');
const response = JSON.parse(
s3('get-object', [
'--key',
latestKey,
'--output',
'json',
previousFile,
]),
);
const previousBytes = readFileSync(previousFile);
const previous = JSON.parse(previousBytes);
const comparison = compareVersions(
metadata.version,
previous.version,
);
if (comparison < 0) {
throw new Error('Refusing to downgrade the update feed.');
}
if (comparison === 0) {
if (!previousBytes.equals(latest)) {
throw new Error(
'Published update metadata differs; bump the app version.',
);
}
} else {
if (!response.ETag) {
throw new Error(
'Cannot atomically update the feed without its ETag.',
);
}
publishLatest(['--if-match', response.ETag]);
}
}
await verifyPublic(
'latest.json',
latest,
`${storage.publicBase}/${latestPrefix}`,
);
return `${publicPrefix}/${metadata.filename}`;
} finally {
rmSync(staging, { recursive: true, force: true });