49a4c97923
The feed publisher overwrote whatever version-specific assets it found, so a re-run of an old release tag could quietly replace the installer that customers already downloaded under that version number. Publication now compares the bytes already in the version-specific registry path and stops when they differ, while still allowing an identical re-run to finish. The metadata verifier gained a negative case so the guard cannot be removed unnoticed.
390 lines
16 KiB
JavaScript
390 lines
16 KiB
JavaScript
import { existsSync, readFileSync } from 'node:fs'
|
|
import { createHash, createPublicKey } from 'node:crypto'
|
|
import { dirname, join } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
|
|
const root = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
|
|
// canonical updater feed: Forgejo Generic Package Registry
|
|
const CANONICAL_UPDATE_FEED =
|
|
'https://git.chanpaca.net/api/packages/yunchan/generic/d3ro-voice/latest'
|
|
// legacy mirror: GitLab Generic Registry (pre-Forgejo installs still poll this)
|
|
const LEGACY_UPDATE_FEED =
|
|
'https://gitlab.twentyoz.kr:8443/api/v4/projects/1172/packages/generic/d3ro-voice/latest'
|
|
|
|
function read(path) {
|
|
return readFileSync(join(root, path), 'utf8')
|
|
}
|
|
|
|
function loadSurfaces(readSurface = read) {
|
|
return {
|
|
metadata: JSON.parse(readSurface('release/product-version.json')),
|
|
updatePolicy: JSON.parse(readSurface('release/update-policy.json')),
|
|
androidIdentity: JSON.parse(readSurface('release/android-release-identity.json')),
|
|
releaseEvidencePublicKey: readSurface('release/mobile-release-evidence-public.pem'),
|
|
desktopLicensePublicKey: readSurface('apps/desktop/resources/license/production-public.pem'),
|
|
rootPackage: JSON.parse(readSurface('package.json')),
|
|
desktopPackage: JSON.parse(readSurface('apps/desktop/package.json')),
|
|
rootLock: JSON.parse(readSurface('package-lock.json')),
|
|
builder: readSurface('apps/desktop/electron-builder.yml'),
|
|
electronVite: readSurface('apps/desktop/electron.vite.config.ts'),
|
|
updateFeed: readSurface('apps/desktop/src/main/update-feed.ts'),
|
|
updatePolicySource: readSurface('apps/desktop/src/main/update-policy.ts'),
|
|
updateService: readSurface('apps/desktop/src/main/services/UpdateService.ts'),
|
|
publisher: readSurface('scripts/ci/publish-gitlab-release.mjs'),
|
|
forgejoPublisher: readSurface('scripts/ci/publish-forgejo-release.mjs'),
|
|
gitlab: readSurface('.gitlab-ci.yml'),
|
|
github: readSurface('.github/workflows/release.yml'),
|
|
githubMac: readSurface('.github/workflows/build-mac.yml'),
|
|
githubSigning: readSurface('.github/workflows/release-signing-ca.yml'),
|
|
forgejoLinux: readSurface('.forgejo/workflows/deploy-site.yml'),
|
|
forgejoWindows: readSurface('.forgejo/workflows/deploy-site-windows.yml'),
|
|
forgejoRelease: readSurface('.forgejo/workflows/release.yml'),
|
|
changelog: readSurface('CHANGELOG.md'),
|
|
}
|
|
}
|
|
|
|
function validate(surfaces) {
|
|
const errors = []
|
|
const { metadata } = surfaces
|
|
const fail = (condition, code) => {
|
|
if (!condition) errors.push(code)
|
|
}
|
|
|
|
fail(/^\d+\.\d+\.\d+$/.test(metadata.version), 'metadata_version_not_stable_semver')
|
|
fail(surfaces.androidIdentity.packageName === 'com.d3ro.voice', 'android_package_identity_drift')
|
|
fail(/^\d+$/.test(surfaces.androidIdentity.playConsoleAppId), 'play_console_app_id_invalid')
|
|
fail(
|
|
/^([0-9A-F]{2}:){31}[0-9A-F]{2}$/.test(surfaces.androidIdentity.playAppSigningCertificateSha256),
|
|
'play_app_signing_certificate_invalid',
|
|
)
|
|
fail(
|
|
/^([0-9A-F]{2}:){31}[0-9A-F]{2}$/.test(surfaces.androidIdentity.uploadCertificateSha256),
|
|
'upload_certificate_invalid',
|
|
)
|
|
fail(
|
|
surfaces.androidIdentity.playAppSigningCertificateSha256 !== surfaces.androidIdentity.uploadCertificateSha256,
|
|
'play_and_upload_certificates_equal',
|
|
)
|
|
let evidenceKeyId = null
|
|
try {
|
|
const key = createPublicKey(surfaces.releaseEvidencePublicKey)
|
|
fail(key.asymmetricKeyType === 'ed25519', 'release_evidence_public_key_not_ed25519')
|
|
evidenceKeyId = createHash('sha256')
|
|
.update(key.export({ type: 'spki', format: 'der' }))
|
|
.digest('hex')
|
|
} catch {
|
|
errors.push('release_evidence_public_key_invalid')
|
|
}
|
|
fail(evidenceKeyId === surfaces.androidIdentity.releaseEvidenceKeyId, 'release_evidence_key_id_drift')
|
|
let desktopLicenseKeyId = null
|
|
try {
|
|
const key = createPublicKey(surfaces.desktopLicensePublicKey)
|
|
fail(key.asymmetricKeyType === 'ed25519', 'desktop_license_public_key_not_ed25519')
|
|
desktopLicenseKeyId = createHash('sha256')
|
|
.update(key.export({ type: 'spki', format: 'der' }))
|
|
.digest('hex')
|
|
} catch {
|
|
errors.push('desktop_license_public_key_invalid')
|
|
}
|
|
fail(
|
|
desktopLicenseKeyId === metadata.desktopLicensePublicKeyId,
|
|
'desktop_license_public_key_id_drift',
|
|
)
|
|
fail(
|
|
surfaces.electronVite.includes("resources/license/production-public.pem"),
|
|
'desktop_license_public_key_build_input_missing',
|
|
)
|
|
fail(
|
|
surfaces.electronVite.includes("asymmetricKeyType !== 'ed25519'"),
|
|
'desktop_license_public_key_build_validation_missing',
|
|
)
|
|
fail(
|
|
/^ca-app-pub-\d{16}~\d{10}$/.test(surfaces.androidIdentity.adMobAppId),
|
|
'admob_app_id_invalid',
|
|
)
|
|
fail(
|
|
/^ca-app-pub-\d{16}\/\d{10}$/.test(surfaces.androidIdentity.adMobBannerUnitId),
|
|
'admob_banner_unit_id_invalid',
|
|
)
|
|
fail(
|
|
/^ca-app-pub-\d{16}\/\d{10}$/.test(surfaces.androidIdentity.adMobRewardedUnitId),
|
|
'admob_rewarded_unit_id_invalid',
|
|
)
|
|
const adMobPublisher = surfaces.androidIdentity.adMobAppId.match(/^ca-app-pub-(\d+)~/)?.[1]
|
|
fail(
|
|
surfaces.androidIdentity.adMobBannerUnitId.startsWith(`ca-app-pub-${adMobPublisher}/`)
|
|
&& surfaces.androidIdentity.adMobRewardedUnitId.startsWith(`ca-app-pub-${adMobPublisher}/`),
|
|
'admob_publisher_drift',
|
|
)
|
|
fail(surfaces.rootPackage.version === metadata.version, 'root_package_version_drift')
|
|
fail(surfaces.desktopPackage.version === metadata.version, 'desktop_package_version_drift')
|
|
fail(
|
|
new RegExp(`^## \\[${escapeRegExp(metadata.version)}\\] - ${escapeRegExp(metadata.releaseDate)}$`, 'm')
|
|
.test(surfaces.changelog),
|
|
'changelog_release_section_missing',
|
|
)
|
|
|
|
const electronVersion = surfaces.desktopPackage.devDependencies?.electron
|
|
const lockedElectron = surfaces.rootLock.packages?.['node_modules/electron']?.version
|
|
const builderElectron = surfaces.builder.match(/^electronVersion:\s*["']?([^"'\s]+)["']?$/m)?.[1]
|
|
fail(electronVersion === lockedElectron, 'electron_package_lock_drift')
|
|
fail(builderElectron === lockedElectron, 'electron_builder_lock_drift')
|
|
|
|
// ── canonical feed contract: runtime == builder == Forgejo canonical ──
|
|
const sourceFeed = surfaces.updateFeed.match(/UPDATE_FEED_URL\s*=\s*\n?\s*['"]([^'"]+)['"]/)?.[1]
|
|
const legacyFeed = surfaces.updateFeed.match(/LEGACY_UPDATE_FEED_URL\s*=\s*\n?\s*['"]([^'"]+)['"]/)?.[1]
|
|
const builderFeed = surfaces.builder.match(/publish:\s*[\s\S]*?\n\s+url:\s*["']([^"']+)["']/)?.[1]
|
|
fail(sourceFeed === CANONICAL_UPDATE_FEED, 'desktop_runtime_update_feed_drift')
|
|
fail(builderFeed === CANONICAL_UPDATE_FEED, 'desktop_builder_update_feed_drift')
|
|
fail(!/\/releases\/\d+\.\d+\.\d+/.test(sourceFeed ?? ''), 'desktop_update_feed_version_pinned')
|
|
fail(legacyFeed === LEGACY_UPDATE_FEED, 'desktop_legacy_mirror_feed_missing')
|
|
|
|
// ── update policy SSOT ──
|
|
const policy = surfaces.updatePolicy
|
|
fail(policy?.schemaVersion === 1, 'update_policy_schema_invalid')
|
|
fail(
|
|
['latest', 'beta', 'alpha'].every((channel) => typeof policy?.channels?.[channel]?.allowPrerelease === 'boolean'),
|
|
'update_policy_channels_missing',
|
|
)
|
|
fail(
|
|
['latest', 'beta', 'alpha'].includes(policy?.defaultChannel),
|
|
'update_policy_default_channel_invalid',
|
|
)
|
|
fail(/^\d+\.\d+\.\d+$/.test(policy?.minimumSupportedVersion ?? ''), 'update_policy_minimum_invalid')
|
|
fail(
|
|
policy?.forceInstallBelow === null || /^\d+\.\d+\.\d+$/.test(policy?.forceInstallBelow ?? ''),
|
|
'update_policy_force_install_invalid',
|
|
)
|
|
fail(typeof policy?.fullInstallOnMajorChange === 'boolean', 'update_policy_major_policy_missing')
|
|
fail(
|
|
Number.isSafeInteger(policy?.fullInstallVersionGap) && policy.fullInstallVersionGap >= 0,
|
|
'update_policy_version_gap_invalid',
|
|
)
|
|
fail(
|
|
Number.isSafeInteger(policy?.stagingPercentage) && policy.stagingPercentage >= 0 && policy.stagingPercentage <= 100,
|
|
'update_policy_staging_invalid',
|
|
)
|
|
fail(typeof policy?.killSwitch === 'boolean', 'update_policy_kill_switch_missing')
|
|
fail(
|
|
surfaces.updatePolicySource.includes('decideUpdate') &&
|
|
surfaces.updatePolicySource.includes('fullInstallVersionGap') &&
|
|
surfaces.updatePolicySource.includes('isWithinRollout'),
|
|
'update_policy_runtime_logic_missing',
|
|
)
|
|
fail(
|
|
surfaces.updateService.includes('decideUpdate') &&
|
|
surfaces.updateService.includes('isWithinRollout') &&
|
|
/\bkillSwitch\b/.test(surfaces.updateService),
|
|
'update_service_policy_enforcement_missing',
|
|
)
|
|
fail(
|
|
surfaces.updateService.includes('disableDifferentialDownload'),
|
|
'update_service_differential_control_missing',
|
|
)
|
|
|
|
// ── legacy GitLab publisher (mirror) ──
|
|
fail(surfaces.publisher.includes('const latestFiles = [...sortedFiles].sort'), 'publisher_asset_first_order_missing')
|
|
fail(!surfaces.publisher.includes('deletePackagesForVersion("latest")'), 'publisher_deletes_live_feed_first')
|
|
fail(surfaces.publisher.includes('verifyPublicLatestFile'), 'publisher_public_metadata_verification_missing')
|
|
fail(surfaces.publisher.includes('release/product-version.json'), 'publisher_product_version_gate_missing')
|
|
|
|
// ── canonical Forgejo publisher contract ──
|
|
fail(!/1\.0\.0/.test(surfaces.forgejoPublisher), 'forgejo_publisher_hardcoded_version')
|
|
fail(surfaces.forgejoPublisher.includes('release/product-version.json'), 'forgejo_publisher_version_gate_missing')
|
|
fail(surfaces.forgejoPublisher.includes('const latestOrder'), 'forgejo_publisher_asset_first_order_missing')
|
|
fail(surfaces.forgejoPublisher.includes('validateUpdateMetadataReferences'), 'forgejo_publisher_metadata_reference_check_missing')
|
|
fail(surfaces.forgejoPublisher.includes('verifyPublicFile'), 'forgejo_publisher_public_verification_missing')
|
|
fail(surfaces.forgejoPublisher.includes('update-policy.json'), 'forgejo_publisher_policy_upload_missing')
|
|
fail(surfaces.forgejoPublisher.includes('CHANGELOG.md'), 'forgejo_publisher_changelog_gate_missing')
|
|
fail(
|
|
surfaces.forgejoPublisher.includes('assertVersionNotRepublished'),
|
|
'forgejo_publisher_rerelease_guard_missing',
|
|
)
|
|
fail(
|
|
surfaces.forgejoPublisher.includes('/api/packages/') &&
|
|
surfaces.forgejoPublisher.includes('generic'),
|
|
'forgejo_publisher_registry_path_missing',
|
|
)
|
|
|
|
for (const [name, workflow] of [
|
|
['gitlab', surfaces.gitlab],
|
|
['github', surfaces.github],
|
|
]) {
|
|
fail(workflow.includes('sync-version.mjs'), `${name}_version_gate_missing`)
|
|
fail(workflow.includes('release/product-version.json'), `${name}_product_metadata_missing`)
|
|
fail(!workflow.includes('1000000 + CI_PIPELINE_IID'), `${name}_pipeline_counter_version_code`)
|
|
fail(!workflow.includes('1000000 + GITHUB_RUN_NUMBER'), `${name}_run_counter_version_code`)
|
|
fail(workflow.includes('publish-forgejo-release.mjs'), `${name}_forgejo_publish_missing`)
|
|
}
|
|
|
|
fail(surfaces.forgejoRelease.includes('publish-forgejo-release.mjs'), 'forgejo_release_workflow_publish_missing')
|
|
fail(/tags:/.test(surfaces.forgejoRelease), 'forgejo_release_workflow_tag_trigger_missing')
|
|
fail(surfaces.forgejoRelease.includes('sync-version.mjs'), 'forgejo_release_workflow_version_gate_missing')
|
|
|
|
fail(!/push:\s*\n\s*tags:/m.test(surfaces.githubMac), 'legacy_mac_tag_trigger_enabled')
|
|
fail(!/push:\s*\n\s*tags:/m.test(surfaces.githubSigning), 'legacy_signing_tag_trigger_enabled')
|
|
fail(!surfaces.forgejoLinux.includes('sync-and-publish-forgejo-release'), 'forgejo_linux_legacy_release_sync')
|
|
fail(!surfaces.forgejoWindows.includes('sync-and-publish-forgejo-release'), 'forgejo_windows_legacy_release_sync')
|
|
fail(!existsSync(join(root, 'apps/mobile-rn/src/lib/update-manager.ts')), 'unsafe_mobile_update_manager_present')
|
|
fail(
|
|
existsSync(join(root, `apps/mobile-rn/metadata/android/ko-KR/changelogs/${metadata.androidVersionCode}.txt`)),
|
|
'play_korean_whats_new_missing',
|
|
)
|
|
fail(
|
|
existsSync(join(root, `apps/mobile-rn/metadata/android/en-US/changelogs/${metadata.androidVersionCode}.txt`)),
|
|
'play_english_whats_new_missing',
|
|
)
|
|
|
|
if (errors.length > 0) throw new Error(`release_metadata_invalid:${errors.join(',')}`)
|
|
return {
|
|
ok: true,
|
|
version: metadata.version,
|
|
androidVersionCode: metadata.androidVersionCode,
|
|
iosBuildNumber: metadata.iosBuildNumber,
|
|
updateFeed: sourceFeed,
|
|
legacyUpdateFeed: legacyFeed,
|
|
updateChannel: policy.defaultChannel,
|
|
minimumSupportedVersion: policy.minimumSupportedVersion,
|
|
electronVersion: lockedElectron,
|
|
releaseEvidenceKeyId: evidenceKeyId,
|
|
desktopLicensePublicKeyId: desktopLicenseKeyId,
|
|
}
|
|
}
|
|
|
|
function expectRejected(surfaces, mutate, expectedCode) {
|
|
const candidate = structuredClone(surfaces)
|
|
mutate(candidate)
|
|
try {
|
|
validate(candidate)
|
|
} catch (error) {
|
|
if (error instanceof Error && error.message.includes(expectedCode)) return
|
|
throw error
|
|
}
|
|
throw new Error(`release_metadata_self_test_failed:${expectedCode}`)
|
|
}
|
|
|
|
function escapeRegExp(value) {
|
|
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
|
|
}
|
|
|
|
const surfaces = loadSurfaces()
|
|
const result = validate(surfaces)
|
|
|
|
if (process.argv.includes('--self-test')) {
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.updateFeed = candidate.updateFeed.replace(CANONICAL_UPDATE_FEED, 'https://example.invalid/releases/1.1.0')
|
|
},
|
|
'desktop_runtime_update_feed_drift',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.updateFeed = candidate.updateFeed.replace(LEGACY_UPDATE_FEED, 'https://example.invalid/legacy')
|
|
},
|
|
'desktop_legacy_mirror_feed_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.updatePolicy.minimumSupportedVersion = 'not-semver'
|
|
},
|
|
'update_policy_minimum_invalid',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.updatePolicy.stagingPercentage = 140
|
|
},
|
|
'update_policy_staging_invalid',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.forgejoPublisher = 'console.log("1.0.0 is hardcoded")'
|
|
},
|
|
'forgejo_publisher_hardcoded_version',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.forgejoPublisher = candidate.forgejoPublisher.replace('const latestOrder', 'const uploadOrder')
|
|
},
|
|
'forgejo_publisher_asset_first_order_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.forgejoPublisher = candidate.forgejoPublisher.replaceAll('assertVersionNotRepublished', 'uploadAnyway')
|
|
},
|
|
'forgejo_publisher_rerelease_guard_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.gitlab = candidate.gitlab.replace('publish-forgejo-release.mjs', 'publish-gitlab-release.mjs')
|
|
},
|
|
'gitlab_forgejo_publish_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.forgejoRelease = candidate.forgejoRelease.replace('tags:', 'branches:')
|
|
},
|
|
'forgejo_release_workflow_tag_trigger_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.gitlab = `${candidate.gitlab}\nVERSION_CODE="$((1000000 + CI_PIPELINE_IID))"\n`
|
|
},
|
|
'gitlab_pipeline_counter_version_code',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.publisher = candidate.publisher.replace('const latestFiles = [...sortedFiles].sort', 'const latestFiles = sortedFiles.sort')
|
|
},
|
|
'publisher_asset_first_order_missing',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.desktopLicensePublicKey = 'not-a-public-key'
|
|
},
|
|
'desktop_license_public_key_invalid',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.metadata.desktopLicensePublicKeyId = '0'.repeat(64)
|
|
},
|
|
'desktop_license_public_key_id_drift',
|
|
)
|
|
expectRejected(
|
|
surfaces,
|
|
(candidate) => {
|
|
candidate.updateService = candidate.updateService.replaceAll('killSwitch', 'killSwitchDisabled')
|
|
},
|
|
'update_service_policy_enforcement_missing',
|
|
)
|
|
let missingDesktopKeyRejected = false
|
|
try {
|
|
loadSurfaces((path) => {
|
|
if (path === 'apps/desktop/resources/license/production-public.pem') {
|
|
throw new Error('desktop_license_public_key_missing')
|
|
}
|
|
return read(path)
|
|
})
|
|
} catch (error) {
|
|
missingDesktopKeyRejected =
|
|
error instanceof Error && error.message.includes('desktop_license_public_key_missing')
|
|
}
|
|
if (!missingDesktopKeyRejected) {
|
|
throw new Error('release_metadata_self_test_failed:desktop_license_public_key_missing')
|
|
}
|
|
result.negativeCases = 14
|
|
}
|
|
|
|
process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
|