bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

release: formalize HoloLake 0.5.0 numbered root

Browse source
This commit is contained in:
冰朔 2026-08-18 23:37:32 +08:00
commit 40b8c49324
10 changed files with 401 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
product-source/hololake-native-desktop/scripts/release-pipeline.test.mjs
View file

@ -3,6 +3,7 @@ import { readFileSync } from 'node:fs'
import test from 'node:test'
import {
materializeUpdaterPrivateKey,
validateCredentialEnvironment,
validateReleaseInput,
validateReleaseTrust,
@ -76,6 +77,25 @@ test('release pipeline requires updater signing, Developer ID and Apple notariza
}))
})
test('release pipeline materializes a protected updater key path only inside the build environment', () => {
const source = {
TAURI_SIGNING_PRIVATE_KEY_PATH: '/protected/hololake-updater.key',
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: 'provided-at-runtime',
}
const hydrated = materializeUpdaterPrivateKey(source, (file) => {
assert.equal(file, source.TAURI_SIGNING_PRIVATE_KEY_PATH)
return 'encrypted-private-key-material'
})
assert.equal(hydrated.TAURI_SIGNING_PRIVATE_KEY, 'encrypted-private-key-material')
assert.equal(source.TAURI_SIGNING_PRIVATE_KEY, undefined)
})
test('release pipeline verifies the updater signature against embedded product trust before broadcast', () => {
const source = readFileSync(new URL('./release-pipeline.mjs', import.meta.url), 'utf8')
assert.match(source, /--example',\s*'verify_updater_signature'/)
assert.match(source, /src-tauri\/release-trust\.json/)
})
test('Windows updater keeps signed installation but never claims the macOS rollback boundary', () => {
const source = readFileSync(new URL('../src-tauri/src/release_update.rs', import.meta.url), 'utf8')
assert.match(source, /SIGNED_PACKAGE_VERIFIED_INSTALLING_NO_LOCAL_ROLLBACK/)