release: formalize HoloLake 0.5.0 numbered root

product-source/hololake-native-desktop/src-tauri/examples/verify_updater_signature.rs

@@ -0,0 +1,48 @@
+use base64::{engine::general_purpose::STANDARD, Engine as _};
+use minisign_verify::{PublicKey, Signature};
+use serde_json::Value;
+use std::{env, fs, path::Path};
+
+fn decode_outer_base64(value: &str, label: &str) -> Result<String, String> {
+    let bytes = STANDARD
+        .decode(value.trim())
+        .map_err(|error| format!("{label}_BASE64_INVALID: {error}"))?;
+    String::from_utf8(bytes).map_err(|error| format!("{label}_UTF8_INVALID: {error}"))
+}
+
+fn main() -> Result<(), String> {
+    let arguments: Vec<String> = env::args().collect();
+    let [_, trust_path, updater_path, signature_path] = arguments.as_slice() else {
+        return Err(
+            "USAGE: verify_updater_signature <release-trust.json> <updater> <signature>"
+                .to_string(),
+        );
+    };
+    let trust: Value = serde_json::from_str(
+        &fs::read_to_string(trust_path)
+            .map_err(|error| format!("RELEASE_TRUST_READ_FAILED: {error}"))?,
+    )
+    .map_err(|error| format!("RELEASE_TRUST_JSON_INVALID: {error}"))?;
+    let encoded_public_key = trust
+        .get("publicKey")
+        .and_then(Value::as_str)
+        .ok_or_else(|| "RELEASE_TRUST_PUBLIC_KEY_MISSING".to_string())?;
+    let public_key = PublicKey::decode(&decode_outer_base64(
+        encoded_public_key,
+        "RELEASE_TRUST_PUBLIC_KEY",
+    )?)
+    .map_err(|error| format!("RELEASE_TRUST_PUBLIC_KEY_INVALID: {error}"))?;
+    let signature = Signature::decode(&decode_outer_base64(
+        &fs::read_to_string(signature_path)
+            .map_err(|error| format!("UPDATER_SIGNATURE_READ_FAILED: {error}"))?,
+        "UPDATER_SIGNATURE",
+    )?)
+    .map_err(|error| format!("UPDATER_SIGNATURE_INVALID: {error}"))?;
+    let updater = fs::read(Path::new(updater_path))
+        .map_err(|error| format!("UPDATER_ARTIFACT_READ_FAILED: {error}"))?;
+    public_key
+        .verify(&updater, &signature, true)
+        .map_err(|error| format!("UPDATER_SIGNATURE_VERIFICATION_FAILED: {error}"))?;
+    println!("HOLOLAKE_UPDATER_SIGNATURE_VERIFIED");
+    Ok(())
+}