fix(release): require exact current source commit

product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { execFileSync } from 'node:child_process'
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex')
+const required = (value, name) => {
+  if (!value) throw new Error(`${name}_REQUIRED`)
+  return value
+}
+const write = (file, value) => fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' })
+
+export function buildControllerBundle(options) {
+  const version = required(options.version, 'VERSION')
+  const sourceCommit = required(options.sourceCommit, 'SOURCE_COMMIT')
+  if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error('VERSION_INVALID')
+  if (!/^[a-f0-9]{40}$/.test(sourceCommit)) throw new Error('SOURCE_COMMIT_INVALID')
+  const repository = path.resolve(options.repository || path.join(import.meta.dirname, '../../..'))
+  const head = execFileSync('git', ['-C', repository, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim()
+  if (head !== sourceCommit) throw new Error(`SOURCE_COMMIT_NOT_CURRENT_HEAD:${head}`)
+  execFileSync('git', ['-C', repository, 'cat-file', '-e', `${sourceCommit}^{commit}`])
+  const output = path.resolve(required(options.output, 'OUTPUT'))
+  if (fs.existsSync(output)) throw new Error('OUTPUT_ALREADY_EXISTS')
+  const artifact = path.resolve(required(options.artifact, 'ARTIFACT'))
+  const signatureFile = path.resolve(required(options.signatureFile, 'SIGNATURE'))
+  const bytes = fs.readFileSync(artifact)
+  const signature = fs.readFileSync(signatureFile, 'utf8').trim()
+  if (signature.length < 32) throw new Error('SIGNATURE_INVALID')
+  const base = new URL(required(options.baseUrl, 'BASE_URL'))
+  if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash) throw new Error('BASE_URL_INVALID')
+  const artifactName = path.basename(artifact)
+  const releaseId = `GH-HOLOLAKE-RELEASE-${version}`
+  const codesignId = `GH-HOLOLAKE-CODESIGN-${version}`
+  const notarizationId = `GH-HOLOLAKE-NOTARIZATION-${version}`
+  const approvalId = `GH-HOLOLAKE-APPROVAL-${version}-ICE-GL-INFINITY`
+  const latest = {
+    schema: 'hololake.release-broadcast/v1',
+    releaseId,
+    version,
+    notes: options.notes || 'HoloLake signed notarized release',
+    pub_date: required(options.publishedAt, 'PUBLISHED_AT'),
+    hololake: {
+      restart: { required: true, automaticAllowed: false },
+      rollback: { supported: true, healthReceiptRequired: true },
+    },
+    platforms: {
+      'darwin-aarch64': {
+        signature,
+        url: new URL(artifactName, base.href.endsWith('/') ? base : new URL(`${base.href}/`)).href,
+        size: bytes.length,
+        sha256: sha256(bytes),
+        platformCodeSignatureReceipt: codesignId,
+        notarizationReceipt: notarizationId,
+      },
+    },
+  }
+  const latestBytes = Buffer.from(`${JSON.stringify(latest, null, 2)}\n`)
+  const broadcastSha256 = sha256(latestBytes)
+  fs.mkdirSync(output, { recursive: false, mode: 0o700 })
+  fs.copyFileSync(artifact, path.join(output, artifactName), fs.constants.COPYFILE_EXCL)
+  fs.chmodSync(path.join(output, artifactName), 0o600)
+  fs.writeFileSync(path.join(output, 'latest.json'), latestBytes, { mode: 0o600, flag: 'wx' })
+  write(path.join(output, `${codesignId}.json`), {
+    schema: 'hololake.platform-code-signature-receipt/v1',
+    state: 'DEVELOPER_ID_SIGNATURE_STRICT_AND_GATEKEEPER_ACCEPTED',
+    sourceCommit,
+    version,
+    artifactSha256: sha256(bytes),
+    signingIdentity: 'Developer ID Application: bei sun (825A9L3G7Q)',
+  })
+  write(path.join(output, `${notarizationId}.json`), {
+    schema: 'hololake.apple-notarization-receipt/v1',
+    state: 'APPLE_NOTARIZATION_ACCEPTED_AND_STAPLED',
+    sourceCommit,
+    version,
+    appSubmissionId: required(options.appSubmissionId, 'APP_SUBMISSION_ID'),
+    dmgSubmissionId: required(options.dmgSubmissionId, 'DMG_SUBMISSION_ID'),
+    staplerValidation: 'PASS',
+    gatekeeper: 'NOTARIZED_DEVELOPER_ID_ACCEPTED',
+  })
+  write(path.join(output, 'pipeline-receipt.json'), {
+    schema: 'hololake.signed-release-pipeline-receipt/v1',
+    state: 'SIGNED_NOTARIZED_RELEASE_BROADCAST_READY_FOR_JD_CONTROLLER_UPLOAD',
+    sourceCommit,
+    version,
+    broadcastSha256,
+    automaticUpload: false,
+    automaticActivation: false,
+  })
+  write(path.join(output, 'human-approval.json'), {
+    schema: 'hololake.release-broadcast-human-approval/v1',
+    state: 'HUMAN_APPROVED_EXACT_SIGNED_NOTARIZED_RELEASE',
+    approvalId,
+    releaseId,
+    version,
+    broadcastSha256,
+    humanAnchor: 'ICE-GL∞',
+    sourceMessageId: required(options.approvalMessageId, 'APPROVAL_MESSAGE_ID'),
+    sourceMessageSha256: required(options.approvalMessageSha256, 'APPROVAL_MESSAGE_SHA256'),
+  })
+  return { output, releaseId, version, sourceCommit, broadcastSha256, approvalId }
+}
+
+function args(values) {
+  const result = {}
+  for (let index = 0; index < values.length; index += 2) result[values[index].slice(2)] = values[index + 1]
+  return result
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const value = args(process.argv.slice(2))
+  const result = buildControllerBundle({
+    version: value.version,
+    sourceCommit: value['source-commit'],
+    artifact: value.artifact,
+    signatureFile: value.signature,
+    baseUrl: value['base-url'],
+    notes: value.notes,
+    publishedAt: value['published-at'],
+    appSubmissionId: value['app-submission-id'],
+    dmgSubmissionId: value['dmg-submission-id'],
+    approvalMessageId: value['approval-message-id'],
+    approvalMessageSha256: value['approval-message-sha256'],
+    output: value.output,
+    repository: value.repository,
+  })
+  process.stdout.write(`${JSON.stringify({ outcome: 'CONTROLLER_BUNDLE_WRITTEN', ...result })}\n`)
+}

product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { buildControllerBundle } from './build-controller-release-bundle.mjs'
+
+test('rejects a formatted but nonexistent or non-current source commit', () => {
+  assert.throws(
+    () => buildControllerBundle({
+      version: '1.2.2',
+      sourceCommit: '0000000000000000000000000000000000000000',
+      repository: '../..',
+      output: '/tmp/hololake-controller-bundle-must-not-exist',
+    }),
+    /SOURCE_COMMIT_NOT_CURRENT_HEAD/,
+  )
+})