bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat: add Xcode notarization release flow

Browse source
This commit is contained in:
冰朔 2026-08-19 04:50:17 +08:00
commit 7f415ee09f
3 changed files with 221 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

13
product-source/hololake-native-desktop/scripts/release-pipeline.test.mjs
View file

@ -75,6 +75,16 @@ test('release pipeline requires updater signing, Developer ID and Apple notariza
APPLE_PASSWORD: 'provided-at-runtime',
APPLE_TEAM_ID: 'TEAM',
}))
assert.equal(validateCredentialEnvironment({
APPLE_SIGNING_IDENTITY: 'Developer ID Application: HoloLake (TEAM)',
TAURI_SIGNING_PRIVATE_KEY: 'runtime-secret-material',
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: 'provided-at-runtime',
APPLE_XCODE_ORGANIZER_FLOW: '1',
}), 'XCODE_ORGANIZER')
assert.throws(() => validateCredentialEnvironment({
APPLE_SIGNING_IDENTITY: 'Developer ID Application: HoloLake (TEAM)',
APPLE_XCODE_ORGANIZER_FLOW: '1',
}), /TAURI_SIGNING_PRIVATE_KEY_OR_PATH/)
})
test('release pipeline materializes a protected updater key path only inside the build environment', () => {
@ -94,6 +104,9 @@ test('release pipeline verifies the updater signature against embedded product t
const source = readFileSync(new URL('./release-pipeline.mjs', import.meta.url), 'utf8')
assert.match(source, /--example',\s*'verify_updater_signature'/)
assert.match(source, /src-tauri\/release-trust\.json/)
assert.match(source, /HoloLakeExecutableSha256/)
assert.match(source, /NOTARIZED_APP_SOURCE_BINARY_MISMATCH/)
assert.match(source, /APPLE_APP_NOTARIZATION_ACCEPTED_AND_STAPLED_DMG_CONTAINS_NOTARIZED_APP/)
})
test('Windows updater keeps signed installation but never claims the macOS rollback boundary', () => {