feat(hololake): bind release chain to public path namespace

product-source/hololake-native-desktop/scripts/release-broadcast-server.test.mjs

@@ -47,7 +47,7 @@ function buildReleaseRoot() {
     notes: 'Signed release',
     platforms: {
       'darwin-aarch64': {
-        url: `https://release.guanghu.test/releases/0.2.0/${packageName}`,
+        url: `https://release.guanghu.test/hololake/releases/0.2.0/${packageName}`,
         signature: 'trusted-updater-signature',
         size: packageBytes.length,
         sha256: sha256(packageBytes),
@@ -105,6 +105,10 @@ test('empty release root stays healthy but returns Tauri-compatible 204 no updat
     assert.equal(health.status, 200)
     assert.deepEqual((await health.json()).upstreamUpdateSources, [])
     assert.equal((await fetch(`${base}/latest.json`)).status, 204)
+    assert.equal((await fetch(`${base}/hololake/releases/latest.json`)).status, 204)
+    const publicHealth = await fetch(`${base}/hololake/releases/health`)
+    assert.equal(publicHealth.status, 200)
+    assert.equal((await publicHealth.json()).releaseEndpointPath, '/hololake/releases/latest.json')
   })
 })
 
@@ -127,7 +131,10 @@ test('only an exact human-approved signed notarized evidence chain becomes reada
     const latest = await fetch(`${base}/latest.json`)
     assert.equal(latest.status, 200)
     assert.equal((await latest.json()).releaseId, 'GH-HOLOLAKE-RELEASE-0.2.0')
-    const updater = await fetch(`${base}/releases/0.2.0/HoloLake.app.tar.gz`)
+    const publicLatest = await fetch(`${base}/hololake/releases/latest.json`)
+    assert.equal(publicLatest.status, 200)
+    assert.equal((await publicLatest.json()).releaseId, 'GH-HOLOLAKE-RELEASE-0.2.0')
+    const updater = await fetch(`${base}/hololake/releases/0.2.0/HoloLake.app.tar.gz`)
     assert.equal(updater.status, 200)
     assert.deepEqual(Buffer.from(await updater.arrayBuffer()), fixture.packageBytes)
     assert.equal((await fetch(`${base}/unknown`)).status, 404)
@@ -151,3 +158,27 @@ test('a symlinked immutable current directory is recognized as the intended exec
   fs.symlinkSync(versionDirectory, current)
   assert.equal(isMainModule(path.join(current, 'server.mjs'), new URL(`file://${copy}`)), true)
 })
+
+test('a package outside the registered public prefix locks the release', () => {
+  const fixture = buildReleaseRoot()
+  const latestPath = path.join(fixture.root, 'releases', '0.2.0', 'latest.json')
+  const latest = JSON.parse(fs.readFileSync(latestPath, 'utf8'))
+  latest.platforms['darwin-aarch64'].url = 'https://release.guanghu.test/releases/0.2.0/HoloLake.app.tar.gz'
+  writeJson(latestPath, latest)
+  const broadcastSha256 = sha256(fs.readFileSync(latestPath))
+  const pipelinePath = path.join(fixture.root, 'releases', '0.2.0', 'pipeline-receipt.json')
+  const pipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8'))
+  pipeline.broadcastSha256 = broadcastSha256
+  writeJson(pipelinePath, pipeline)
+  const approvalPath = path.join(fixture.root, 'releases', '0.2.0', 'human-approval.json')
+  const approval = JSON.parse(fs.readFileSync(approvalPath, 'utf8'))
+  approval.broadcastSha256 = broadcastSha256
+  writeJson(approvalPath, approval)
+  const activationPath = path.join(fixture.root, 'ACTIVE.json')
+  const activation = JSON.parse(fs.readFileSync(activationPath, 'utf8'))
+  activation.broadcastSha256 = broadcastSha256
+  writeJson(activationPath, activation)
+  const state = loadRuntimeState(fixture.root)
+  assert.equal(state.state, 'LOCKED_INVALID_RELEASE_EVIDENCE')
+  assert.equal(state.reasonCode, 'HOLOLAKE_RELEASE_PACKAGE_PUBLIC_PREFIX_MISMATCH')
+})