bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(hololake): bind release chain to public path namespace

Browse source
This commit is contained in:
冰朔 2026-08-13 19:11:26 +08:00
commit 9006075310
13 changed files with 223 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

22
product-source/hololake-native-desktop/scripts/release-pipeline.mjs
View file

@ -8,6 +8,8 @@ import path from 'node:path'
import { fileURLToPath } from 'node:url'
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
const PUBLIC_RELEASE_ENDPOINT_PATH = '/hololake/releases/latest.json'
const PUBLIC_RELEASE_PREFIX = '/hololake/releases'
const fail = (code) => {
throw new Error(code)
@ -28,7 +30,15 @@ export function validateReleaseTrust(trust) {
if (!Array.isArray(trust.allowedReleaseHosts) || trust.allowedReleaseHosts.length !== 1) fail('HOLOLAKE_RELEASE_PIPELINE_EXACT_HOST_REQUIRED')
const endpoint = new URL(trust.endpoints[0])
const host = requireText(trust.allowedReleaseHosts[0], 'HOLOLAKE_RELEASE_PIPELINE_HOST_REQUIRED')
if (endpoint.protocol !== 'https:' || endpoint.hostname !== host || endpoint.username || endpoint.password) {
if (
endpoint.protocol !== 'https:' ||
endpoint.hostname !== host ||
endpoint.username ||
endpoint.password ||
endpoint.search ||
endpoint.hash ||
endpoint.pathname !== PUBLIC_RELEASE_ENDPOINT_PATH
) {
fail('HOLOLAKE_RELEASE_PIPELINE_ENDPOINT_NOT_HOLOLAKE_HTTPS')
}
if (requireText(trust.publicKey, 'HOLOLAKE_RELEASE_PIPELINE_UPDATER_PUBLIC_KEY_REQUIRED').length < 32) {
@ -50,7 +60,15 @@ export function validateReleaseInput(input, trustFacts) {
if (!/^[a-f0-9]{40}$/.test(input.sourceCommit || '')) fail('HOLOLAKE_RELEASE_PIPELINE_SOURCE_COMMIT_INVALID')
if (input.releaseTag !== `v${version}`) fail('HOLOLAKE_RELEASE_PIPELINE_IMMUTABLE_TAG_INVALID')
const packageUrl = new URL(requireText(input.packageUrl, 'HOLOLAKE_RELEASE_PIPELINE_PACKAGE_URL_REQUIRED'))
if (packageUrl.protocol !== 'https:' || packageUrl.hostname !== trustFacts.host || packageUrl.username || packageUrl.password) {
if (
packageUrl.protocol !== 'https:' ||
packageUrl.hostname !== trustFacts.host ||
packageUrl.username ||
packageUrl.password ||
packageUrl.search ||
packageUrl.hash ||
!packageUrl.pathname.startsWith(`${PUBLIC_RELEASE_PREFIX}/`)
) {
fail('HOLOLAKE_RELEASE_PIPELINE_PACKAGE_HOST_NOT_TRUSTED')
}
if (!Array.isArray(input.features) || input.features.length === 0 || input.features.some((item) => typeof item !== 'string' || !item.trim())) {