feat(hololake): bind release chain to public path namespace

product-source/hololake-native-desktop/scripts/release-pipeline.test.mjs

@@ -10,7 +10,7 @@ import {
 const readyTrust = () => ({
   schema: 'hololake.release-trust/v1',
   state: 'PROVISIONED',
-  endpoints: ['https://release.guanghu.test/latest.json'],
+  endpoints: ['https://release.guanghu.test/hololake/releases/latest.json'],
   publicKey: 'A'.repeat(64),
   allowedReleaseHosts: ['release.guanghu.test'],
   automaticCheckOnStartup: false,
@@ -28,7 +28,7 @@ const readyInput = () => ({
   releaseTag: 'v0.2.0',
   sourceCommit: 'a'.repeat(40),
   platformCode: 'darwin-aarch64',
-  packageUrl: 'https://release.guanghu.test/releases/0.2.0/HoloLake.app.tar.gz',
+  packageUrl: 'https://release.guanghu.test/hololake/releases/0.2.0/HoloLake.app.tar.gz',
   appleTeamIdentifier: '825A9L3G7Q',
   notes: 'Signed release',
   features: ['Persistent direct connection'],
@@ -53,6 +53,10 @@ test('release package must use the exact registered HoloLake HTTPS host and immu
   wrongHost.packageUrl = 'https://github.com/example/HoloLake.app.tar.gz'
   assert.throws(() => validateReleaseInput(wrongHost, trust), /PACKAGE_HOST_NOT_TRUSTED/)
 
+  const wrongPath = readyInput()
+  wrongPath.packageUrl = 'https://release.guanghu.test/updates/HoloLake.app.tar.gz'
+  assert.throws(() => validateReleaseInput(wrongPath, trust), /PACKAGE_HOST_NOT_TRUSTED/)
+
   const wrongTag = readyInput()
   wrongTag.releaseTag = 'latest'
   assert.throws(() => validateReleaseInput(wrongTag, trust), /IMMUTABLE_TAG_INVALID/)