feat: publish HoloLake model-native living system source

product-source/hololake-platform/.github/scripts/configure-windows-authenticode.ps1

@@ -0,0 +1,115 @@
+param(
+  [string]$ConfigPath = "src-tauri/tauri.windows-signing.conf.json"
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+function Read-FirstEnv {
+  param([string[]]$Names)
+
+  foreach ($Name in $Names) {
+    $Value = [Environment]::GetEnvironmentVariable($Name)
+    if (-not [string]::IsNullOrWhiteSpace($Value)) {
+      return $Value.Trim()
+    }
+  }
+
+  throw "Set one of these environment variables: $($Names -join ', ')"
+}
+
+function Read-OptionalEnv {
+  param(
+    [string[]]$Names,
+    [string]$DefaultValue
+  )
+
+  foreach ($Name in $Names) {
+    $Value = [Environment]::GetEnvironmentVariable($Name)
+    if (-not [string]::IsNullOrWhiteSpace($Value)) {
+      return $Value.Trim()
+    }
+  }
+
+  return $DefaultValue
+}
+
+function Normalize-Thumbprint {
+  param([string]$Thumbprint)
+
+  return ($Thumbprint -replace "\s", "").ToUpperInvariant()
+}
+
+function Convert-CertificateSecretToBytes {
+  param([string]$CertificateSecret)
+
+  $Base64Lines = $CertificateSecret -split "\r?\n" |
+    Where-Object { $_ -notmatch "^-+BEGIN " -and $_ -notmatch "^-+END " }
+  $CertificateBase64 = ($Base64Lines -join "") -replace "\s", ""
+
+  try {
+    return [Convert]::FromBase64String($CertificateBase64)
+  } catch {
+    throw "Windows code-signing certificate must be base64-encoded PFX data."
+  }
+}
+
+$CertificateSecret = Read-FirstEnv @("WINDOWS_CODE_SIGNING_CERTIFICATE", "WINDOWS_CERTIFICATE")
+$CertificatePassword = Read-FirstEnv @("WINDOWS_CODE_SIGNING_CERTIFICATE_PASSWORD", "WINDOWS_CERTIFICATE_PASSWORD")
+$ConfiguredThumbprint = Read-OptionalEnv @("WINDOWS_CODE_SIGNING_CERTIFICATE_THUMBPRINT", "WINDOWS_CERTIFICATE_THUMBPRINT") ""
+$DigestAlgorithm = Read-OptionalEnv @("WINDOWS_CODE_SIGNING_DIGEST_ALGORITHM") "sha256"
+$TimestampUrl = Read-OptionalEnv @("WINDOWS_CODE_SIGNING_TIMESTAMP_URL", "WINDOWS_TIMESTAMP_URL") "http://timestamp.digicert.com"
+
+$TempRoot = Join-Path ([IO.Path]::GetTempPath()) "tolaria-windows-signing"
+if (-not [string]::IsNullOrWhiteSpace($env:RUNNER_TEMP)) {
+  $TempRoot = Join-Path $env:RUNNER_TEMP "tolaria-windows-signing"
+}
+New-Item -ItemType Directory -Force -Path $TempRoot | Out-Null
+
+$PfxPath = Join-Path $TempRoot "certificate.pfx"
+[IO.File]::WriteAllBytes($PfxPath, (Convert-CertificateSecretToBytes $CertificateSecret))
+
+$SecurePassword = ConvertTo-SecureString -String $CertificatePassword -Force -AsPlainText
+$ImportedCertificates = @(Import-PfxCertificate -FilePath $PfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $SecurePassword)
+Remove-Item -Force -ErrorAction SilentlyContinue $PfxPath
+
+$ImportedCertificate = $ImportedCertificates | Where-Object { $_.HasPrivateKey } | Select-Object -First 1
+if ($null -eq $ImportedCertificate) {
+  throw "The imported Windows code-signing certificate does not include a private key."
+}
+
+if ([string]::IsNullOrWhiteSpace($ConfiguredThumbprint)) {
+  $CertificateThumbprint = Normalize-Thumbprint $ImportedCertificate.Thumbprint
+} else {
+  $CertificateThumbprint = Normalize-Thumbprint $ConfiguredThumbprint
+}
+
+$StoreCertificate = Get-ChildItem Cert:\CurrentUser\My |
+  Where-Object { (Normalize-Thumbprint $_.Thumbprint) -eq $CertificateThumbprint } |
+  Select-Object -First 1
+if ($null -eq $StoreCertificate) {
+  throw "The requested Windows code-signing certificate thumbprint was not found in Cert:\CurrentUser\My."
+}
+
+$Config = @{
+  bundle = @{
+    windows = @{
+      certificateThumbprint = $CertificateThumbprint
+      digestAlgorithm = $DigestAlgorithm
+      timestampUrl = $TimestampUrl
+    }
+  }
+}
+
+$ResolvedConfigPath = Resolve-Path -Path (Split-Path -Parent $ConfigPath) -ErrorAction SilentlyContinue
+if ($null -eq $ResolvedConfigPath) {
+  New-Item -ItemType Directory -Force -Path (Split-Path -Parent $ConfigPath) | Out-Null
+}
+
+$Config | ConvertTo-Json -Depth 10 | Set-Content -Path $ConfigPath -Encoding utf8NoBOM
+
+if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
+  "WINDOWS_CODE_SIGNING_CERTIFICATE_THUMBPRINT=$CertificateThumbprint" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+}
+
+Write-Host "Prepared Windows Authenticode signing config at $ConfigPath."

product-source/hololake-platform/.github/scripts/prefetch-tauri-nsis.ps1

@@ -0,0 +1,137 @@
+$ErrorActionPreference = "Stop"
+
+$nsisUrl = "https://github.com/tauri-apps/binary-releases/releases/download/nsis-3.11/nsis-3.11.zip"
+$nsisSha1 = "EF7FF767E5CBD9EDD22ADD3A32C9B8F4500BB10D"
+$tauriUtilsUrl = "https://github.com/tauri-apps/nsis-tauri-utils/releases/download/nsis_tauri_utils-v0.5.3/nsis_tauri_utils.dll"
+$tauriUtilsSha1 = "75197FEE3C6A814FE035788D1C34EAD39349B860"
+$tauriUtilsRelativePath = "Plugins\x86-unicode\additional\nsis_tauri_utils.dll"
+
+$nsisRequiredFiles = @(
+  "makensis.exe",
+  "Bin\makensis.exe",
+  "Stubs\lzma-x86-unicode",
+  "Stubs\lzma_solid-x86-unicode",
+  "Include\MUI2.nsh",
+  "Include\FileFunc.nsh",
+  "Include\x64.nsh",
+  "Include\nsDialogs.nsh",
+  "Include\WinMessages.nsh",
+  "Include\Win\COM.nsh",
+  "Include\Win\Propkey.nsh",
+  "Include\Win\RestartManager.nsh"
+)
+
+function Get-UpperSha1 {
+  param([Parameter(Mandatory = $true)][string]$Path)
+
+  return (Get-FileHash -Algorithm SHA1 -LiteralPath $Path).Hash.ToUpperInvariant()
+}
+
+function Test-FileSha1 {
+  param(
+    [Parameter(Mandatory = $true)][string]$Path,
+    [Parameter(Mandatory = $true)][string]$ExpectedSha1
+  )
+
+  return (Test-Path -LiteralPath $Path) -and ((Get-UpperSha1 -Path $Path) -eq $ExpectedSha1)
+}
+
+function Save-VerifiedDownload {
+  param(
+    [Parameter(Mandatory = $true)][string]$Uri,
+    [Parameter(Mandatory = $true)][string]$OutFile,
+    [Parameter(Mandatory = $true)][string]$ExpectedSha1
+  )
+
+  $parent = Split-Path -Parent $OutFile
+  New-Item -ItemType Directory -Force -Path $parent | Out-Null
+
+  $tempFile = "$OutFile.download"
+  for ($attempt = 1; $attempt -le 5; $attempt++) {
+    try {
+      Remove-Item -Force -ErrorAction SilentlyContinue -LiteralPath $tempFile
+      Invoke-WebRequest -Uri $Uri -OutFile $tempFile -TimeoutSec 120
+
+      $actualSha1 = Get-UpperSha1 -Path $tempFile
+      if ($actualSha1 -ne $ExpectedSha1) {
+        throw "SHA1 mismatch for $Uri. Expected $ExpectedSha1, got $actualSha1."
+      }
+
+      Move-Item -Force -LiteralPath $tempFile -Destination $OutFile
+      return
+    } catch {
+      Remove-Item -Force -ErrorAction SilentlyContinue -LiteralPath $tempFile
+      if ($attempt -eq 5) {
+        throw
+      }
+
+      $delaySeconds = [Math]::Min(30, 5 * $attempt)
+      Write-Warning "Download attempt ${attempt} failed: $($_.Exception.Message). Retrying in ${delaySeconds}s."
+      Start-Sleep -Seconds $delaySeconds
+    }
+  }
+}
+
+function Find-MissingFile {
+  param(
+    [Parameter(Mandatory = $true)][string]$Root,
+    [Parameter(Mandatory = $true)][string[]]$RelativePaths
+  )
+
+  foreach ($relativePath in $RelativePaths) {
+    if (-not (Test-Path -LiteralPath (Join-Path $Root $relativePath))) {
+      return $relativePath
+    }
+  }
+
+  return $null
+}
+
+if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) {
+  throw "LOCALAPPDATA is required to resolve Tauri's Windows tool cache."
+}
+
+$tauriToolsPath = Join-Path $env:LOCALAPPDATA "tauri"
+$nsisPath = Join-Path $tauriToolsPath "NSIS"
+$downloadRoot = if ([string]::IsNullOrWhiteSpace($env:RUNNER_TEMP)) {
+  [System.IO.Path]::GetTempPath()
+} else {
+  $env:RUNNER_TEMP
+}
+
+New-Item -ItemType Directory -Force -Path $tauriToolsPath | Out-Null
+
+$missingNsisFile = Find-MissingFile -Root $nsisPath -RelativePaths $nsisRequiredFiles
+if ($missingNsisFile) {
+  Write-Host "Tauri NSIS cache is missing $missingNsisFile; downloading NSIS 3.11."
+  Remove-Item -Recurse -Force -ErrorAction SilentlyContinue -LiteralPath $nsisPath
+  Remove-Item -Recurse -Force -ErrorAction SilentlyContinue -LiteralPath (Join-Path $tauriToolsPath "nsis-3.11")
+
+  $zipPath = Join-Path $downloadRoot "nsis-3.11.zip"
+  Save-VerifiedDownload -Uri $nsisUrl -OutFile $zipPath -ExpectedSha1 $nsisSha1
+  Expand-Archive -Force -LiteralPath $zipPath -DestinationPath $tauriToolsPath
+
+  $extractedNsisPath = Join-Path $tauriToolsPath "nsis-3.11"
+  if (-not (Test-Path -LiteralPath $extractedNsisPath)) {
+    throw "Downloaded NSIS archive did not contain the expected nsis-3.11 directory."
+  }
+
+  Move-Item -Force -LiteralPath $extractedNsisPath -Destination $nsisPath
+} else {
+  Write-Host "Tauri NSIS cache already contains NSIS 3.11."
+}
+
+$tauriUtilsPath = Join-Path $nsisPath $tauriUtilsRelativePath
+if (-not (Test-FileSha1 -Path $tauriUtilsPath -ExpectedSha1 $tauriUtilsSha1)) {
+  Write-Host "Downloading Tauri NSIS utility plugin."
+  Save-VerifiedDownload -Uri $tauriUtilsUrl -OutFile $tauriUtilsPath -ExpectedSha1 $tauriUtilsSha1
+} else {
+  Write-Host "Tauri NSIS utility plugin is already cached."
+}
+
+$missingFile = Find-MissingFile -Root $nsisPath -RelativePaths ($nsisRequiredFiles + @($tauriUtilsRelativePath))
+if ($missingFile) {
+  throw "Tauri NSIS toolchain is incomplete after prefetch; missing $missingFile."
+}
+
+Write-Host "Tauri NSIS toolchain ready at $nsisPath."