bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(hololake): provision signed in-app update bootstrap

Browse source
This commit is contained in:
冰朔 2026-08-17 00:51:56 +08:00
commit cfa8fdefc2
15 changed files with 144 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

16
product-source/hololake-native-desktop/scripts/foundation.test.mjs
View file

@ -16,12 +16,12 @@ const broadcast = readJson('contracts/release-broadcast.schema.json')
const stageOne = readJson('contracts/stage-one-platform.json')
const publicRoute = readJson('server/release-broadcast/public-route.json')
test('clean Tauri foundation contains no inherited product updater endpoint', () => {
test('HoloLake updater trust is product-owned and contains no inherited endpoint', () => {
assert.deepEqual(foundation.upstream_product_update_endpoints, [])
assert.deepEqual(trust.endpoints, [])
assert.deepEqual(trust.allowedReleaseHosts, [])
assert.equal(trust.state, 'UNPROVISIONED_FAIL_CLOSED')
assert.equal(trust.publicKey, '')
assert.deepEqual(trust.endpoints, ['https://guanghulab.com/hololake/releases/latest.json'])
assert.deepEqual(trust.allowedReleaseHosts, ['guanghulab.com'])
assert.equal(trust.state, 'PROVISIONED')
assert.ok(trust.publicKey.length > 100)
for (const relative of [
'foundation.json',
'src-tauri/release-trust.json',
@ -67,12 +67,12 @@ test('release activation remains explicitly human controlled', () => {
assert.equal(foundation.release_pipeline_automatic_upload_allowed, false)
assert.equal(
foundation.release_production_activation_state,
'BLOCKED_PENDING_PUBLIC_HTTPS_TRUST_UPDATER_KEY_PIPELINE_EXECUTION_AND_APPLE_NOTARIZATION',
'BOOTSTRAP_CLIENT_TRUST_PROVISIONED_PENDING_PUBLIC_ROUTE_AND_FIRST_NOTARIZED_RELEASE',
)
})
test('unprovisioned builds cannot emit updater artifacts or expose updater IPC', () => {
assert.equal(tauriConfig.bundle.createUpdaterArtifacts, false)
test('provisioned builds emit signed updater artifacts without exposing updater IPC', () => {
assert.equal(tauriConfig.bundle.createUpdaterArtifacts, true)
assert.equal(foundation.tauri_update_artifacts_enablement_gate, 'JD_CONTROLLER_PUBLIC_KEY_AND_SIGNED_RELEASE_PIPELINE_REQUIRED')
assert.deepEqual(capability.permissions, ['core:default'])
assert.equal(capability.permissions.includes('updater:default'), false)