bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: harden Xcode release provenance

Browse source
This commit is contained in:
冰朔 2026-08-19 05:10:54 +08:00
commit fdc1bd3c0a
2 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
product-source/hololake-native-desktop/scripts/release-pipeline.test.mjs
View file

@ -102,6 +102,7 @@ test('release pipeline materializes a protected updater key path only inside the
return 'encrypted-private-key-material'
})
assert.equal(hydrated.TAURI_SIGNING_PRIVATE_KEY, 'encrypted-private-key-material')
assert.equal(hydrated.TAURI_SIGNING_PRIVATE_KEY_PATH, undefined)
assert.equal(source.TAURI_SIGNING_PRIVATE_KEY, undefined)
})
@ -109,7 +110,9 @@ test('release pipeline verifies the updater signature against embedded product t
const source = readFileSync(new URL('./release-pipeline.mjs', import.meta.url), 'utf8')
assert.match(source, /--example',\s*'verify_updater_signature'/)
assert.match(source, /src-tauri\/release-trust\.json/)
assert.match(source, /HoloLakeExecutableSha256/)
assert.match(source, /HoloLakePreNotarizationExecutableSha256/)
assert.match(source, /HoloLakeUnsignedExecutableSha256/)
assert.match(source, /--remove-signature/)
assert.match(source, /NOTARIZED_APP_SOURCE_BINARY_MISMATCH/)
assert.match(source, /APPLE_APP_NOTARIZATION_ACCEPTED_AND_STAPLED_DMG_CONTAINS_NOTARIZED_APP/)
assert.match(source, /path\.resolve\(appExecutable, '\.\.\/\.\.\/\.\.'\)/)