76 lines
2.9 KiB
JavaScript
76 lines
2.9 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
|
|
import {
|
|
validateCredentialEnvironment,
|
|
validateReleaseInput,
|
|
validateReleaseTrust,
|
|
} from './release-pipeline.mjs'
|
|
|
|
const readyTrust = () => ({
|
|
schema: 'hololake.release-trust/v1',
|
|
state: 'PROVISIONED',
|
|
endpoints: ['https://release.guanghu.test/hololake/releases/latest.json'],
|
|
publicKey: 'A'.repeat(64),
|
|
allowedReleaseHosts: ['release.guanghu.test'],
|
|
automaticCheckOnStartup: false,
|
|
automaticDownload: false,
|
|
humanOptInInstallRequired: true,
|
|
automaticRestart: false,
|
|
})
|
|
|
|
const readyInput = () => ({
|
|
schema: 'hololake.release-pipeline-input/v1',
|
|
releaseId: 'GH-HOLOLAKE-RELEASE-0.2.0',
|
|
version: '0.2.0',
|
|
previousVersion: '0.1.0',
|
|
minimumVersion: '0.1.0',
|
|
releaseTag: 'v0.2.0',
|
|
sourceCommit: 'a'.repeat(40),
|
|
platformCode: 'darwin-aarch64',
|
|
packageUrl: 'https://release.guanghu.test/hololake/releases/0.2.0/HoloLake.app.tar.gz',
|
|
appleTeamIdentifier: '825A9L3G7Q',
|
|
notes: 'Signed release',
|
|
features: ['Persistent direct connection'],
|
|
fixes: [],
|
|
dataMigrationRequired: false,
|
|
restartMessage: 'Restart manually',
|
|
})
|
|
|
|
test('release pipeline refuses an unprovisioned or upstream-owned trust document', () => {
|
|
const unprovisioned = readyTrust()
|
|
unprovisioned.state = 'UNPROVISIONED_FAIL_CLOSED'
|
|
assert.throws(() => validateReleaseTrust(unprovisioned), /TRUST_UNPROVISIONED/)
|
|
|
|
const upstream = readyTrust()
|
|
upstream.endpoints = ['https://updates.vendor.test/latest.json']
|
|
assert.throws(() => validateReleaseTrust(upstream), /ENDPOINT_NOT_HOLOLAKE_HTTPS/)
|
|
})
|
|
|
|
test('release package must use the exact registered HoloLake HTTPS host and immutable tag', () => {
|
|
const trust = validateReleaseTrust(readyTrust())
|
|
const wrongHost = readyInput()
|
|
wrongHost.packageUrl = 'https://github.com/example/HoloLake.app.tar.gz'
|
|
assert.throws(() => validateReleaseInput(wrongHost, trust), /PACKAGE_HOST_NOT_TRUSTED/)
|
|
|
|
const wrongPath = readyInput()
|
|
wrongPath.packageUrl = 'https://release.guanghu.test/updates/HoloLake.app.tar.gz'
|
|
assert.throws(() => validateReleaseInput(wrongPath, trust), /PACKAGE_HOST_NOT_TRUSTED/)
|
|
|
|
const wrongTag = readyInput()
|
|
wrongTag.releaseTag = 'latest'
|
|
assert.throws(() => validateReleaseInput(wrongTag, trust), /IMMUTABLE_TAG_INVALID/)
|
|
assert.equal(validateReleaseInput(readyInput(), trust).version, '0.2.0')
|
|
})
|
|
|
|
test('release pipeline requires updater signing, Developer ID and Apple notarization credentials together', () => {
|
|
assert.throws(() => validateCredentialEnvironment({}), /CREDENTIALS_MISSING/)
|
|
assert.doesNotThrow(() => validateCredentialEnvironment({
|
|
APPLE_SIGNING_IDENTITY: 'Developer ID Application: HoloLake (TEAM)',
|
|
TAURI_SIGNING_PRIVATE_KEY: 'runtime-secret-material',
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: 'provided-at-runtime',
|
|
APPLE_ID: 'release@example.test',
|
|
APPLE_PASSWORD: 'provided-at-runtime',
|
|
APPLE_TEAM_ID: 'TEAM',
|
|
}))
|
|
})
|