native-packages 0.6.0 → 0.8.0

data/docs/platforms.md

@@ -1,34 +1,5 @@
-# Platform and distribution coverage
+# Supported platforms
 
-All seven nFPM 2.47.0 packagers are exposed by the v0.2 CLI. Each target explicitly declares suitable inputs; enabling an output format does not port an application or guarantee acceptance by a distribution.
+This guide is now part of the documentation site:
 
-| Output/destination | Shared implementation | Application responsibility |
-| --- | --- | --- |
-| DEB | nFPM, ELF inspection, known dependency inference, release upload | Supported distro baseline, runtime-loaded libraries, services/assets and installation testing |
-| RPM | Same, with RPM dependency names | Distribution-specific dependencies and compatibility |
-| Arch package | nFPM `archlinux`, native filename, ELF inspection | Arch-compatible files and explicit dependencies |
-| Alpine APK | nFPM `apk`, ELF/libc checks | Suitable musl/static inputs and Alpine dependencies |
-| IPK | nFPM `ipk`, ELF checks, explicit ABI label | Device/distribution ABI, architecture and dependencies |
-| MSIX | nFPM `msix`, PE architecture checks, `after_package` hook for native signing | Windows executables/DLLs, application identity, assets, capabilities and signing certificate |
-| SRPM | nFPM `srpm`, source/spec input validation | A correct spec and sources, native rebuild testing |
-| AUR | Template rendering, `.SRCINFO`, staged Git publication | Native PKGBUILD source/bin/git variants and build checks |
-| Homebrew | Hash/render supplied formulae or casks and publish a tap | Completed macOS assets, native recipe logic |
-| Nixpkgs/Gentoo/Void and similar repositories | Template rendering and configured Git/PR/MR publication | Native recipes, dependency hashes, distro checks and review |
-| Flatpak | No build/publication adapter yet | Use flatpak-builder and native manifests/runtime/sandbox settings |
-| Inno Setup | Native command adapter, PE inspection, copied input and final output hashes | Inno recipe/compiler, application version mapping, signing and installation tests |
-| macOS DMG | Native command adapter, Mach-O inspection, automatic Developer ID signing/notarization with Apple credentials, final stapled hashes | Bundle, hdiutil recipe, Apple credentials/entitlements, update/rollback testing |
-| Other Windows installers | No adapter for NSIS/WiX yet | Existing native tools and WinGet/Scoop integrations |
-
-The IPK acceptance fixture targets OpenWrt 24.10.8. OpenWrt 25.12 switched to APK, so IPK is not the package format for every OpenWrt release. [OpenWrt 25.12 release notes](https://openwrt.org/releases/25.12/notes-25.12.0)
-
-nFPM ends at constructing the package file, including its supported signing operations. It does not compile the application or host package indexes. [nFPM configuration](https://nfpm.goreleaser.com/docs/configuration/)
-
-The Windows acceptance test uses Windows SDK SignTool through `after_package`. Windows rejected nFPM 2.47.0's built-in signature with `0x80096010` in the initial acceptance run; do not assume its signing configuration alone produces a Windows-installable result.
-
-The CLI uses known ELF machine/class/endianness mappings and PE machine mappings. Unsupported inspection architectures fail explicitly. Data and source targets do not require an executable. The small DEB/RPM dependency table can be extended in configuration; other formats require explicit runtime dependencies. These checks do not detect every dynamically loaded library or establish compatibility with every version of a distribution.
-
-CI builds fixtures in every format and defines native Linux install/upgrade/remove checks, an SRPM rebuild and a signed MSIX installation on Windows. A build manifest reports `installation: not-tested` unless such testing was actually performed for that application output. Fixture coverage is separate from app-specific validation.
-
-The [acceptance run for v0.2 development](https://github.com/crmne/native-packages/actions/runs/34748247545) passed on Debian trixie, Fedora 41, Arch's base image, Alpine 3.24.0, OpenWrt 24.10.8 and the GitHub Windows runner. Linux binary tests use a small static executable; the SRPM rebuilds its C source, and the Windows package contains a compiled Windows executable. These fixtures test package construction and lifecycle, not the compatibility of every application's GUI or device integrations.
-
-Version 0.1 and its pinned workflow retain their DEB/RPM behavior. The new formats are enabled through the v0.2 single-file configuration and `build` command. Existing v0.1 application configurations do not silently gain more output formats.
+[Supported platforms](_reference/platforms.md).

data/docs/releasing.md

@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
 Create a GitHub release for that commit:
 
 ```sh
-gh release create v0.6.0 --target main --title 'native-packages 0.6.0' --notes-file release-notes.md
+gh release create v0.8.0 --target main --title 'native-packages 0.8.0' --notes-file release-notes.md
 ```
 
 Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.
@@ -31,3 +31,16 @@ Adding `--draft` permits review before publication and does not trigger the publ
 The release workflow verifies the tag, tested commit and prerelease setting, then runs the test workflow, including native package acceptance. It downloads the tested gem from the Ruby 4.0 job, publishes it to RubyGems and GitHub Packages, and attaches it to the GitHub release. It does not rebuild a different artifact after the tests.
 
 If authentication is missing, leave the tested gem and release draft available until the secret is configured. Failed release jobs can be rerun after configuration; already-published gem versions are not overwritten. Never move an existing release tag to retry publication.
+
+If the workflow itself needs a correction, fix it on `main` and dispatch the
+corrected release workflow against the existing published tag:
+
+```sh
+gh workflow run release.yml --ref main -f tag=v0.8.0
+```
+
+Validation resolves the original tag to an exact commit, requires it to be on
+`main`, and checks the existing release's version and prerelease state. Every
+test and publication checkout uses that commit, not the newer workflow commit.
+The gem is taken from that retry's tested Ruby 4.0 artifact. This permits a
+workflow repair without moving a tag or publishing untested source.

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.6.0'
+  version: '0.8.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.6.0'
+  version: '0.8.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/appimage.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+module NativePackages
+  # Builds a type 2 AppImage from the same contents nFPM packages: the files
+  # are laid out in an AppDir, packed with mksquashfs and appended to a pinned
+  # AppImage runtime. Libraries are not bundled; the AppImage uses the host's,
+  # as the deb and rpm packages do.
+  class AppImage
+    include Support
+    RUNTIME = "20251108"
+    RUNTIME_URL = "https://github.com/AppImage/type2-runtime/releases/download/#{RUNTIME}"
+    # nFPM architecture => [AppImage architecture, runtime SHA-256].
+    RUNTIMES = {
+      "amd64" => ["x86_64", "2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d"],
+      "arm64" => ["aarch64", "00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444"],
+      "386" => ["i686", "e72ea0b140a0a16e680713238a6f30aad278b62c4ca17919c554864124515498"],
+      "arm7" => ["armhf", "e9060d37577b8a29914ec12d8740add24e19ff29012fb1fa0f60daf62db0688d"]
+    }.freeze
+    ICON_DIRECTORIES = %w[usr/share/icons usr/share/pixmaps].freeze
+    attr_reader :root
+
+    def initialize(root)
+      @root = root
+    end
+
+    def self.architecture(target)
+      RUNTIMES.fetch(target.fetch("arch")) { raise Error, "appimage does not support #{target.fetch('arch')}; use #{RUNTIMES.keys.join(', ')}" }.first
+    end
+
+    def self.filename(name, version, target) = "#{name}-#{version}-#{architecture(target)}.AppImage"
+
+    def doctor(target)
+      self.class.architecture(target)
+      missing = %w[mksquashfs curl].reject { |tool| available?(tool) }
+      raise Error, "install required AppImage tools: #{missing.join(', ')} (mksquashfs is in squashfs-tools)" unless missing.empty?
+    end
+
+    def runtime(target)
+      architecture, digest = RUNTIMES.fetch(target.fetch("arch"))
+      path = root / ".cache/native-packages/appimage-runtime" / RUNTIME / "runtime-#{architecture}"
+      download("#{RUNTIME_URL}/runtime-#{architecture}", path)
+      unless sha256(path) == digest
+        path.delete
+        raise Error, "AppImage runtime checksum mismatch: runtime-#{architecture}"
+      end
+      path
+    end
+
+    # Returns the AppImage's path and what was put at the AppDir's root.
+    def build(package, target, destination, name:, version:, epoch:)
+      doctor(target)
+      output = destination / self.class.filename(name, version, target)
+      Dir.mktmpdir("native-packages-appimage-") do |directory|
+        appdir = Pathname.new(directory) / "AppDir"
+        appdir.mkpath
+        stage(package, appdir)
+        entry = integrate(appdir)
+        normalize(appdir, epoch)
+        image = Pathname.new(directory) / "filesystem.squashfs"
+        run "mksquashfs", appdir, image, "-root-owned", "-noappend", "-no-xattrs", "-no-progress", "-quiet", "-comp", "zstd",
+          env: { "SOURCE_DATE_EPOCH" => epoch.to_s }
+        File.open(output, "wb") do |file|
+          file.write(runtime(target).binread)
+          IO.copy_stream(image.to_s, file)
+        end
+        output.chmod(0o755)
+        check(output)
+        [output, entry.merge("runtime" => RUNTIME, "libraries" => "host")]
+      end
+    end
+
+    def check(path)
+      header = path.binread(11)
+      raise Error, "not a type 2 AppImage: #{path}" unless header&.start_with?("\x7fELF".b) && header.byteslice(8, 3) == "AI\x02".b
+    end
+
+    # nFPM overrides replace the contents list when one is supplied.
+    def contents(package)
+      package.fetch("overrides", {}).fetch("appimage", {}).fetch("contents", package.fetch("contents"))
+        .reject { |item| item["packager"] && item["packager"] != "appimage" }
+    end
+
+    def inside(appdir, destination)
+      raise Error, "appimage: content destinations must be absolute: #{destination}" unless destination.to_s.start_with?("/")
+      appdir / relative_path(destination.to_s.delete_prefix("/"))
+    end
+
+    def stage(package, appdir)
+      contents(package).each do |item|
+        type = item.fetch("type", "file")
+        next if type == "ghost"
+        target = inside(appdir, item.fetch("dst"))
+        mode = item.dig("file_info", "mode")
+        case type
+        when "dir"
+          target.mkpath
+        when "symlink"
+          target.dirname.mkpath
+          File.symlink(item.fetch("src"), target)
+        when "file", "tree", "config", "config|noreplace", "config|missingok"
+          source = File.expand_path(item.fetch("src"), root)
+          paths = package["disable_globbing"] ? [source].select { |path| File.exist?(path) } : Dir.glob(source).sort
+          raise Error, "missing package content: #{source}" if paths.empty?
+          single = paths.length == 1 && File.file?(paths.first) && type != "tree"
+          paths.each do |path|
+            if File.directory?(path)
+              target.mkpath
+              FileUtils.cp_r(Dir.children(path).map { |child| File.join(path, child) }, target)
+            else
+              file = single ? target : target / File.basename(path)
+              file.dirname.mkpath
+              FileUtils.cp(path, file)
+              file.chmod(mode) if mode
+            end
+          end
+        else
+          raise Error, "appimage: unsupported content type #{type}"
+        end
+      end
+    end
+
+    # AppImage's root needs the desktop entry, its icon and AppRun.
+    def integrate(appdir)
+      entries = Pathname.glob(appdir / "usr/share/applications/*.desktop")
+      raise Error, "appimage needs exactly one desktop entry in /usr/share/applications; found #{entries.length}" unless entries.length == 1
+      desktop = entries.first
+      fields = desktop.read.lines.each_with_object({}) do |line, result|
+        key, value = line.strip.split("=", 2)
+        result[key] ||= value if value && %w[Exec Icon].include?(key)
+      end
+      command = Shellwords.split(fields.fetch("Exec") { raise Error, "appimage: #{desktop.basename} has no Exec" }).first
+      executable = command.start_with?("/") ? inside(appdir, command) : appdir / "usr/bin" / relative_path(command)
+      raise Error, "appimage: #{desktop.basename} runs #{command}, which the package does not install" unless executable.file? && executable.executable?
+      name = fields.fetch("Icon") { raise Error, "appimage: #{desktop.basename} has no Icon" }
+      raise Error, "appimage: Icon must be a name, not a path" if name.include?("/")
+      icons = ICON_DIRECTORIES.flat_map { |path| Pathname.glob(appdir / path / "**" / "#{name}.{svg,png}") }
+      # A scalable icon first, else the largest bitmap.
+      icon = icons.find { |path| path.extname == ".svg" } || icons.max_by(&:size)
+      raise Error, "appimage: the package installs no #{name}.svg or #{name}.png icon" unless icon
+      FileUtils.cp(desktop, appdir / desktop.basename)
+      FileUtils.cp(icon, appdir / icon.basename)
+      File.symlink(icon.basename.to_s, appdir / ".DirIcon")
+      File.symlink(executable.relative_path_from(appdir).to_s, appdir / "AppRun")
+      { "desktop" => desktop.basename.to_s, "icon" => icon.basename.to_s, "executable" => executable.relative_path_from(appdir).to_s }
+    end
+
+    # The same bytes for the same inputs: fixed modes and times.
+    def normalize(appdir, epoch)
+      time = Time.at(epoch)
+      Pathname.glob(appdir / "**/*", File::FNM_DOTMATCH).each do |path|
+        next if path.basename.to_s == "."
+        if path.symlink?
+          File.lutime(time, time, path)
+        else
+          path.chmod(path.directory? || path.executable? ? 0o755 : 0o644)
+          File.utime(time, time, path)
+        end
+      end
+      appdir.chmod(0o755)
+      File.utime(time, time, appdir)
+    end
+  end
+end

data/lib/native_packages/build.rb

@@ -4,6 +4,7 @@ require_relative "configuration"
 require_relative "inspection"
 require_relative "native_recipe"
 require_relative "macos_signing"
+require_relative "appimage"
 
 module NativePackages
   class Build
@@ -31,7 +32,8 @@ module NativePackages
     def doctor(ids: [], formats: [], release: false, defer_recipes: false)
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
-      nfpm_version if selected.values.any? { |target| (target.fetch("formats") & Configuration::NATIVE_FORMATS).empty? }
+      nfpm_version if selected.values.any? { |target| !(target.fetch("formats") - Configuration::NATIVE_FORMATS - ["appimage"]).empty? }
+      selected.each_value { |target| AppImage.new(root).doctor(target) if target.fetch("formats").include?("appimage") }
       selected.each do |id, target|
         next unless target["native"]
         metadata = configuration.target_tokens(configuration.tokens("9.8.7"), id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
@@ -155,6 +157,14 @@ module NativePackages
                   packages = files(destination)
                   raise Error, "native recipe must create only its declared output" unless packages == [package_path]
                   native.check_output(package_path, format)
+                elsif format == "appimage"
+                  package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+                  inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+                  package_path, details = AppImage.new(root).build(package, target, destination, name: configuration.name, version: number,
+                    epoch: info.fetch("SOURCE_DATE_EPOCH"))
+                  inspection["appimage"] = details
+                  packages = files(destination)
+                  raise Error, "AppImage build must create only its package" unless packages == [package_path]
                 else
                   package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
                   if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
@@ -174,6 +184,7 @@ module NativePackages
                   hook_tokens = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
                   run(*render_tree(target.fetch("after_package"), hook_tokens), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
                   raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
+                  AppImage.new(root).check(packages.first) if format == "appimage"
                 end
                 if native
                   native.check_output(packages.first, format)

data/lib/native_packages/cli.rb

@@ -2,6 +2,7 @@
 
 require_relative "build"
 require_relative "scaffold"
+require_relative "release_signing"
 
 module NativePackages
   module CLI
@@ -15,6 +16,10 @@ module NativePackages
           [--output DIRECTORY] [--dry-run]         Choose output or inspect the plan
           [--defer-recipes]                        Build targets without recipe assets/tools
         notarize-macos DIRECTORY --output DIRECTORY Copy, sign and notarize portable Mac code
+        release-checksums DIRECTORY --output FILE  Hash a flat directory of release artifacts
+        sign-checksums FILE --public-key HEX_FILE   Sign verified checksums with Ed25519
+          [--key-env VARIABLE]                    Default: NATIVE_PACKAGES_SIGNING_KEY
+        verify-checksums FILE --public-key HEX_FILE Verify signature and artifact hashes
         aggregate DIR... --output DIRECTORY        Combine target builds before publishing
           [--finalize-recipes]                    Generate recipes from deferred builds
         publish --from DIRECTORY --to github,aur   Publish a complete, verified build
@@ -50,6 +55,11 @@ module NativePackages
         flags.on("--help", "-h") { puts HELP; return }
         flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare notarize-macos].include?(command)
         flags.on("--body-file FILE") { |value| options[:body_file] = Pathname.new(value).expand_path(root) } if command == "publish"
+        flags.on("--output FILE") { |value| options[:output] = Pathname.new(value).expand_path(root) } if command == "release-checksums"
+        if %w[sign-checksums verify-checksums].include?(command)
+          flags.on("--public-key FILE") { |value| options[:public_key] = Pathname.new(value).expand_path(root) }
+        end
+        flags.on("--key-env VARIABLE") { |value| options[:key_env] = value } if command == "sign-checksums"
         flags.on("--target ID") { |value| options[:ids] << value } if %w[build doctor publish].include?(command)
         if %w[build doctor].include?(command)
           flags.on("--format FORMAT") { |value| options[:formats] << value }
@@ -80,10 +90,21 @@ module NativePackages
       parser.parse!(arguments)
       raise Error, "publish --target requires --from" if command == "publish" && !options[:from] && !options[:ids].empty?
       arity = { "init" => 0..0, "migrate" => 0..0, "build" => 0..0, "doctor" => 0..0, "aggregate" => 1..,
+        "release-checksums" => 1..1, "sign-checksums" => 1..1, "verify-checksums" => 1..1,
         "prepare" => 1..1, "check" => 1..1, "artifacts" => 1..1, "publish-release" => 2..2,
         "notarize-macos" => 1..1, "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
         "publish-aur" => 1..1, "status" => 0..1, "check-version" => 1..1, "validate" => 0..0 }[command]
       raise Error, HELP unless arity&.cover?(arguments.length)
+      if %w[release-checksums sign-checksums verify-checksums].include?(command)
+        path = Pathname.new(arguments.first).expand_path(root)
+        if command == "release-checksums"
+          raise Error, "release-checksums requires --output" unless options[:output]
+          return ReleaseSigning.checksums(path, output: options.fetch(:output))
+        end
+        raise Error, "#{command} requires --public-key" unless options[:public_key]
+        return ReleaseSigning.sign(path, **options.slice(:public_key, :key_env)) if command == "sign-checksums"
+        return ReleaseSigning.verify(path, public_key: options.fetch(:public_key))
+      end
       if command == "init"
         raise Error, "init writes native-packages.yaml in the current directory" if config_path
         return Scaffold.new(root).init(**options.slice(:interactive, :name, :input).merge(formats: options[:init_formats]))

data/lib/native_packages/configuration.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
 
 require_relative "project"
+require_relative "appimage"
 
 module NativePackages
   class Configuration
     include Support
     NATIVE_FORMATS = %w[dmg inno].freeze
-    FORMATS = (%w[deb rpm archlinux apk ipk msix srpm] + NATIVE_FORMATS).freeze
+    FORMATS = (%w[deb rpm archlinux apk ipk msix srpm appimage] + NATIVE_FORMATS).freeze
     NFPM_VERSION = "2.47.0"
     NAMES = %w[native-packages.yaml native-packages.yml].freeze
     KEYS = %w[schema tool nfpm targets release assets templates repositories revisions libraries version_file version_section].freeze
@@ -59,8 +60,8 @@ module NativePackages
     def check_prerelease(version, selected, defer_recipes: false)
       return unless version.include?("-")
       raise Error, "prerelease builds require release.prereleases: true" unless data.fetch("release")["prereleases"] == true
-      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm dmg inno]).empty? } && (defer_recipes || data.fetch("templates").empty?)
-        raise Error, "prereleases support deb, rpm, dmg and inno only, without downstream recipes"
+      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm appimage dmg inno]).empty? } && (defer_recipes || data.fetch("templates").empty?)
+        raise Error, "prereleases support deb, rpm, appimage, dmg and inno only, without downstream recipes"
       end
     end
 
@@ -121,6 +122,10 @@ module NativePackages
         if kind == "binary" && target["platform"] == "linux"
           raise Error, "#{id}.libc: declare glibc, musl or static" unless %w[glibc musl static].include?(target["libc"])
         end
+        if formats.include?("appimage")
+          raise Error, "#{id}: AppImage requires a Linux binary target" unless target["platform"] == "linux" && kind == "binary"
+          AppImage.architecture(target)
+        end
         raise Error, "#{id}: IPK needs an explicit abi (device/distribution baseline)" if formats.include?("ipk") && target.fetch("abi", "").empty?
         input = mapping(target.fetch("input"), "#{id}.input")
         raise Error, "#{id}.input: declare local or release_asset" unless input["local"] || input["release_asset"]

data/lib/native_packages/inspection.rb

@@ -115,6 +115,8 @@ module NativePackages
           depends << (format == "deb" ? "libc6 (>= #{floor})" : "glibc >= #{floor}")
         end
         override["depends"] = depends.uniq
+      elsif format == "appimage"
+        # Nothing is bundled: the host supplies these, as for deb and rpm.
       elsif !external.empty? && package.fetch("overrides", {}).fetch(format, {}).fetch("depends", package.fetch("depends", [])).empty?
         raise Error, "#{format}: declare dependencies for #{external.join(', ')}"
       end

data/lib/native_packages/release_signing.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module NativePackages
+  # Portable release manifests, independent of package format or CI provider.
+  # Ed25519 signs the exact file bytes (no prehash, encoding or canonicalization).
+  module ReleaseSigning
+    LIMIT = 1024 * 1024
+    PUBLIC_PREFIX = ["302a300506032b6570032100"].pack("H*").freeze
+    FILENAME = /\A[A-Za-z0-9][A-Za-z0-9._+\-]*\z/
+    module_function
+
+    def checksums(directory, output:)
+      directory = Pathname.new(directory).realpath
+      output = Pathname.new(output).expand_path
+      raise Error, "invalid checksum filename" unless FILENAME.match?(output.basename.to_s)
+      raise Error, "checksum output must be inside the artifact directory" unless output.dirname.realpath == directory
+      raise Error, "refusing to overwrite checksum output" if output.exist? || output.symlink?
+      entries = directory.children.sort
+      raise Error, "no release artifacts" if entries.empty?
+      names = entries.map { |path| path.basename.to_s }
+      raise Error, "ambiguous artifact filenames" unless names.map(&:downcase).uniq.length == names.length
+      manifest = entries.map do |path|
+        name = path.basename.to_s
+        raise Error, "invalid artifact filename" unless FILENAME.match?(name)
+        raise Error, "signature already exists" if name == "#{output.basename}.sig"
+        regular_file!(path)
+        "#{Digest::SHA256.file(path).hexdigest}  #{name}\n"
+      end.join
+      raise Error, "release manifest exceeds 1 MiB" if manifest.bytesize > LIMIT
+      write_new(output, manifest)
+    end
+
+    def sign(manifest, public_key:, key_env: "NATIVE_PACKAGES_SIGNING_KEY")
+      raise Error, "invalid signing key variable name" unless /\A[A-Z][A-Z0-9_]*\z/.match?(key_env)
+      pem = ENV.delete(key_env)
+      raise Error, "missing signing key environment variable" if pem.nil? || pem.empty?
+      # No subprocess receives the private key, and no private file is created.
+      key = OpenSSL::PKey.read(pem, "")
+      trusted = read_public_key(public_key)
+      raise Error, "signing key does not match trusted Ed25519 public key" unless key.oid == "ED25519" && key.public_to_der == trusted.public_to_der
+      manifest = Pathname.new(manifest)
+      bytes = bounded_read(manifest, LIMIT)
+      verify_files(manifest, bytes)
+      signature = key.sign(nil, bytes)
+      raise Error, "could not verify generated signature" unless signature.bytesize == 64 && trusted.verify(nil, signature, bytes)
+      write_new(Pathname.new("#{manifest}.sig"), signature)
+    rescue OpenSSL::OpenSSLError
+      # Do not expose parser diagnostics from secret input.
+      raise Error, "could not use Ed25519 signing key"
+    end
+
+    def verify(manifest, public_key:)
+      manifest = Pathname.new(manifest)
+      bytes = bounded_read(manifest, LIMIT)
+      signature = bounded_read(Pathname.new("#{manifest}.sig"), 64)
+      trusted = read_public_key(public_key)
+      raise Error, "invalid release signature" unless signature.bytesize == 64 && trusted.verify(nil, signature, bytes)
+      verify_files(manifest, bytes)
+      true
+    rescue OpenSSL::OpenSSLError
+      raise Error, "invalid Ed25519 public key or release signature"
+    end
+
+    def read_public_key(path)
+      hex = bounded_read(Pathname.new(path), 128).strip
+      raise Error, "public key must be 32 bytes encoded as hex" unless /\A[0-9a-fA-F]{64}\z/.match?(hex)
+      OpenSSL::PKey.read(PUBLIC_PREFIX + [hex].pack("H*"))
+    end
+
+    def verify_files(manifest, bytes)
+      raise Error, "empty release manifest" if bytes.empty?
+      seen = {}
+      bytes.each_line do |line|
+        match = /\A([0-9a-fA-F]{64})  ([A-Za-z0-9][A-Za-z0-9._+\-]*)\n\z/.match(line)
+        raise Error, "invalid release checksum entry" unless match
+        digest, name = match.captures
+        raise Error, "duplicate or self-referencing checksum entry" if seen[name.downcase] || [manifest.basename.to_s.downcase, "#{manifest.basename}.sig".downcase].include?(name.downcase)
+        seen[name.downcase] = true
+        path = manifest.dirname / name
+        regular_file!(path)
+        raise Error, "release artifact checksum mismatch: #{name}" unless Digest::SHA256.file(path).hexdigest == digest.downcase
+      end
+    end
+
+    def regular_file!(path)
+      raise Error, "release input must be a regular file: #{path.basename}" unless path.lstat.file?
+    end
+
+    def bounded_read(path, limit)
+      regular_file!(path)
+      bytes = File.binread(path, limit + 1) || "".b
+      raise Error, "release metadata exceeds size limit" if bytes.bytesize > limit
+      bytes
+    end
+
+    def write_new(path, bytes)
+      File.open(path, File::WRONLY | File::CREAT | File::EXCL, 0o644) do |file|
+        file.binmode
+        file.write(bytes)
+      end
+      path
+    end
+  end
+end

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.6.0"
+  VERSION = "0.8.0"
   class Error < StandardError; end
 
   module Support

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Carmine Paolino
@@ -16,12 +16,30 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CONTRIBUTING.md
 - LICENSE
 - README.md
+- docs/404.md
+- docs/_guides/apple-notarization.md
+- docs/_guides/building-packages.md
+- docs/_guides/distribution-recipes.md
+- docs/_guides/getting-started.md
+- docs/_guides/github-actions.md
+- docs/_guides/multi-platform.md
+- docs/_guides/native-recipes.md
+- docs/_guides/prereleases.md
+- docs/_guides/publishing.md
+- docs/_guides/release-signing.md
+- docs/_reference/commands.md
+- docs/_reference/configuration.md
+- docs/_reference/platforms.md
+- docs/_reference/troubleshooting.md
 - docs/acceptance/0.5.0-notarization.md
 - docs/apple-notarization.md
+- docs/assets/images/logo.svg
 - docs/cli-design.md
 - docs/configuration.md
+- docs/index.md
 - docs/legacy.md
 - docs/native-recipes.md
 - docs/platforms.md
@@ -34,6 +52,7 @@ files:
 - examples/packaging/repositories.yml
 - exe/native-packages
 - lib/native_packages.rb
+- lib/native_packages/appimage.rb
 - lib/native_packages/build.rb
 - lib/native_packages/cli.rb
 - lib/native_packages/configuration.rb
@@ -41,6 +60,7 @@ files:
 - lib/native_packages/macos_signing.rb
 - lib/native_packages/native_recipe.rb
 - lib/native_packages/project.rb
+- lib/native_packages/release_signing.rb
 - lib/native_packages/repositories.rb
 - lib/native_packages/scaffold.rb
 - lib/native_packages/support.rb
@@ -64,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
-summary: Shared release packaging and downstream recipe updates with nFPM
+summary: Build native application packages and publish release updates
 test_files: []