@automattic/vip 4.1.3 → 4.1.5

package/.buildkite/build-macos-installer.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Package the already signed/notarized binaries from this build.
+[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
+: "${BIN_BASE:=vip-next}"
+
+if command -v install_gems >/dev/null 2>&1; then install_gems; else bundle install; fi
+if ! command -v go >/dev/null 2>&1; then brew install go; fi
+export GOFLAGS="${GOFLAGS:--mod=mod}"
+VERSION="$(go run -mod=mod ./cmd/stamp-version)"
+numeric_version="$(go run -mod=mod ./cmd/installer-version "$VERSION")"
+
+# This lane does not run in the binary job and never creates certificates.
+bundle exec fastlane configure_installer_signing
+stage="$(mktemp -d)"
+trap 'rm -rf "$stage"' EXIT
+buildkite-agent artifact download "dist/${BIN_BASE}-darwin-*.tar.gz*" "$stage" --step binaries-macos
+mkdir -p dist
+for arch in arm64 amd64; do
+  payload="$stage/$arch"
+  go run -mod=mod ./cmd/installer-payload darwin "$stage/dist/${BIN_BASE}-darwin-${arch}.tar.gz" "$payload"
+  bin="$payload/vip-next"
+  helper="$payload/go-search-replace"
+  bundle exec fastlane verify_code_signing binary:"$bin"
+  bundle exec fastlane verify_code_signing binary:"$helper"
+  pkg="dist/${BIN_BASE}-darwin-${arch}.pkg"
+  bash packaging/macos/build-pkg.sh "$VERSION" "$arch" "$bin" "$helper" "$pkg"
+  bundle exec fastlane sign_and_notarize_installer package:"$pkg"
+  python3 packaging/macos/verify-pkg.py "$pkg" "$numeric_version" "$arch" "$bin" "$helper"
+  shasum -a 256 "$pkg" > "$pkg.sha256"
+done
+# No automatic artifact_paths: failed/unsigned/partially verified packages must
+# never be uploaded by Buildkite's post-command hook.
+buildkite-agent artifact upload "dist/${BIN_BASE}-darwin-*.pkg;dist/${BIN_BASE}-darwin-*.pkg.sha256"

package/.buildkite/build-macos.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
-# Build, sign, and notarize the macOS vip-next artifacts on a Buildkite macOS
-# agent (queue: mac). Each arch is a tarball of vip-next + go-search-replace,
-# both codesigned and notarized. Checksums are written AFTER signing.
+# Build, sign, and notarize portable macOS binary archives.
+# Native installers consume these archives in a separate downstream job.
 
 [ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
 : "${BIN_BASE:=vip-next}"

package/.buildkite/build-windows-installer.ps1

@@ -0,0 +1,65 @@
+#Requires -Version 5.1
+# Consume the signed binaries from this build; installer failures are isolated.
+$ErrorActionPreference = 'Stop'
+$binBase = if ($env:BIN_BASE) { $env:BIN_BASE } else { 'vip-next' }
+
+# Any Go will do: go.mod's `toolchain` directive makes it fetch go1.27.0 itself.
+if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
+  Write-Host "--- :package: install go"
+  choco install golang -y --no-progress
+  if ($LASTEXITCODE -ne 0) { throw 'choco install golang failed' }
+  # choco updates the machine PATH, not this process's.
+  $env:PATH = "$env:PATH;$env:ProgramFiles\Go\bin"
+}
+go version
+if ($LASTEXITCODE -ne 0) { throw 'go not usable after install' }
+
+$version = (& go run -mod=mod ./cmd/stamp-version | Out-String).Trim()
+if ($LASTEXITCODE -ne 0 -or -not $version) { throw 'stamp-version failed' }
+$stage = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid().ToString())
+New-Item -ItemType Directory -Path $stage | Out-Null
+try {
+  # Agent v3 stores Windows artifact paths with backslashes; v4 uses slashes.
+  # Match either prefix while retaining the exact upstream step and platform.
+  buildkite-agent artifact download "*$binBase-windows-amd64.tar.gz*" $stage --step binaries-windows
+  if ($LASTEXITCODE -ne 0) { throw 'binary artifact download failed' }
+  $payload = Join-Path $stage 'payload'
+  go run -mod=mod ./cmd/installer-payload windows "$stage/dist/$binBase-windows-amd64.tar.gz" $payload
+  if ($LASTEXITCODE -ne 0) { throw 'binary archive verification failed' }
+  $out = Join-Path $payload 'vip-next.exe'
+  $helper = Join-Path $payload 'go-search-replace.exe'
+  . "$PSScriptRoot/sign-windows.ps1"
+  foreach ($binary in @($out, $helper)) {
+    & $env:SIGNTOOL_PATH verify /pa /v $binary
+    if ($LASTEXITCODE -ne 0) { throw "binary signature verification failed: $binary" }
+  }
+  New-Item -ItemType Directory -Force -Path dist | Out-Null
+  Write-Host "--- :package: MSI"
+  $dotnet = Get-Command dotnet -ErrorAction SilentlyContinue
+  $dotnetMajor = 0
+  if ($dotnet) {
+    $dotnetVersion = (& $dotnet.Source --version | Out-String).Trim()
+    if ($LASTEXITCODE -eq 0 -and $dotnetVersion -match '^(\d+)\.') {
+      $dotnetMajor = [int]$Matches[1]
+    }
+  }
+  if ($dotnetMajor -lt 8) {
+    choco install dotnet-8.0-sdk -y --no-progress
+    if ($LASTEXITCODE -ne 0) { throw 'choco install dotnet-8.0-sdk failed' }
+    $env:PATH = "$env:PATH;$env:ProgramFiles\dotnet"
+  }
+
+  $msi = "dist/$binBase-windows-amd64.msi"
+  & ./packaging/windows/build-msi.ps1 -Version $version -CLI $out -Helper $helper -Output $msi
+  if ($LASTEXITCODE -ne 0) { throw 'build-msi.ps1 failed' }
+  Sign-File $msi
+  & ./packaging/windows/verify-msi.ps1 -MSI $msi -CLI $out -Helper $helper
+  if ($LASTEXITCODE -ne 0) { throw 'verify-msi.ps1 failed' }
+  $msiHash = (Get-FileHash -Algorithm SHA256 $msi).Hash.ToLower()
+  "$msiHash *$(Split-Path $msi -Leaf)" | Set-Content "$msi.sha256" -NoNewline -Encoding ascii
+  # Upload only after the signed MSI and its payload have passed verification.
+  buildkite-agent artifact upload "$msi;$msi.sha256"
+  if ($LASTEXITCODE -ne 0) { throw 'installer artifact upload failed' }
+} finally {
+  Remove-Item $stage -Recurse -Force
+}

package/.buildkite/build-windows.ps1

@@ -43,24 +43,7 @@ bash .buildkite/fetch-search-replace.sh windows/amd64
 if ($LASTEXITCODE -ne 0) { throw 'fetch-search-replace.sh failed' }
 $helper = 'third_party/go-search-replace/windows-amd64/go-search-replace.exe'
 
-Write-Host "--- :closed_lock_with_key: Azure Trusted Signing"
-$setupScript = (Get-Command setup_azure_trusted_signing.ps1 -ErrorAction Stop).Source
-& $setupScript
-if ($LASTEXITCODE -ne 0) { throw 'setup_azure_trusted_signing.ps1 failed' }
-
-function Sign-File([string]$path) {
-  Write-Host "--- :closed_lock_with_key: Authenticode sign $path"
-  & $env:SIGNTOOL_PATH sign /v `
-    /fd $env:AZURE_FILE_DIGEST `
-    /tr $env:AZURE_TIMESTAMP_SERVER `
-    /td $env:AZURE_TIMESTAMP_DIGEST `
-    /dlib $env:AZURE_CODE_SIGNING_DLIB `
-    /dmdf $env:AZURE_METADATA_JSON `
-    $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool sign failed for $path" }
-  & $env:SIGNTOOL_PATH verify /pa /v $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool verify failed for $path" }
-}
+. "$PSScriptRoot/sign-windows.ps1"
 
 Sign-File $out
 Sign-File $helper
@@ -72,4 +55,5 @@ if ($LASTEXITCODE -ne 0) { throw 'pack-release.sh failed' }
 $tar = "dist/$binBase-windows-amd64.tar.gz"
 $hash = (Get-FileHash -Algorithm SHA256 $tar).Hash.ToLower()
 "$hash *$(Split-Path $tar -Leaf)" | Set-Content "$tar.sha256" -NoNewline
+
 Remove-Item $out -Force

package/.buildkite/pipeline.yml

@@ -13,6 +13,7 @@ env:
 
 steps:
   - label: ':macos: Build & sign (macOS)'
+    key: binaries-macos
     command: .buildkite/build-macos.sh
     plugins:
       - $CI_TOOLKIT_PLUGIN
@@ -27,6 +28,7 @@ steps:
       - 'dist/vip-next-darwin-*.tar.gz*'
 
   - label: ':windows: Build & sign (Windows)'
+    key: binaries-windows
     command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows.ps1
     plugins:
       - $CI_TOOLKIT_PLUGIN
@@ -47,3 +49,33 @@ steps:
           context: 'Build (Linux)'
     artifact_paths:
       - 'dist/vip-next-linux-*.tar.gz*'
+
+  # Installer failures remain visible but cannot fail the binary release build.
+  # Scripts explicitly upload only fully signed and verified installer pairs.
+  - label: ':macos: Package & sign installer (macOS)'
+    key: installer-macos
+    depends_on: binaries-macos
+    soft_fail: true
+    command: bash .buildkite/build-macos-installer.sh
+    plugins:
+      - $CI_TOOLKIT_PLUGIN
+    agents:
+      queue: mac
+    env:
+      IMAGE_ID: $IMAGE_ID
+    notify:
+      - github_commit_status:
+          context: 'Package & sign installer (macOS)'
+
+  - label: ':windows: Package & sign installer (Windows)'
+    key: installer-windows
+    depends_on: binaries-windows
+    soft_fail: true
+    command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows-installer.ps1
+    plugins:
+      - $CI_TOOLKIT_PLUGIN
+    agents:
+      queue: windows
+    notify:
+      - github_commit_status:
+          context: 'Package & sign installer (Windows)'

package/.buildkite/sign-windows.ps1

@@ -0,0 +1,21 @@
+# Shared Azure setup and signing for independent binary and installer jobs.
+$ErrorActionPreference = 'Stop'
+
+Write-Host "--- :closed_lock_with_key: Azure Trusted Signing"
+$setupScript = (Get-Command setup_azure_trusted_signing.ps1 -ErrorAction Stop).Source
+& $setupScript
+if ($LASTEXITCODE -ne 0) { throw 'setup_azure_trusted_signing.ps1 failed' }
+
+function Sign-File([string]$path) {
+  Write-Host "--- :closed_lock_with_key: Authenticode sign $path"
+  & $env:SIGNTOOL_PATH sign /v `
+    /fd $env:AZURE_FILE_DIGEST `
+    /tr $env:AZURE_TIMESTAMP_SERVER `
+    /td $env:AZURE_TIMESTAMP_DIGEST `
+    /dlib $env:AZURE_CODE_SIGNING_DLIB `
+    /dmdf $env:AZURE_METADATA_JSON `
+    $path
+  if ($LASTEXITCODE -ne 0) { throw "signtool sign failed for $path" }
+  & $env:SIGNTOOL_PATH verify /pa /v $path
+  if ($LASTEXITCODE -ne 0) { throw "signtool verify failed for $path" }
+}

package/.buildkite/test-windows-installer-download.ps1

@@ -0,0 +1,54 @@
+#Requires -Version 5.1
+# Run the real installer script through artifact lookup with agent-v3 Windows
+# paths. Stop before package construction; no signing or host installation.
+$ErrorActionPreference = 'Stop'
+$previousBinBase = $env:BIN_BASE
+$env:BIN_BASE = 'vip-next'
+
+function go {
+  $global:LASTEXITCODE = 0
+  if ($args[0] -eq 'version') { return 'go version test' }
+  if ($args -contains './cmd/stamp-version') { return '5.0.0-alpha.1' }
+  if ($args -contains './cmd/installer-payload') {
+    $archive = $args[$args.Count - 2]
+    if (-not (Test-Path -LiteralPath $archive) -or -not (Test-Path -LiteralPath "$archive.sha256")) {
+      throw 'Downloaded artifacts were not placed at the expected extraction paths'
+    }
+    throw 'TEST_STOP_BEFORE_PACKAGING'
+  }
+  throw "Unexpected Go invocation: $args"
+}
+
+function buildkite-agent {
+  if ($args[0] -ne 'artifact' -or $args[1] -ne 'download' -or
+      $args[4] -ne '--step' -or $args[5] -ne 'binaries-windows') {
+    throw "Unexpected or unscoped artifact command: $args"
+  }
+  $pattern = '^' + [regex]::Escape($args[2]).Replace('\*', '.*') + '$'
+  # These are the paths actually recorded by Buildkite build #96.
+  $paths = @("dist${artifactSeparator}vip-next-windows-amd64.tar.gz", "dist${artifactSeparator}vip-next-windows-amd64.tar.gz.sha256")
+  $matches = @($paths | Where-Object { $_ -cmatch $pattern })
+  $global:LASTEXITCODE = 1
+  if ($matches.Count -ne 2) { return }
+  foreach ($path in $matches) {
+    $destination = Join-Path $args[3] $path
+    New-Item -ItemType Directory -Force -Path (Split-Path $destination -Parent) | Out-Null
+    [System.IO.File]::WriteAllText($destination, 'test artifact')
+  }
+  $global:LASTEXITCODE = 0
+}
+
+try {
+  foreach ($artifactSeparator in @('\', '/')) {
+    try {
+      & "$PSScriptRoot/build-windows-installer.ps1"
+      throw 'Installer script did not stop at the test boundary'
+    } catch {
+      # Only the Go extraction stub emits this after verifying both downloads.
+      if ($_.Exception.Message -ne 'TEST_STOP_BEFORE_PACKAGING') { throw }
+    }
+  }
+  Write-Host 'Windows artifact lookup regression passed for both separator styles'
+} finally {
+  $env:BIN_BASE = $previousBinBase
+}

package/.buildkite/test_pipeline.py

@@ -0,0 +1,69 @@
+"""Exercise the real binary script with unavailable installer signing."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class SigningIsolationTest(unittest.TestCase):
+    def test_binary_archives_survive_unavailable_installer_signing(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / ".buildkite").mkdir()
+            (root / "tools").mkdir()
+            for name in ["build-macos.sh", "pack-release.sh", "build-macos-installer.sh"]:
+                shutil.copy2(ROOT / ".buildkite" / name, root / ".buildkite" / name)
+
+            def executable(name, content):
+                target = root / name
+                target.write_text("#!/usr/bin/env bash\nset -eu\n" + content)
+                target.chmod(0o755)
+
+            executable(".buildkite/fetch-search-replace.sh", '''
+for arch in arm64 amd64; do
+  mkdir -p "third_party/go-search-replace/darwin-$arch"
+  printf '#!/bin/sh\\nexit 0\\n' > "third_party/go-search-replace/darwin-$arch/go-search-replace"
+done
+''')
+            executable("tools/go", '''
+case "$*" in
+  *stamp-version*) echo 5.0.0-alpha.1 ;;
+  *installer-version*) echo 5.0.101 ;;
+  build*)
+    while [ "$1" != -o ]; do shift; done
+    printf '#!/bin/sh\\nexit 0\\n' > "$2"
+    chmod +x "$2" ;;
+esac
+''')
+            executable("tools/bundle", '''
+printf '%s\\n' "$*" >> "$CALL_LOG"
+case "$*" in
+  *installer*) echo 'Installer certificate unavailable' >&2; exit 1 ;;
+esac
+''')
+            executable("tools/buildkite-agent", 'echo "unexpected artifact operation" >&2; exit 99\n')
+            env = dict(os.environ, PATH=str(root / "tools") + os.pathsep + os.environ["PATH"],
+                       CALL_LOG=str(root / "calls"), BIN_BASE="vip-next")
+            binary = subprocess.run(["bash", ".buildkite/build-macos.sh"], cwd=root, env=env,
+                                    capture_output=True, text=True)
+            self.assertEqual(binary.returncode, 0, binary.stdout + binary.stderr)
+            archives = sorted((root / "dist").glob("*.tar.gz*"))
+            self.assertEqual(len(archives), 4)
+            before = {p.name: p.read_bytes() for p in archives}
+            calls = (root / "calls").read_text()
+            self.assertIn("configure_code_signing", calls)
+            self.assertNotIn("installer", calls)
+            installer = subprocess.run(["bash", ".buildkite/build-macos-installer.sh"], cwd=root,
+                                       env=env, capture_output=True, text=True)
+            self.assertNotEqual(installer.returncode, 0)
+            self.assertIn("Installer certificate unavailable", installer.stderr)
+            self.assertEqual(before, {p.name: p.read_bytes() for p in archives})
+            self.assertFalse(list((root / "dist").glob("*.pkg*")))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/Gemfile.lock

@@ -8,8 +8,8 @@ GEM
     artifactory (3.0.17)
     atomos (0.1.3)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1282.0)
-    aws-sdk-core (3.254.1)
+    aws-partitions (1.1287.0)
+    aws-sdk-core (3.257.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -17,11 +17,12 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.130.0)
-      aws-sdk-core (~> 3, >= 3.254.0)
+      rexml (~> 3.4, >= 3.4.2)
+    aws-sdk-kms (1.132.0)
+      aws-sdk-core (~> 3, >= 3.256.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.229.0)
-      aws-sdk-core (~> 3, >= 3.254.1)
+    aws-sdk-s3 (1.232.1)
+      aws-sdk-core (~> 3, >= 3.256.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
@@ -29,7 +30,8 @@ GEM
     babosa (1.0.4)
     base64 (0.3.0)
     benchmark (0.5.0)
-    bigdecimal (4.1.2)
+    bigdecimal (4.1.3)
+    cgi (0.5.2)
     claide (1.1.0)
     colored (1.2)
     colored2 (3.1.2)
@@ -39,13 +41,13 @@ GEM
     declarative (0.0.20)
     digest-crc (0.7.0)
       rake (>= 12.0.0, < 14.0.0)
-    domain_name (0.6.20260829)
+    domain_name (0.6.20260907)
     dotenv (2.8.1)
     emoji_regex (3.2.3)
     erb (6.0.7)
     excon (1.7.1)
       logger
-    faraday (2.14.3)
+    faraday (2.14.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
@@ -61,7 +63,7 @@ GEM
     faraday-retry (2.4.0)
       faraday (~> 2.0)
     fastimage (2.4.1)
-    fastlane (2.238.0)
+    fastlane (2.240.1)
       CFPropertyList (>= 2.3, < 5.0.0)
       abbrev (~> 0.1)
       addressable (>= 2.9.0, < 3.0.0)
@@ -71,6 +73,7 @@ GEM
       base64 (~> 0.2)
       benchmark (>= 0.1.0)
       bundler (>= 2.4.0, < 5.0.0)
+      cgi (~> 0.4)
       colored (~> 1.2)
       commander (~> 4.6)
       csv (~> 3.3)
@@ -85,12 +88,11 @@ GEM
       fastimage (>= 2.1.0, < 3.0.0)
       fastlane-sirp (>= 1.1.0)
       gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-androidpublisher_v3 (~> 0.99)
       google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-env (>= 1.6.0, < 2.4.0)
       google-cloud-storage (~> 1.31)
       highline (~> 2.0)
-      http-cookie (~> 1.0.5)
       irb (>= 1.8)
       json (< 3.0.0)
       jwt (>= 2.10.3, < 4)
@@ -104,8 +106,8 @@ GEM
       optparse (>= 0.1.1, < 1.0.0)
       ostruct (>= 0.1.0)
       plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 2.0.0, < 3.0.0)
-      security (= 0.1.5)
+      rubyzip (>= 3.4.0, < 4.0.0)
+      security (~> 0.3)
       simctl (~> 1.6.3)
       terminal-notifier (>= 2.0.0, < 3.0.0)
       terminal-table (~> 4)
@@ -117,7 +119,7 @@ GEM
       xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
     fastlane-sirp (1.1.0)
     gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.107.0)
+    google-apis-androidpublisher_v3 (0.108.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-apis-core (1.2.5)
       addressable (~> 2.9)
@@ -132,12 +134,12 @@ GEM
       google-apis-core (>= 0.15.0, < 2.a)
     google-apis-playcustomapp_v1 (0.18.0)
       google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-storage_v1 (0.66.0)
+    google-apis-storage_v1 (0.67.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-cloud-core (1.9.0)
       google-cloud-env (>= 1.0, < 3.a)
       google-cloud-errors (~> 1.0)
-    google-cloud-env (2.2.2)
+    google-cloud-env (2.3.1)
       base64 (~> 0.2)
       faraday (>= 1.0, < 3.a)
     google-cloud-errors (1.7.0)
@@ -160,9 +162,9 @@ GEM
       pstore (~> 0.1)
       signet (>= 0.16, < 2.a)
     highline (2.0.3)
-    http-cookie (1.0.8)
+    http-cookie (1.1.6)
       domain_name (~> 0.5)
-    io-console (0.9.2)
+    io-console (0.9.4)
     irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
@@ -170,12 +172,12 @@ GEM
       reline (>= 0.4.2)
     jmespath (1.6.2)
     json (2.21.2)
-    jwt (3.2.0)
+    jwt (3.3.0)
       base64
     logger (1.7.0)
     mini_magick (4.13.2)
     mini_mime (1.1.5)
-    multi_json (1.21.1)
+    multi_json (1.21.2)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
     nanaimo (0.4.0)
@@ -213,8 +215,8 @@ GEM
     retriable (4.2.0)
     rexml (3.4.4)
     rouge (3.28.0)
-    rubyzip (2.4.1)
-    security (0.1.5)
+    rubyzip (3.6.0)
+    security (0.3.0)
     signet (0.22.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
@@ -272,16 +274,17 @@ CHECKSUMS
   artifactory (3.0.17) sha256=3023d5c964c31674090d655a516f38ca75665c15084140c08b7f2841131af263
   atomos (0.1.3) sha256=7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f
   aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
-  aws-partitions (1.1282.0) sha256=d6c7c4ad2e4f8cd4ca56445bfbb3958fec0deecd959c1e2bcd3a83c9aa308c18
-  aws-sdk-core (3.254.1) sha256=518089e32134c3478cd4ec63d07fb966546a45e9e4cbf5f80d2cf16d5699d29b
-  aws-sdk-kms (1.130.0) sha256=a2e83662ca31b77a2a19c9aa2f40a98165a67270c18c718fe1c70d0cbd7cd749
-  aws-sdk-s3 (1.229.0) sha256=7dd11a111875b3505d2ec0a0a383a6aab6c1badb3d4e94e7fbb958a24451f596
+  aws-partitions (1.1287.0) sha256=76f4c73011654553566c5db5bbef0f24738bb016e923910e8b1b3f9cb7d989ca
+  aws-sdk-core (3.257.0) sha256=a92ad19c7ff668cec6688ee3200ee562da80647a3bbeed9fda02e8b0ca6492c6
+  aws-sdk-kms (1.132.0) sha256=094b0097bb3be9d5c1ac87e971ca7f5aebb746801dfb5f0f576480bf98dca69c
+  aws-sdk-s3 (1.232.1) sha256=124440f3a44fbc28cc3a2dec6eaeeea2a236bfc33772005010a19baa62654870
   aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
   babosa (1.0.4) sha256=18dea450f595462ed7cb80595abd76b2e535db8c91b350f6c4b3d73986c5bc99
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
-  bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+  bigdecimal (4.1.3) sha256=61ebe1e5e559bdc3cc6f2c0ee7f427321fc838f59611c294356eb04d6e21cf66
   bundler (4.0.18) sha256=02d9a17429de1847b4e0c9f27a9ee4b20c0a74c0a641b4e77195d6019e3618ac
+  cgi (0.5.2) sha256=61ca30298171190fd4fa0d8018e57ada456eae9b7a2b78526debf7f0a0e6f8bb
   claide (1.1.0) sha256=6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e
   colored (1.2) sha256=9d82b47ac589ce7f6cab64b1f194a2009e9fd00c326a5357321f44afab2c1d2c
   colored2 (3.1.2) sha256=b13c2bd7eeae2cf7356a62501d398e72fde78780bd26aec6a979578293c28b4a
@@ -289,43 +292,43 @@ CHECKSUMS
   csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456
   declarative (0.0.20) sha256=8021dd6cb17ab2b61233c56903d3f5a259c5cf43c80ff332d447d395b17d9ff9
   digest-crc (0.7.0) sha256=64adc23a26a241044cbe6732477ca1b3c281d79e2240bcff275a37a5a0d78c07
-  domain_name (0.6.20260829) sha256=a9c1aa678423b9db3a4193b300fd76b9c21cb2a5f60d7dcf0a832b82d13764f0
+  domain_name (0.6.20260907) sha256=5517a7f82c4464a61fc17133c3f6a02833faa13533c16c07e8f73b11d872cb03
   dotenv (2.8.1) sha256=c5944793349ae03c432e1780a2ca929d60b88c7d14d52d630db0508c3a8a17d8
   emoji_regex (3.2.3) sha256=ecd8be856b7691406c6bf3bb3a5e55d6ed683ffab98b4aa531bb90e1ddcc564b
   erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
   excon (1.7.1) sha256=dd2d870eece1b5ce4e4f9efd938e67a69ccd8c003c3825b638b937e1082eaac2
-  faraday (2.14.3) sha256=1882247e6766615c8220b4392bf1d27f6ebb63d8e28267587cef1fb0bf37f278
+  faraday (2.14.4) sha256=9bb4408c44621b0dbaaaa39e5dbfc4dbe58cc6751b6eb94d16ae9e1f2f2fab6e
   faraday-cookie_jar (0.0.8) sha256=0140605823f8cc63c7028fccee486aaed8e54835c360cffc1f7c8c07c4299dbb
   faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
   faraday-multipart (1.2.0) sha256=7d89a949693714176f612323ca13746a2ded204031a6ba528adee788694ef757
   faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
   faraday-retry (2.4.0) sha256=7b79c48fb7e56526faf247b12d94a680071ff40c9fda7cf1ec1549439ad11ebe
   fastimage (2.4.1) sha256=c64bebd46b6fd8943ab70c1e6e85ff728f970f2e48f92ecd249b6bc3a540ad20
-  fastlane (2.238.0) sha256=78e9252df2224c7e427012638e41051edfa29b133a40fda883fd2f1c13a77b98
+  fastlane (2.240.1) sha256=cf792bc99ec6af6574ea416cda6530f519c8b4b3a46b1a3b52488ebf1696aa5c
   fastlane-sirp (1.1.0) sha256=10bc94f9682efd8e1badfb31452a76dd8981f1f3a33717c765fde6d75b54d847
   gh_inspector (1.1.3) sha256=04cca7171b87164e053aa43147971d3b7f500fcb58177698886b48a9fc4a1939
-  google-apis-androidpublisher_v3 (0.107.0) sha256=b8207eecc89e6a9f7ea11aa88a07bccdcae5ca90121330079db4ef4696a2f3ff
+  google-apis-androidpublisher_v3 (0.108.0) sha256=11a8b1885dce62ef28d8b7f16225d67e60c77b5baf16310a31d33fb1dc3c2d4e
   google-apis-core (1.2.5) sha256=e21562b5627a0fc6a0c3165e429c3afed0f6a628eaa514e83f7204dda1adff69
   google-apis-iamcredentials_v1 (0.28.0) sha256=0a92ffe6cc39c569554af2a77a25dfc61519ed8bbb64ab04cffdd352dc5ef106
   google-apis-playcustomapp_v1 (0.18.0) sha256=44b277b9dee4a59ac5e9d98be1485edc5e382d2f9d73c79ae8908a455786a254
-  google-apis-storage_v1 (0.66.0) sha256=fdf6d65d3fc77e7046b3494333a818ece9e2afd763bb161e1a7a9e70cf198351
+  google-apis-storage_v1 (0.67.0) sha256=13befc89bf03512783f535d214590f15993b0c56411155fd8090ca607e1b8d20
   google-cloud-core (1.9.0) sha256=ab55409f51488e8deefb6edcc1ce4771dfb5da2fe7b3bc075709a030c2b682a4
-  google-cloud-env (2.2.2) sha256=94bed40e05a67e9468ce1cb38389fba9a90aa8fc62fc9e173204c1dca59e21e7
+  google-cloud-env (2.3.1) sha256=0faac01eb27be78c2591d64433663b1a114f8f7af55a4f819755426cac9178e7
   google-cloud-errors (1.7.0) sha256=6e682f42d89aae08689f36f28495de629d756da076bafff0003bac7f8042ebb3
   google-cloud-storage (1.62.0) sha256=e2c3c08bf8fd40d50be92304084942203314d4fc0ee52028e99f9359c3ad1330
   google-logging-utils (0.2.0) sha256=675462b4ea5affa825a3442694ca2d75d0069455a1d0956127207498fca3df7b
   googleauth (1.17.4) sha256=acc2cac2a6011048f149c922cbc6c9675719e165aa5000c7fa3876c480fe9ae3
   highline (2.0.3) sha256=2ddd5c127d4692721486f91737307236fe005352d12a4202e26c48614f719479
-  http-cookie (1.0.8) sha256=b14fe0445cf24bf9ae098633e9b8d42e4c07c3c1f700672b09fbfe32ffd41aa6
-  io-console (0.9.2) sha256=efa74f891dd03c0939a931dfc6e74c2813d904763d456ea9762b0525e748db08
+  http-cookie (1.1.6) sha256=ba4b82be64de61dc281243dac70e3c382c45142f20268ed9276a3670c93feaa9
+  io-console (0.9.4) sha256=a403304f32928ee85e56d457b4612ca43f2703b561a3258844992bd24085fbb1
   irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
   jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
   json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a
-  jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
+  jwt (3.3.0) sha256=44cc34fbc341c148233cf66641522b4bce0dfb1ce55e8073f05c56f44f4ee546
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   mini_magick (4.13.2) sha256=71d6258e0e8a3d04a9a0a09784d5d857b403a198a51dd4f882510435eb95ddd9
   mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
-  multi_json (1.21.1) sha256=e6126a31808e3b4d19f483c775ceac34df190dffa62adfb63a165ee14ba68080
+  multi_json (1.21.2) sha256=245531eaf54bdba57aba515ff08b4503505c5e09911daa89c5a561e2f85bea8e
   multipart-post (2.4.1) sha256=9872d03a8e552020ca096adadbf5e3cb1cd1cdd6acd3c161136b8a5737cdb4a8
   mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751
   nanaimo (0.4.0) sha256=faf069551bab17f15169c1f74a1c73c220657e71b6e900919897a10d991d0723
@@ -350,8 +353,8 @@ CHECKSUMS
   retriable (4.2.0) sha256=90c3b257472a1c02f2a3dfa64dd35a420f7a624cef1a5981e20fdac5730f8cdc
   rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
   rouge (3.28.0) sha256=0d6de482c7624000d92697772ab14e48dca35629f8ddf3f4b21c99183fd70e20
-  rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615
-  security (0.1.5) sha256=3a977a0eca7706e804c96db0dd9619e0a94969fe3aac9680fcfc2bf9b8a833b7
+  rubyzip (3.6.0) sha256=268994d44d62282d1cfd99bf10eae48d7267199158ad7ea3e1fee2da9458b695
+  security (0.3.0) sha256=bc9d06718258a96c8552ce4044bfe69144491b10d3403d74c4753a03a720ecf0
   signet (0.22.0) sha256=b76d495ccb07ad35dbc89f3e920665a9d8ed717141955034005d7843dcfe4780
   simctl (1.6.10) sha256=b99077f4d13ad81eace9f86bf5ba4df1b0b893a4d1b368bd3ed59b5b27f9236b
   terminal-notifier (2.0.0) sha256=7a0d2b2212ab9835c07f4b2e22a94cff64149dba1eed203c04835f7991078cea

package/cmd/installer-payload/main.go

@@ -0,0 +1,19 @@
+// installer-payload extracts verified binary artifacts for native packaging.
+package main
+
+import (
+	"fmt"
+	"github.com/Automattic/vip/internal/releasepromotion"
+	"os"
+)
+
+func main() {
+	if len(os.Args) != 4 {
+		fmt.Fprintln(os.Stderr, "usage: installer-payload <darwin|windows> <archive> <new-directory>")
+		os.Exit(1)
+	}
+	if err := releasepromotion.ExtractBinaryArchive(os.Args[1], os.Args[2], os.Args[3]); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}

package/cmd/installer-version/main.go

@@ -0,0 +1,22 @@
+// installer-version converts the Go release stamp into a native package version.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/Automattic/vip/internal/installer"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintln(os.Stderr, "usage: installer-version <version>")
+		os.Exit(1)
+	}
+	v, err := installer.NumericVersion(os.Args[1])
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	fmt.Println(v)
+}