@rightkit/release 0.2.0

package/sign-windows.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const EXCLUDE_CREDENTIALS = [
+  "ManagedIdentityCredential",
+  "WorkloadIdentityCredential",
+  "SharedTokenCacheCredential",
+  "VisualStudioCredential",
+  "VisualStudioCodeCredential",
+  "AzurePowerShellCredential",
+  "AzureDeveloperCliCredential",
+  "InteractiveBrowserCredential",
+];
+const userEnvCache = new Map();
+
+const args = process.argv.slice(2);
+const dryRun = args.includes("--dry-run");
+const files = args.filter((arg) => arg !== "--dry-run").map((arg) => path.resolve(arg));
+
+if (!files.length) fail("usage: node sign-windows.mjs [--dry-run] <file>...");
+if (dryRun) {
+  console.log(`dry-run: Azure Artifact Signing ${files.join(", ")}`);
+  process.exit(0);
+}
+if (process.platform !== "win32") fail("Windows signing must run on Windows");
+for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
+
+const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
+const dlib = findFirst([
+  env("AZURE_CODESIGN_DLIB_PATH"),
+  env("AZURE_ARTIFACT_SIGNING_DLIB_PATH"),
+  path.join(env("LOCALAPPDATA") || "", "AzureArtifactSigningTools", "Microsoft.ArtifactSigning.Client", "bin", "x64", "Azure.CodeSigning.Dlib.dll"),
+  "C:\\Program Files\\Microsoft Azure Artifact Signing Client Tools\\x64\\Azure.CodeSigning.Dlib.dll",
+  "C:\\Program Files (x86)\\Microsoft\\ArtifactSigningClientTools\\bin\\x64\\Azure.CodeSigning.Dlib.dll",
+]);
+if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
+if (!dlib) fail("Azure.CodeSigning.Dlib.dll not found; set AZURE_CODESIGN_DLIB_PATH or install Azure Artifact Signing Client Tools");
+
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "right-sign-"));
+const metadata = metadataPath(tempDir);
+const childEnv = signingEnv();
+try {
+  for (const file of files) {
+    run(signtool, ["sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", "/dlib", dlib, "/dmdf", metadata, file]);
+    run(signtool, ["verify", "/pa", "/v", file]);
+  }
+} finally {
+  rmSync(tempDir, { recursive: true, force: true });
+}
+
+function metadataPath(dir) {
+  const existing = env("AZURE_ARTIFACT_SIGNING_METADATA") || env("AZURE_SIGNING_METADATA");
+  if (existing) {
+    if (!existsSync(existing)) fail(`metadata file not found: ${existing}`);
+    return existing;
+  }
+  const Endpoint = env("AZURE_ARTIFACT_SIGNING_ENDPOINT") || env("AZURE_SIGNING_ENDPOINT") || env("AZURE_ENDPOINT");
+  const CodeSigningAccountName = env("AZURE_ARTIFACT_SIGNING_ACCOUNT") || env("AZURE_SIGNING_ACCOUNT_NAME") || env("AZURE_ACCOUNT");
+  const CertificateProfileName = env("AZURE_ARTIFACT_SIGNING_PROFILE") || env("AZURE_CERTIFICATE_PROFILE_NAME") || env("AZURE_PROFILE");
+  if (!Endpoint || !CodeSigningAccountName || !CertificateProfileName) {
+    fail("set AZURE_ARTIFACT_SIGNING_ENDPOINT, AZURE_ARTIFACT_SIGNING_ACCOUNT, and AZURE_ARTIFACT_SIGNING_PROFILE");
+  }
+  const file = path.join(dir, "metadata.json");
+  writeFileSync(file, `${JSON.stringify({ Endpoint, CodeSigningAccountName, CertificateProfileName, ExcludeCredentials: EXCLUDE_CREDENTIALS }, null, 2)}\n`);
+  return file;
+}
+
+function signingEnv() {
+  const paths = [path.dirname(findFirst(azureCliCandidates()) ?? ""), env("PATH")].filter(Boolean);
+  return { ...process.env, PATH: paths.join(path.delimiter) };
+}
+
+function azureCliCandidates() {
+  return [
+    path.join(env("LOCALAPPDATA") || "", "AzureCLI", "bin", "az.cmd"),
+    path.join(env("ProgramFiles(x86)") || "C:\\Program Files (x86)", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
+    path.join(env("ProgramFiles") || "C:\\Program Files", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
+  ];
+}
+
+function signtoolCandidates() {
+  return [
+    ...sdkBuildToolsCandidates(),
+    ...windowsKitCandidates(path.join(env("ProgramFiles(x86)") || "C:\\Program Files (x86)", "Windows Kits", "10", "bin")),
+  ];
+}
+
+function sdkBuildToolsCandidates() {
+  const bin = path.join(env("LOCALAPPDATA") || "", "AzureArtifactSigningTools", "Microsoft.Windows.SDK.BuildTools", "bin");
+  return windowsKitCandidates(bin);
+}
+
+function windowsKitCandidates(bin) {
+  if (!existsSync(bin)) return [];
+  return readdirSync(bin, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(bin, entry.name, "x64", "signtool.exe"))
+    .sort()
+    .reverse();
+}
+
+function findFirst(candidates) {
+  return candidates.find((candidate) => candidate && existsSync(candidate));
+}
+
+function env(name) {
+  return process.env[name] || userEnv(name);
+}
+
+function userEnv(name) {
+  if (userEnvCache.has(name)) return userEnvCache.get(name);
+  const result = spawnSync("powershell", [
+    "-NoProfile",
+    "-Command",
+    `[Environment]::GetEnvironmentVariable('${name.replace(/'/g, "''")}','User')`,
+  ], { encoding: "utf8", windowsHide: true });
+  const value = result.status === 0 ? result.stdout.trim() : "";
+  userEnvCache.set(name, value);
+  return value;
+}
+
+function run(cmd, runArgs) {
+  const result = spawnSync(cmd, runArgs, { env: childEnv, stdio: "inherit" });
+  if (result.status !== 0) process.exit(result.status ?? 1);
+}
+
+function fail(message) {
+  console.error(`right-sign-windows: ${message}`);
+  process.exit(1);
+}

package/upload-large.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { createReadStream, statSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev";
+const PART_SIZE = 90 * 1024 * 1024;
+
+const [, , localFile, r2Key, bucket = "public"] = process.argv;
+if (!localFile || !r2Key) {
+  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
+  process.exit(1);
+}
+
+const token = process.env.ADMIN_UPLOAD_TOKEN || readKeychainToken();
+if (!token) {
+  console.error("ADMIN_UPLOAD_TOKEN not set and no Keychain token found");
+  process.exit(1);
+}
+
+const headers = { Authorization: `Bearer ${token}` };
+const fileSize = statSync(localFile).size;
+
+async function api(method, pathname, body, isJson = true) {
+  const opts = {
+    method,
+    headers: isJson
+      ? { ...headers, "Content-Type": "application/json" }
+      : { ...headers, "Content-Type": "application/octet-stream" },
+  };
+  if (body != null) opts.body = isJson ? JSON.stringify(body) : body;
+  const resp = await fetch(`${WORKER_BASE}${pathname}`, opts);
+  const text = await resp.text();
+  if (!resp.ok) throw new Error(`${method} ${pathname} -> ${resp.status}: ${text}`);
+  return JSON.parse(text);
+}
+
+async function readChunk(offset, size) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const stream = createReadStream(localFile, { start: offset, end: offset + size - 1 });
+    stream.on("data", (c) => chunks.push(c));
+    stream.on("end", () => resolve(Buffer.concat(chunks)));
+    stream.on("error", reject);
+  });
+}
+
+console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${bucket}/${r2Key}`);
+const { uploadId } = await api("POST", "/admin/multipart/init", { key: r2Key, bucket });
+const parts = [];
+const totalParts = Math.ceil(fileSize / PART_SIZE);
+for (let i = 0; i < totalParts; i++) {
+  const offset = i * PART_SIZE;
+  const size = Math.min(PART_SIZE, fileSize - offset);
+  const partNumber = i + 1;
+  const chunk = await readChunk(offset, size);
+  const params = `?uploadId=${encodeURIComponent(uploadId)}&key=${encodeURIComponent(r2Key)}&bucket=${bucket}`;
+  const { etag } = await api("PUT", `/admin/multipart/part/${partNumber}${params}`, chunk, false);
+  parts.push({ partNumber, etag });
+  console.log(`  part ${partNumber}/${totalParts}`);
+}
+await api("POST", "/admin/multipart/complete", { uploadId, key: r2Key, bucket, parts });
+console.log(`Done. ${r2Key} uploaded to ${bucket}.`);
+
+function readKeychainToken() {
+  if (process.platform !== "darwin") return "";
+  for (const service of ["rightapps-admin-upload-token", "heardright-admin-upload-token"]) {
+    const result = spawnSync("security", ["find-generic-password", "-a", process.env.USER || "", "-s", service, "-w"], {
+      encoding: "utf8",
+    });
+    if (result.status === 0 && result.stdout.trim()) return result.stdout.trim();
+  }
+  return "";
+}