@rightkit/release 0.2.150 → 0.2.153

package/runtime-bundle-scan.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// Fails when a built or installed bundle carries a Node or Python runtime,
+// interpreter libraries, or script sources (M19 owner gap 2; replaces the
+// per-app scan-bundle.mjs copies in CutRight and GenRight).
+// Usage: right-release bundle-scan [--allow-name <basename>]... <bundle-root>...
+import { readdirSync, statSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const BANNED_NAMES = Object.freeze([
+  /^node(js)?(\.exe)?$/i, /^libnode/i, /^python[\d.]*w?(\.exe)?$/i, /^libpython/i,
+  /^python\d+\.dll$/i, /^pythonw?\d*\.zip$/i,
+]);
+export const BANNED_EXTENSIONS = Object.freeze(new Set([".js", ".mjs", ".cjs", ".py", ".pyc", ".pyo", ".pyd", ".pyz"]));
+export const BANNED_DIRECTORIES = Object.freeze(new Set(["node_modules", "site-packages", "__pycache__"]));
+
+/** Scan one bundle root. `allowNames` exempts exact basenames (product-declared exceptions). */
+export function scanRuntimeBundle(root, { allowNames = [] } = {}) {
+  const allowed = new Set(allowNames);
+  const offenders = [];
+  let files = 0;
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (BANNED_DIRECTORIES.has(entry.name) && !allowed.has(entry.name)) offenders.push(path);
+        walk(path);
+        continue;
+      }
+      files += 1;
+      const name = basename(path);
+      if (allowed.has(name)) continue;
+      if (BANNED_EXTENSIONS.has(extname(name).toLowerCase()) || BANNED_NAMES.some((re) => re.test(name))) offenders.push(path);
+    }
+  };
+  if (statSync(root).isDirectory()) walk(root); else files = 1;
+  return { root, files, offenders };
+}
+
+export function runtimeBundleScanFailed(results) {
+  return results.some((r) => r.offenders.length > 0 || r.files === 0);
+}
+
+function main(argv) {
+  const roots = [];
+  const allowNames = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--allow-name") allowNames.push(argv[++i] ?? "");
+    else roots.push(argv[i]);
+  }
+  if (!roots.length || allowNames.includes("")) {
+    console.error("usage: right-release bundle-scan [--allow-name <basename>]... <bundle-root>...");
+    return 2;
+  }
+  const results = roots.map((root) => scanRuntimeBundle(root, { allowNames }));
+  console.log(JSON.stringify(results, null, 2));
+  return runtimeBundleScanFailed(results) ? 1 : 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) process.exit(main(process.argv.slice(2)));

package/sign-macos.mjs

@@ -2,7 +2,7 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { fileEvidence } from "./macos-file-evidence.mjs";
+import { readSignManifest, signMacosEntries } from "./mac-sign-core.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
@@ -13,44 +13,46 @@ const receiptIndex = args.indexOf("--receipt");
 const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
 const entitlementsIndex = args.indexOf("--entitlements");
 const entitlementsPath = entitlementsIndex >= 0 ? args[entitlementsIndex + 1] : null;
+const manifestIndex = args.indexOf("--manifest");
+const manifestPath = manifestIndex >= 0 ? args[manifestIndex + 1] : null;
 if (entitlementsIndex >= 0 && (!entitlementsPath || entitlementsPath.startsWith("--"))) fail("--entitlements requires a path");
+if (manifestIndex >= 0 && (!manifestPath || manifestPath.startsWith("--"))) fail("--manifest requires a path");
 const files = args
-  .filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--entitlements"
+  .filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--entitlements" && arg !== "--manifest"
     && (receiptIndex < 0 || index !== receiptIndex + 1)
-    && (entitlementsIndex < 0 || index !== entitlementsIndex + 1))
+    && (entitlementsIndex < 0 || index !== entitlementsIndex + 1)
+    && (manifestIndex < 0 || index !== manifestIndex + 1))
   .map((arg) => path.resolve(arg));
 
-if (!files.length) fail("usage: node sign-macos.mjs [--dry-run] [--entitlements <path>] --receipt <path> <file>...");
+// A manifest carries per-file settings (entitlements, codesign options) in signing order; the plain form
+// signs every positional file with the same optional --entitlements.
+if (manifestPath && (files.length || entitlementsPath)) fail("--manifest cannot be combined with positional files or --entitlements");
+if (!manifestPath && !files.length) fail("usage: node sign-macos.mjs [--dry-run] [--entitlements <path>] --receipt <path> <file>... | --manifest <json>");
 if (!receiptPath) fail("--receipt requires a path");
+let entries;
+if (manifestPath) {
+  try { entries = readSignManifest(path.resolve(manifestPath)); } catch (error) { fail(error.message); }
+} else {
+  entries = files.map((file) => ({ file, ...(entitlementsPath ? { entitlements: path.resolve(entitlementsPath) } : {}), options: [] }));
+}
 if (dryRun) {
-  console.log(`dry-run: Developer ID signing ${files.join(", ")}`);
+  console.log(`dry-run: Developer ID signing ${entries.map((entry) => entry.file).join(", ")}`);
   process.exit(0);
 }
 if (process.platform !== "darwin") fail("macOS signing must run on macOS");
 let identity;
 try { identity = resolveMacosDeveloperIdIdentity(); } catch (error) { fail(error.message); }
-for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
-if (entitlementsPath && !existsSync(entitlementsPath)) fail(`missing entitlements: ${entitlementsPath}`);
+for (const entry of entries) if (!existsSync(entry.file)) fail(`missing file: ${entry.file}`);
+for (const entry of entries) if (entry.entitlements && !existsSync(entry.entitlements)) fail(`missing entitlements: ${entry.entitlements}`);
 
-const evidence = [];
-for (const file of files) {
-  const before = fileEvidence(file);
-  try {
-    const [signed] = runMacCodesignCommands([["--force", "--options", "runtime", "--timestamp", "--sign", identity,
-      ...(entitlementsPath ? ["--entitlements", path.resolve(entitlementsPath)] : []), file]]);
-    if (signed.error || signed.status !== 0) fail(`codesign failed: ${signed.stderr ?? signed.error?.message ?? signed.status}`);
-  } catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
-  const verification = run("codesign", ["--verify", "--strict", "--verbose=4", file]);
-  const details = run("codesign", ["-dvv", file]);
-  if (!/valid on disk/i.test(verification) || !/satisfies its designated requirement/i.test(verification)) {
-    fail(`strict codesign verification failed for ${file}`);
-  }
-  if (!new RegExp(`^Authority=${escapeRegExp(identity)}$`, "m").test(details) && !details.includes(`Authority=${identity}`)) {
-    fail(`codesign identity mismatch for ${file}: expected ${identity}`);
-  }
-  evidence.push({ file, before, after: fileEvidence(file), codesign: "strict-valid", identity, timestampPresent: /(?:Timestamp|Signed Time)[=:]/i.test(details) });
-  if (!evidence.at(-1).timestampPresent) fail(`Developer ID timestamp is missing for ${file}`);
-}
+let evidence;
+try {
+  evidence = signMacosEntries(entries, {
+    identity,
+    signOne: (codesignArgs) => runMacCodesignCommands([codesignArgs])[0],
+    inspect: run,
+  });
+} catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
 
 const absoluteReceipt = path.resolve(receiptPath);
 mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
@@ -63,10 +65,6 @@ function run(cmd, runArgs) {
   return output;
 }
 
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 function fail(message) {
   console.error(`right-sign-macos: ${message}`);
   process.exit(1);

package/sign-updater.mjs

@@ -8,8 +8,10 @@ import { refuseManagedEnvSecrets, MANAGED_HOST_ENV_SECRET_REFUSED } from "./mana
 const args = process.argv.slice(2);
 const files = [];
 let dryRun = false;
+let keyFile = process.env.RIGHT_UPDATER_KEY_FILE || "";
 for (let i = 0; i < args.length; i++) {
   if (args[i] === "--file") files.push(path.resolve(args[++i]));
+  else if (args[i] === "--key-file") keyFile = args[++i] ?? "";
   else if (args[i] === "--dry-run") dryRun = true;
   else fail(`unknown argument: ${args[i]}`);
 }
@@ -22,8 +24,9 @@ if (!dryRun) {
 }
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   if (process.platform === "win32") {
-    const key = path.join(env.APPDATA || "", "ViewRight", "updater.key");
-    if (!existsSync(key)) fail(`shared updater key not found: ${key}`);
+    if (!keyFile) fail("updater key path required on win32: pass --key-file or set RIGHT_UPDATER_KEY_FILE (release config: targets.win.updater.keyFile), or set TAURI_SIGNING_PRIVATE_KEY");
+    const key = path.resolve(keyFile.replace(/%([^%]+)%/g, (m, name) => process.env[name] ?? m));
+    if (!existsSync(key)) fail(`updater key not found: ${key}`);
     env.TAURI_SIGNING_PRIVATE_KEY = readFileSync(key, "utf8");
   } else if (process.platform !== "darwin") {
     fail("TAURI_SIGNING_PRIVATE_KEY is required on this platform");

package/swift-mac-dmg.mjs

@@ -4,6 +4,7 @@
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { buildDmg } from "./dmg-build.mjs";
+import { readDmgSpec } from "./dmg-spec.mjs";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
 const DMG_HOOK = /dmg|hdiutil/i;
@@ -30,7 +31,9 @@ export function swiftMacDmgPlan({ target, projectType, appName = "app", resolve
   return {
     app: resolve(target.notarize.app),
     out: resolve(d.out ?? target.notarize.file),
-    options: { volname: d.volname ?? appName, background: d.background && resolve(d.background), iconSize: d.iconSize, appPosition: d.appPosition,
+    // `spec` is an appdmg-style JSON file (dmg-spec.mjs); explicit options here win over it, and its title is the volume name.
+    fallbackVolname: appName,
+    options: { volname: d.volname ?? (d.spec ? undefined : appName), spec: d.spec && resolve(d.spec), background: d.background && resolve(d.background), iconSize: d.iconSize, appPosition: d.appPosition,
       applicationsPosition: d.applicationsPosition, window: d.window, volumeIcon: d.volumeIcon && resolve(d.volumeIcon) },
   };
 }
@@ -46,7 +49,9 @@ export async function buildStapledSwiftMacDmg(plan, { run = spawnSync, build = b
   if (probe.error || probe.status !== 0) throw fail("SWIFT_DMG_APP_NOT_STAPLED", `refusing to build the DMG: ${plan.app} is not stapled (xcrun stapler validate failed). Notarize and staple the app before packaging.`);
   remove(plan.out);
   log(`right-release: building macOS DMG from stapled app ${plan.app}`);
-  const built = build({ app: plan.app, out: plan.out, ...definedOnly(plan.options) });
+  let options = definedOnly(plan.options);
+  if (options.spec && !options.volname) options = { ...options, volname: readDmgSpec(options.spec, { app: plan.app }).volname ?? plan.fallbackVolname };
+  const built = build({ app: plan.app, out: plan.out, ...options });
   if (signDmg) await signDmg(plan.out);
   return built;
 }

package/swift-package-command.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// right-release swift-package <windows-stage|msix|mac-app|doctor> --config <swift-package.json> [options]
+// right-release swift-package <windows-stage|msix|mac-app> --config <swift-package.json> [options]
 //
 // One product config (schema 1) drives all three steps; paths resolve against the config file.
 // Build-only: nothing here uploads or publishes.

package/upload-release.mjs

@@ -2,13 +2,8 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
-import { pathToFileURL } from "node:url";
 import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
-import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
-import { verifySealedRelease } from "./release-state.mjs";
-import { assertCleanSource } from "./source-gate.mjs";
-import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
+import { authorizeGitHubUpload } from "./github-upload-gate.mjs";
 import { recordPublishedVersion } from "./artifact-storage.mjs";
 import { admitInstalledQa } from "./release-qa-audit.mjs";
 
@@ -32,33 +27,17 @@ for (let index = 0; index < args.length; index += 1) {
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
 }
-if (tier !== "patch" && tier !== "update") fail("tier is required (patch|update)");
-if (!releaseId) fail("--release is required");
-if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
 
-const repoRoot = git(process.cwd(), ["rev-parse", "--show-toplevel"]);
-assertPrimaryReleaseCheckout(repoRoot);
-const candidateCommit = git(repoRoot, ["rev-parse", "HEAD"]);
-assertCleanSource({
-  status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]),
-  commandId: "right-release upload",
-});
-const platformDir = platform === "win" ? "windows" : "mac";
-const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir));
-if (sealed.manifest.commit !== candidateCommit) fail("sealed release was built from a different commit than the current checkout");
-
-const configPath = path.resolve(configName);
-if (!existsSync(configPath)) fail(`release config is required: ${configName}`);
-const releaseConfig = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
-const ownership = verifyOwnershipEvidence(sealed.manifest.ownershipEvidence, repoRoot, path.dirname(configPath));
-if (!ownership.ok) fail(`sealed ownership evidence rejected: ${ownership.reason}`);
-if (releaseConfig?.distribution?.provider !== "github-releases") {
-  fail("release config distribution.provider must be github-releases");
+// Tier, primary checkout, clean tree, sealed commit, ownership evidence, provider and repository are checked by
+// the gate that `right-release github --release` also uses; nothing below runs until it passes.
+let authority;
+try {
+  authority = await authorizeGitHubUpload({ command: "right-release upload", tier, releaseId, platform, configName, repo });
+} catch (error) {
+  fail(error.message);
 }
-const configuredRepo = releaseConfig?.distribution?.repository ?? "";
-if (!configuredRepo) fail("release config distribution.repository is required for github-releases");
-if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
-repo = configuredRepo;
+const { repoRoot, platformDir, sealed, configPath } = authority;
+repo = authority.repo;
 
 // Hardening step 4: installed QA is recorded, not enforced; a missing receipt warns and the outcome is written to state.
 if (!dryRun) {
@@ -87,12 +66,6 @@ if (!dryRun) writeJson(verifiedMarker, {
 if (!dryRun) recordPublishedVersion({ app: sealed.manifest.app, version: sealed.manifest.version, platform });
 console.log(`right-release upload: ${dryRun ? "dry-run " : ""}${result.status} ${releaseId} tier=${tier} repo=${repo}`);
 
-function git(cwd, runArgs) {
-  const result = spawnSync("git", runArgs, { cwd, encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) fail(`git ${runArgs.join(" ")} failed: ${result.stderr}`);
-  return result.stdout.trim();
-}
-
 function writeJson(file, value) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);