@rightkit/release 0.2.165 → 0.2.173

package/sign-dev-artifact.mjs

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+// right-release sign-dev-artifact: Developer ID sign an EXISTING, already-qualified CI dev artifact in place (Orthic-Labs/rightkit#257).
+// It never builds, notarizes, publishes or installs. Steps: verify the artifact's recorded hashes, sign each manifest file with its fixed
+// codesign identifier (mac-sign-core signMacosEntries, the provisioned Developer ID only), verify strictly, read back Identifier and
+// TeamIdentifier, refresh the payload metadata, and write evidence JSON. An optional declarative `refresh` in the sign manifest
+// (dev-artifact-refresh.mjs) recomputes digests recorded in JSON files after the code they describe is signed and before the bundle
+// that contains those files is signed, so that bundle seals their final bytes; the payload metadata refresh then records everything.
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { MacosDevelopmentSigningError, resolveMacosDevelopmentSigning } from "./development-signing.mjs";
+import { SIGN_MANIFEST_SCHEMA, parseSignManifest, signMacosEntries } from "./mac-sign-core.mjs";
+import { fileEvidence } from "./macos-file-evidence.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { SignDevArtifactError, assertInsideOnDisk, contained, fail, toPosix } from "./dev-artifact-support.mjs";
+import { applyRefresh, planRefresh, readRefreshPlan } from "./dev-artifact-refresh.mjs";
+
+export const DEV_ARTIFACT_PAYLOAD_SCHEMA = 1;
+export const DEV_ARTIFACT_EVIDENCE_SCHEMA = 1;
+export const DEFAULT_PAYLOAD_METADATA = "payload.json";
+
+export { SignDevArtifactError };
+
+/**
+ * Sign manifest for this command: `{ schema: 1, entries: [{ file, identifier, entitlements?, options?, hardenedRuntime? }] }`.
+ * `file` is relative to the artifact directory (a loose executable or the installer .app); `identifier` is required on every entry.
+ * Entries sign in the given order, so list nested code before the bundle that contains it. Returns absolute-path entries.
+ */
+export function readDevArtifactSignManifest(file, artifact) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(file, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest is not readable JSON: ${file}`); }
+  if (raw?.schema !== SIGN_MANIFEST_SCHEMA || !Array.isArray(raw.entries) || !raw.entries.length) {
+    fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest must be { schema: ${SIGN_MANIFEST_SCHEMA}, entries: [...] } with at least one entry`);
+  }
+  const absolute = raw.entries.map((entry, index) => {
+    if (!entry || typeof entry !== "object") fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest entry ${index} must be an object`);
+    if (entry.identifier === undefined) fail("SIGN_DEV_ARTIFACT_IDENTIFIER_REQUIRED", `sign manifest entry ${index} (${entry.file}) needs a fixed identifier`);
+    return {
+      ...entry,
+      file: contained(artifact, entry.file, `sign manifest entry ${index} file`),
+      ...(entry.entitlements !== undefined ? { entitlements: contained(artifact, entry.entitlements, `sign manifest entry ${index} entitlements`) } : {}),
+    };
+  });
+  const entries = parseSignManifest(JSON.stringify({ schema: SIGN_MANIFEST_SCHEMA, entries: absolute }));
+  const seen = new Set();
+  entries.forEach((entry, index) => {
+    if (seen.has(entry.file)) fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest lists ${entry.file} twice`);
+    seen.add(entry.file);
+    for (const earlier of entries.slice(0, index)) {
+      if (entry.file.startsWith(earlier.file + path.sep)) fail("SIGN_DEV_ARTIFACT_ORDER_INVALID", `${path.relative(artifact, earlier.file)} contains ${path.relative(artifact, entry.file)} but is listed first; sign nested code before its bundle`);
+    }
+  });
+  return entries;
+}
+
+/** The optional declarative `refresh` of the sign manifest (see dev-artifact-refresh.mjs): `{ root, operations }`, absolute paths, validated. */
+export function readDevArtifactRefreshPlan(file, artifact) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(file, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_MANIFEST_INVALID", `sign manifest is not readable JSON: ${file}`); }
+  return readRefreshPlan(raw, artifact);
+}
+
+/** Read the artifact's payload metadata `{ schema: 1, files: [{ path, sha256, ... }] }` and verify every recorded hash against disk. */
+export function verifyDevArtifactPayload(artifact, metadataFile) {
+  let metadata;
+  try { metadata = JSON.parse(readFileSync(metadataFile, "utf8")); } catch { fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata is not readable JSON: ${metadataFile}`); }
+  if (metadata?.schema !== DEV_ARTIFACT_PAYLOAD_SCHEMA || !Array.isArray(metadata.files) || !metadata.files.length) {
+    fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata must be { schema: ${DEV_ARTIFACT_PAYLOAD_SCHEMA}, files: [...] } with at least one file: ${metadataFile}`);
+  }
+  const recorded = new Map();
+  for (const item of metadata.files) {
+    if (!/^[0-9a-f]{64}$/.test(item?.sha256 ?? "")) fail("SIGN_DEV_ARTIFACT_METADATA_INVALID", `payload metadata entry ${JSON.stringify(item?.path)} has no sha256`);
+    const absolute = contained(artifact, item.path, "payload metadata path");
+    if (!existsSync(absolute)) fail("SIGN_DEV_ARTIFACT_MISSING", `payload file is missing: ${item.path}`);
+    const actual = fileEvidence(absolute).sha256;
+    if (actual !== item.sha256) fail("SIGN_DEV_ARTIFACT_HASH_MISMATCH", `recorded hash does not match ${item.path}: recorded ${item.sha256}, found ${actual}. Refusing to sign bytes that were not qualified.`);
+    recorded.set(absolute, item);
+  }
+  return { metadata, recorded };
+}
+
+const defaultInspect = (run, env) => (command, args) => {
+  const result = run(command, args, { env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  if (result.error || result.status !== 0) fail("SIGN_DEV_ARTIFACT_INSPECT_FAILED", `${command} ${args.join(" ")} failed: ${output.trim() || result.error?.message}`);
+  return output;
+};
+
+/**
+ * Sign an existing dev artifact. Injectable for tests: `resolveSigning`, `signOne`, `inspect`, `evidenceOf`.
+ * Returns the evidence object (also written to `evidencePath`). With `dryRun` only the hash verification and manifest parsing run.
+ */
+export function signDevArtifact({
+  artifact, manifestPath, metadataPath, evidencePath, dryRun = false,
+  env = process.env, run = spawnSync, platform = process.platform,
+  resolveSigning = (options) => resolveMacosDevelopmentSigning(options),
+  signOne = (codesignArgs) => runMacCodesignCommands([codesignArgs], { env, run })[0],
+  inspect = defaultInspect(run, env), evidenceOf = fileEvidence,
+} = {}) {
+  if (!artifact || !manifestPath) fail("SIGN_DEV_ARTIFACT_USAGE", "usage: right-release sign-dev-artifact --artifact <dir> --manifest <sign-manifest.json> [--metadata <payload.json>] [--evidence <path>] [--dry-run]");
+  const root = path.resolve(artifact);
+  if (!existsSync(root)) fail("SIGN_DEV_ARTIFACT_MISSING", `artifact directory does not exist: ${root}`);
+  const metadataFile = path.resolve(metadataPath ?? path.join(root, DEFAULT_PAYLOAD_METADATA));
+  const entries = readDevArtifactSignManifest(path.resolve(manifestPath), root);
+  const refreshPlan = readDevArtifactRefreshPlan(path.resolve(manifestPath), root);
+  const plan = planRefresh(entries, refreshPlan.operations, metadataFile);
+  const before = verifyDevArtifactPayload(root, metadataFile);
+  for (const entry of entries) {
+    if (!existsSync(entry.file)) fail("SIGN_DEV_ARTIFACT_MISSING", `sign manifest file is missing: ${path.relative(root, entry.file)}`);
+    if (!before.recorded.has(entry.file)) fail("SIGN_DEV_ARTIFACT_NOT_RECORDED", `${path.relative(root, entry.file)} is not in the payload metadata, so its hash was never recorded`);
+    if (entry.entitlements && !existsSync(entry.entitlements)) fail("SIGN_DEV_ARTIFACT_MISSING", `entitlements file is missing: ${path.relative(root, entry.entitlements)}`);
+  }
+  if (dryRun) return { schema: DEV_ARTIFACT_EVIDENCE_SCHEMA, dryRun: true, files: entries.map((entry) => ({ path: toPosix(path.relative(root, entry.file)), identifier: entry.identifier })) };
+  if (platform !== "darwin") fail("SIGN_DEV_ARTIFACT_PLATFORM", "sign-dev-artifact must run on macOS");
+  if (!evidencePath) fail("SIGN_DEV_ARTIFACT_USAGE", "--evidence requires a path");
+
+  // Same Developer ID resolution as dev signing: no ad hoc and no Apple Development fallback.
+  const signing = resolveSigning({ root, bundle: root, descriptor: {}, config: {}, env, run });
+  if (signing.adhoc || !/^Developer ID Application:/.test(signing.identity ?? "")) {
+    throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_DEVELOPER_ID_REQUIRED", `sign-dev-artifact needs the provisioned Developer ID Application identity; got ${JSON.stringify(signing.identity)}. There is no ad hoc or Apple Development fallback.`, { identity: signing.identity });
+  }
+  const { identity, teamIdentifier } = signing;
+
+  const sha256Before = new Map(entries.map((entry) => [entry.file, evidenceOf(entry.file).sha256]));
+  // Entries before the refresh sign first, then the declared metadata is recomputed from their final bytes, then the entries that
+  // contain the refreshed files (the wrapper bundle) sign over them. Without a refresh this is one signing pass, as before.
+  const signingOptions = { identity, signOne, inspect, evidence: evidenceOf, bundle: root };
+  // The manifest paths were checked when it was read; check them on disk again right before codesign touches them.
+  const recheck = (list) => {
+    for (const entry of list) {
+      assertInsideOnDisk(root, entry.file, `sign manifest file ${path.relative(root, entry.file)}`);
+      if (entry.entitlements) assertInsideOnDisk(root, entry.entitlements, `entitlements ${path.relative(root, entry.entitlements)}`);
+    }
+    return list;
+  };
+  const signed = plan.before.length ? signMacosEntries(recheck(plan.before), signingOptions) : [];
+  const refreshOps = refreshPlan.operations.length ? applyRefresh(refreshPlan.operations, refreshPlan.root) : [];
+  if (plan.after.length) signed.push(...signMacosEntries(recheck(plan.after), signingOptions));
+  const files = signed.map((record) => {
+    const rel = toPosix(path.relative(root, record.file));
+    const details = inspect("codesign", ["-dvv", record.file]);
+    const team = /^TeamIdentifier=(.+)$/m.exec(details)?.[1]?.trim();
+    const identifier = /^Identifier=(.+)$/m.exec(details)?.[1]?.trim();
+    if (!team || team !== teamIdentifier) fail("SIGN_DEV_ARTIFACT_TEAM_MISMATCH", `${rel}: expected TeamIdentifier=${teamIdentifier}, found ${team ?? "missing"}`);
+    if (!identifier || identifier !== record.identifier) fail("SIGN_DEV_ARTIFACT_IDENTIFIER_MISMATCH", `${rel}: expected Identifier=${record.identifier}, found ${identifier ?? "missing"}`);
+    const requirement = inspect("codesign", ["-d", "-r-", record.file]);
+    const designatedRequirement = /^designated => (.+)$/m.exec(requirement)?.[1]?.trim();
+    if (!designatedRequirement || /\bcdhash\b/.test(designatedRequirement)) fail("SIGN_DEV_ARTIFACT_UNSTABLE_REQUIREMENT", `${rel}: designated requirement ${JSON.stringify(designatedRequirement)} is not identity-based, so privacy grants would not survive a rebuild`);
+    return { path: rel, sha256Before: sha256Before.get(record.file), sha256After: record.after.sha256, identifier, teamIdentifier: team, designatedRequirement };
+  });
+
+  // Refresh the payload metadata: every recorded hash is recomputed (a signed bundle changes its tree digest too).
+  const payloadFiles = before.metadata.files.map((item) => {
+    const evidence = evidenceOf(contained(root, item.path, "payload metadata path"));
+    return { ...item, sha256: evidence.sha256, ...(item.sizeBytes !== undefined ? { sizeBytes: evidence.sizeBytes } : {}) };
+  });
+  const metadata = { ...before.metadata, files: payloadFiles, signing: { contract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, teamIdentifier, signedPaths: files.map((file) => file.path) } };
+  const metadataBefore = evidenceOf(metadataFile).sha256;
+  const staging = `${metadataFile}.signing`;
+  rmSync(staging, { force: true }); // a stale file or planted link is removed itself, never written through
+  writeFileSync(staging, `${JSON.stringify(metadata, null, 2)}\n`, { flag: "wx" });
+  renameSync(staging, metadataFile);
+  verifyDevArtifactPayload(root, metadataFile);
+
+  const result = {
+    schema: DEV_ARTIFACT_EVIDENCE_SCHEMA, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, teamIdentifier, notarized: false, built: false, published: false,
+    artifact: root, metadata: { path: toPosix(path.relative(root, metadataFile)), sha256Before: metadataBefore, sha256After: evidenceOf(metadataFile).sha256 }, files,
+    ...(refreshOps.length ? { refresh: refreshOps } : {}),
+  };
+  const absoluteEvidence = path.resolve(evidencePath);
+  mkdirSync(path.dirname(absoluteEvidence), { recursive: true });
+  writeFileSync(absoluteEvidence, `${JSON.stringify(result, null, 2)}\n`);
+  return result;
+}
+
+export function main(args = process.argv.slice(2), options = {}) {
+  const take = (flag) => {
+    const index = args.indexOf(flag);
+    if (index < 0) return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) fail("SIGN_DEV_ARTIFACT_USAGE", `${flag} requires a value`);
+    return value;
+  };
+  try {
+    const result = signDevArtifact({
+      artifact: take("--artifact"), manifestPath: take("--manifest"), metadataPath: take("--metadata"), evidencePath: take("--evidence"),
+      dryRun: args.includes("--dry-run"), ...options,
+    });
+    console.log(result.dryRun ? `dry-run: recorded hashes verified; would sign ${result.files.map((file) => file.path).join(", ")}` : `signed ${result.files.length} file(s) as ${result.teamIdentifier}: ${result.files.map((file) => `${file.path} (${file.identifier})`).join(", ")}`);
+  } catch (error) {
+    console.error(`right-release sign-dev-artifact: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main();

package/stage-binary.mjs

@@ -0,0 +1,60 @@
+import { statSync } from "node:fs";
+import path from "node:path";
+import { replaceFileInPlace } from "./in-place-install.mjs";
+import { resolveTargetRoot } from "./cargo-target.mjs";
+
+/**
+ * A stable staged path for a development or QA binary.
+ *
+ * The build broker writes Cargo output to per-generation folders (`<managed>/rightkit-build-control/ws/<hash>/g/<gen>/...`)
+ * and `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. Those are build output only: their path is not
+ * stable, so NOTHING may run from them. macOS ties privacy grants to the path an app runs from, so a dev or QA binary is
+ * copied in place to `<root>/.rightkit-dev-bin/<triple-or-host>/<name>` (keeping `<name>.previous`) and run from there.
+ */
+export const DEV_STAGE_DIRECTORY = ".rightkit-dev-bin";
+
+export function stagedBinaryPath({ root, name, triple = null }) {
+  if (typeof name !== "string" || !name || name !== path.basename(name) || name === "." || name === "..") throw new Error("staged binary name must be a bare file name");
+  if (triple !== null && !/^[A-Za-z0-9_.-]+$/.test(triple)) throw new Error("staged binary triple is not a safe path segment");
+  return path.join(path.resolve(root), DEV_STAGE_DIRECTORY, triple ?? "host", name);
+}
+
+/** Copy `source` to its stable staged path in place and return that path. Never launches or keeps anything per build. */
+export function stageDevelopmentBinary({ root, source, name = path.basename(source), triple = null }) {
+  const from = path.resolve(root, source);
+  if (!statSync(from).isFile()) throw new Error(`staged binary source is not a file: ${from}`);
+  const destination = stagedBinaryPath({ root, name, triple });
+  replaceFileInPlace(from, destination);
+  return destination;
+}
+
+// The dev and test profiles are written to debug and bench to release (same mapping as development.mjs).
+const profileDirectory = (profile) => (profile === "dev" || profile === "test" ? "debug" : profile === "bench" ? "release" : profile);
+
+/** `{ source }` or `{ manifestPath, bin, targetTriple?, profile? }` (resolved through Cargo's own target directory, broker or not). */
+export function resolveStageSource(entry, { root, resolveTarget = resolveTargetRoot, platform = process.platform } = {}) {
+  if (entry.source) return path.resolve(root, entry.source);
+  if (!entry.manifestPath || !entry.bin) throw new Error("development stage entry needs source, or manifestPath and bin");
+  const target = resolveTarget(path.resolve(root, entry.manifestPath));
+  const file = platform === "win32" ? `${entry.bin}.exe` : entry.bin;
+  return path.join(target, ...(entry.targetTriple ? [entry.targetTriple] : []), profileDirectory(entry.profile ?? "dev"), file);
+}
+
+export function validateStageEntries(entries, label) {
+  if (entries === undefined) return [];
+  if (!Array.isArray(entries)) throw new Error(`${label} must be an array`);
+  for (const [index, entry] of entries.entries()) {
+    if (!entry || typeof entry !== "object" || (!entry.source && !(entry.manifestPath && entry.bin))) throw new Error(`${label}[${index}] needs source, or manifestPath and bin`);
+    if (entry.name !== undefined) stagedBinaryPath({ root: ".", name: entry.name });
+    if (entry.targetTriple !== undefined) stagedBinaryPath({ root: ".", name: "x", triple: entry.targetTriple });
+  }
+  return entries;
+}
+
+export function stageDevelopmentBinaries(entries, { root, platform = process.platform, resolveTarget } = {}) {
+  return entries.map((entry) => {
+    const source = resolveStageSource(entry, { root, platform, resolveTarget });
+    const name = entry.name ?? path.basename(source);
+    return stageDevelopmentBinary({ root, source, name, triple: entry.targetTriple ?? null });
+  });
+}

package/stage-sidecar-command.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// `right-release stage-sidecar [--config right-release.config.mjs] [--target <triple>]` (bogusyogi/rightkit#345):
+// stages the config's declarative `sidecars` into src-tauri/binaries with Tauri externalBin naming.
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { resolveTargetTriple, stageSidecars } from "./stage-sidecar.mjs";
+
+export function parseStageSidecarArgs(argv) {
+  const opts = { config: "right-release.config.mjs", target: undefined, json: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--config" || arg === "--target") {
+      const value = argv[i + 1];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} needs a value`);
+      opts[arg.slice(2)] = value;
+      i += 1;
+    } else if (arg === "--json") opts.json = true;
+    else throw new Error(`unknown stage-sidecar argument: ${arg}`);
+  }
+  return opts;
+}
+
+async function main() {
+  const opts = parseStageSidecarArgs(process.argv.slice(2));
+  const configPath = path.resolve(opts.config);
+  const appRoot = path.dirname(configPath);
+  const loaded = await import(pathToFileURL(configPath).href);
+  const config = loaded.default ?? loaded.config ?? loaded;
+  if (config?.sidecars === undefined) throw new Error(`${opts.config} declares no sidecars`);
+  const target = resolveTargetTriple({ target: opts.target, cwd: appRoot });
+  const result = await stageSidecars({ appRoot, manifest: config.sidecars, target });
+  if (opts.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    for (const file of result.files ?? []) console.log(`right-release stage-sidecar: staged ${typeof file === "string" ? file : file.path ?? JSON.stringify(file)}`);
+    console.log(`right-release stage-sidecar: externalBin ${JSON.stringify(result.externalBinNames ?? [])}; receipt ${result.receiptPath}`);
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().catch((error) => { console.error(`right-release stage-sidecar: ${error.code ? `[${error.code}] ` : ""}${error.message}`); process.exitCode = 1; });
+}