@rightkit/release 0.2.30 → 0.2.32

package/release-state.mjs

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+export function cacheFingerprint({ cargoLockSha256, rustc, target, features = [] }) {
+  const payload = JSON.stringify({
+    cargoLockSha256,
+    rustc,
+    target,
+    features: [...features].sort(),
+  });
+  return createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+export function releaseEnvironment({ root, platform, cacheKey, kind = "release" }) {
+  if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
+  const targetKind = kind === "release" ? "cargo-target" : "test-target";
+  return {
+    CARGO_TARGET_DIR: path.resolve(root, "cache", targetKind, platform, cacheKey),
+    CARGO_HOME: path.resolve(root, "cache", "cargo-home"),
+    SCCACHE_DIR: path.resolve(root, "cache", "sccache"),
+    RUSTC_WRAPPER: "sccache",
+  };
+}
+
+export function verifySealedRelease(sealedDir) {
+  const manifestPath = path.join(sealedDir, "release-manifest.json");
+  if (!existsSync(manifestPath)) throw new Error(`sealed manifest missing: ${manifestPath}`);
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  if (manifest.schema !== 1) throw new Error(`unsupported sealed manifest schema: ${manifest.schema}`);
+  if (!manifest.checkpoints?.includes("sealed")) throw new Error("release is not sealed");
+  for (const item of manifest.files ?? []) {
+    const file = path.join(sealedDir, item.name);
+    if (!existsSync(file)) throw new Error(`sealed file missing: ${item.name}`);
+    const bytes = readFileSync(file);
+    const actualHash = createHash("sha256").update(bytes).digest("hex");
+    if (actualHash !== item.sha256) throw new Error(`sealed file hash mismatch: ${item.name}`);
+    if (bytes.length !== item.sizeBytes) throw new Error(`sealed file size mismatch: ${item.name}`);
+  }
+  return { manifest, manifestPath, sealedDir };
+}
+
+export async function runBuildStateMachine({
+  root,
+  app,
+  version,
+  commit,
+  platform,
+  requiredInputs = [],
+  ops,
+}) {
+  const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
+  const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
+  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  if (existsSync(path.join(sealedDir, "release-manifest.json"))) {
+    const sealed = verifySealedRelease(sealedDir);
+    if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {
+      throw new Error(`sealed release identity mismatch: ${releaseId}`);
+    }
+    return { status: "sealed", resumed: true, releaseId, sealedDir };
+  }
+  await ops.preflight?.({ root, app, version, commit, platform, requiredInputs, releaseId });
+  await ops.prepare?.({ root, app, version, commit, platform, releaseId });
+  await ops.build?.({ root, app, version, commit, platform, releaseId });
+  await ops.sign?.({ root, app, version, commit, platform, releaseId });
+  await ops.harden?.({ root, app, version, commit, platform, releaseId });
+  await ops.seal?.({ root, app, version, commit, platform, releaseId, sealedDir });
+  return { status: "sealed", resumed: false, releaseId, sealedDir };
+}
+
+export async function runUploadStateMachine({ root, releaseId, platform, tier, ops = {} }) {
+  if (tier !== "patch" && tier !== "update") throw new Error("upload tier is required (patch|update)");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(String(releaseId))) throw new Error(`invalid release id: ${releaseId}`);
+  const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
+  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  const sealed = verifySealedRelease(sealedDir);
+  if (sealed.manifest.platform !== platform) throw new Error("sealed release platform mismatch");
+  const routes = sealed.manifest.routes?.[tier] ?? [];
+  if (!routes.length) throw new Error(`sealed release has no ${tier} upload route`);
+  validateUploadRoutes(routes, tier, platformDir);
+
+  await ops.verifyAuthenticode?.(sealed);
+  await ops.harden?.(sealed);
+  let backedUp = false;
+  try {
+    await ops.backup?.(sealed, routes);
+    backedUp = true;
+    await ops.upload?.(sealed, routes);
+    await ops.register?.(sealed, routes);
+    await ops.verifyRemote?.(sealed, routes);
+    await ops.discardBackup?.(sealed, routes);
+  } catch (error) {
+    if (backedUp) await ops.restore?.(sealed, routes);
+    throw error;
+  }
+  return { status: "verified", releaseId, tier, sealedDir };
+}
+
+function validateUploadRoutes(routes, tier, platformDir) {
+  const expectedBucket = tier === "patch" ? "public" : "private";
+  const expectedLane = tier === "patch" ? "installers" : "updates";
+  const marker = `/${expectedLane}/${platformDir}/current/`;
+  for (const route of routes) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(String(route.key)) || String(route.key).includes("//")) {
+      throw new Error(`unsafe R2 key: ${route.key}`);
+    }
+    if (route.bucket !== expectedBucket || !String(route.key).includes(marker)) {
+      throw new Error(`${tier} route must use ${expectedBucket} ${expectedLane}/${platformDir}/current: ${route.key}`);
+    }
+    if (String(route.key).includes("..")) throw new Error(`${tier} route contains traversal: ${route.key}`);
+  }
+}

package/release-state.test.mjs

@@ -0,0 +1,224 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  cacheFingerprint,
+  releaseEnvironment,
+  runBuildStateMachine,
+  runUploadStateMachine,
+  verifySealedRelease,
+} from "./release-state.mjs";
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-state-"));
+  const sealedDir = path.join(root, ".right-release", "sealed", "fixture-1.2.3-abcdef12", "windows");
+  mkdirSync(sealedDir, { recursive: true });
+  const installer = path.join(sealedDir, "Fixture_x64-setup.exe");
+  const signature = `${installer}.sig`;
+  writeFileSync(installer, "signed-installer");
+  writeFileSync(signature, "updater-signature");
+  const manifest = {
+    schema: 1,
+    releaseId: "fixture-1.2.3-abcdef12",
+    app: "fixture",
+    version: "1.2.3",
+    commit: "abcdef1234567890",
+    platform: "win",
+    files: [
+      { role: "installer", name: path.basename(installer), sha256: sha256("signed-installer"), sizeBytes: 16 },
+      { role: "updater-signature", name: path.basename(signature), sha256: sha256("updater-signature"), sizeBytes: 17 },
+    ],
+    routes: {
+      patch: [{ role: "installer", bucket: "public", key: "fixture/installers/windows/current/Fixture_x64-setup.exe" }],
+      update: [{ role: "installer", bucket: "private", key: "fixture/updates/windows/current/Fixture_x64-setup.exe" }],
+    },
+    checkpoints: ["preflight_complete", "build_complete", "signed", "hardened", "sealed"],
+  };
+  writeFileSync(path.join(sealedDir, "release-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  return { root, sealedDir, installer, signature, manifest };
+}
+
+test("upload has no build operation and restores the previous stable object when registration fails", async () => {
+  const fx = fixture();
+  const calls = [];
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: {
+        verifyAuthenticode: async () => calls.push("verify-authenticode"),
+        harden: async () => calls.push("harden"),
+        backup: async () => calls.push("backup"),
+        upload: async () => calls.push("upload"),
+        register: async () => { calls.push("register"); throw new Error("R2/API unavailable"); },
+        verifyRemote: async () => calls.push("verify-remote"),
+        restore: async () => calls.push("restore"),
+        discardBackup: async () => calls.push("discard-backup"),
+      },
+    }),
+    /R2\/API unavailable/,
+  );
+  assert.deepEqual(calls, ["verify-authenticode", "harden", "backup", "upload", "register", "restore"]);
+});
+test("missing runtime input fails before build preparation and cannot touch an existing sealed installer", async () => {
+  const fx = fixture();
+  let prepared = false;
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: "1.2.4",
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [path.join(fx.root, "missing-directml.dll")],
+      ops: {
+        preflight: async ({ requiredInputs }) => {
+          for (const file of requiredInputs) readFileSync(file);
+        },
+        prepare: async () => { prepared = true; },
+        build: async () => {},
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /ENOENT/,
+  );
+  assert.equal(prepared, false);
+  assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
+});
+
+test("an interrupted build leaves every previously sealed release untouched", async () => {
+  const fx = fixture();
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: "1.2.4",
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [],
+      ops: {
+        preflight: async () => {},
+        prepare: async () => {},
+        build: async () => { throw new Error("SIGINT"); },
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /SIGINT/,
+  );
+  assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
+});
+
+test("a valid sealed release resumes without rebuilding", async () => {
+  const fx = fixture();
+  let builds = 0;
+  const result = await runBuildStateMachine({
+    root: fx.root,
+    app: "fixture",
+    version: fx.manifest.version,
+    commit: fx.manifest.commit,
+    platform: "win",
+    requiredInputs: [],
+    ops: {
+      preflight: async () => {},
+      prepare: async () => {},
+      build: async () => { builds += 1; },
+      sign: async () => {},
+      harden: async () => {},
+      seal: async () => {},
+    },
+  });
+  assert.equal(result.status, "sealed");
+  assert.equal(result.resumed, true);
+  assert.equal(builds, 0);
+});
+
+test("manifest or file tampering blocks upload before any mutation", async () => {
+  const fx = fixture();
+  writeFileSync(fx.installer, "changed");
+  assert.throws(() => verifySealedRelease(fx.sealedDir), /hash mismatch/);
+  let uploaded = false;
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: {
+        upload: async () => { uploaded = true; },
+      },
+    }),
+    /hash mismatch/,
+  );
+  assert.equal(uploaded, false);
+});
+
+test("tier or non-current route mismatch fails before R2 backup", async () => {
+  const fx = fixture();
+  fx.manifest.routes.patch[0].bucket = "private";
+  fx.manifest.routes.patch[0].key = "fixture/updates/windows/1.2.3/Fixture.exe";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+  let backedUp = false;
+  await assert.rejects(
+    runUploadStateMachine({
+      root: fx.root,
+      releaseId: fx.manifest.releaseId,
+      platform: "win",
+      tier: "patch",
+      ops: { backup: async () => { backedUp = true; } },
+    }),
+    /patch route.*public.*installers.*current/i,
+  );
+  assert.equal(backedUp, false);
+});
+
+test("release ids and R2 keys reject traversal and shell metacharacters", async () => {
+  const fx = fixture();
+  await assert.rejects(
+    runUploadStateMachine({ root: fx.root, releaseId: "../../outside", platform: "win", tier: "patch" }),
+    /invalid release id/i,
+  );
+  fx.manifest.routes.patch[0].key = "fixture/installers/windows/current/Fixture.exe&whoami";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+  await assert.rejects(
+    runUploadStateMachine({ root: fx.root, releaseId: fx.manifest.releaseId, platform: "win", tier: "patch" }),
+    /unsafe R2 key/i,
+  );
+});
+
+test("release and test Cargo targets are disjoint", () => {
+  const root = "C:/repo/.right-release";
+  const build = releaseEnvironment({ root, platform: "win", cacheKey: "deps123", kind: "release" });
+  const testEnv = releaseEnvironment({ root, platform: "win", cacheKey: "deps123", kind: "test" });
+  assert.notEqual(build.CARGO_TARGET_DIR, testEnv.CARGO_TARGET_DIR);
+  assert.match(build.CARGO_TARGET_DIR, /cache[\\/]cargo-target[\\/]win[\\/]deps123/);
+  assert.match(testEnv.CARGO_TARGET_DIR, /cache[\\/]test-target[\\/]win[\\/]deps123/);
+  assert.match(build.SCCACHE_DIR, /cache[\\/]sccache/);
+  assert.equal(build.RUSTC_WRAPPER, "sccache");
+});
+
+test("dependency cache survives source commits and invalidates only dependency/toolchain inputs", () => {
+  const base = {
+    cargoLockSha256: "lock-a",
+    rustc: "rustc 1.90.0 host x86_64-pc-windows-msvc",
+    target: "x86_64-pc-windows-msvc",
+    features: ["bundled-sqlcipher-vendored-openssl"],
+  };
+  assert.equal(cacheFingerprint({ ...base, commit: "aaa" }), cacheFingerprint({ ...base, commit: "bbb" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, cargoLockSha256: "lock-b" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, rustc: "rustc 1.91.0" }));
+  assert.notEqual(cacheFingerprint(base), cacheFingerprint({ ...base, features: ["bundled-sqlcipher"] }));
+});

package/release.mjs

@@ -59,7 +59,7 @@ for (let i = 0; i < args.length; i++) {
   else usage(2, `unknown argument: ${arg}`);
 }
 
-if (!opts.doctor && !opts.tier) usage(2, "--tier is required (patch|update)");
+if (opts.upload) fail("combined build+upload was removed; run right-release build, then right-release upload --release <id> --tier patch|update");
 if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
 
 const configPath = path.resolve(opts.config);
@@ -103,7 +103,7 @@ if (opts.doctor) {
 }
 
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
-const mode = opts.upload ? "publish" : "package";
+const mode = "package";
 const command = target.package;
 if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
@@ -111,7 +111,7 @@ if (opts.upload && !target.publish && !target.upload) {
 }
 
 const started = Date.now();
-console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier}`);
+console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier ?? "neutral"}`);
 
 if (opts.install) await runInstall(config.packageManager, workdir);
 if (!opts.skipChecks) {

package/release.test.mjs

@@ -128,10 +128,11 @@ function runRaw(config, ...args) {
   });
 }
 
-test("rejects a release without an explicit entitlement tier", () => {
+test("accepts a tier-neutral internal build", () => {
   const result = run(fixture());
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /--tier is required.*patch\|update/i);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /tier=neutral/);
+  assert.doesNotMatch(result.stdout, /RIGHT_RELEASE_TIER=/);
 });
 
 test("accepts patch and exposes it to the signed package command", () => {
@@ -233,35 +234,31 @@ test("doctor rejects a RightKit override at an ancestor repository root", () =>
   assert.match(result.stderr, /forbidden RightKit Cargo override/i);
 });
 
-test("publish runs the signed package step before the updater publication step", () => {
+test("combined build and upload is rejected before the package step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
-  assert.equal(result.status, 0, result.stderr);
-  const packageAt = result.stdout.indexOf("node -e process.exit(0)");
-  const publishAt = result.stdout.indexOf("node publish-update.mjs");
-  assert.ok(packageAt >= 0, result.stdout);
-  assert.ok(publishAt > packageAt, result.stdout);
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /combined build\+upload was removed/i);
+  assert.doesNotMatch(result.stdout, /node -e process\.exit\(0\)/);
 });
 
-test("Windows patch signs the installer then minisigns the free updater payload", () => {
-  const result = run(fixture({ publish: true }), "--tier=patch", "--upload");
+test("Windows tier-neutral build signs the installer then minisigns the updater payload", () => {
+  const result = run(fixture({ publish: true }));
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
   const updaterAt = result.stdout.indexOf("sign-updater.mjs");
-  const publishAt = result.stdout.indexOf("publish-update.mjs");
   assert.ok(azureAt >= 0, result.stdout);
   assert.ok(updaterAt > azureAt, result.stdout);
-  assert.ok(publishAt > updaterAt, result.stdout);
+  assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 
-test("Windows update re-signs the updater artifact after Azure code signing", () => {
-  const result = run(fixture({ publish: true }), "--tier=update", "--upload");
+test("legacy internal tier does not make the build worker upload", () => {
+  const result = run(fixture({ publish: true }), "--tier=update");
   assert.equal(result.status, 0, result.stderr);
   const azureAt = result.stdout.indexOf("sign-windows.mjs");
   const updaterAt = result.stdout.indexOf("sign-updater.mjs");
-  const publishAt = result.stdout.indexOf("publish-update.mjs");
   assert.ok(azureAt >= 0, result.stdout);
   assert.ok(updaterAt > azureAt, result.stdout);
-  assert.ok(publishAt > updaterAt, result.stdout);
+  assert.doesNotMatch(result.stdout, /publish-update\.mjs/);
 });
 
 test("release sweeps stale rust artifacts when a target dir exists", () => {

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.29");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.32");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -327,10 +327,9 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.30",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"],
   });
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),

package/rightkit-versions.json

@@ -7,18 +7,17 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.29",
+    "@rightkit/release": "0.2.32",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.30"
+    "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",