@rightkit/release 0.2.34 → 0.2.36

package/build-release.mjs

@@ -20,7 +20,7 @@ import {
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { cacheFingerprint, commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine } from "./release-state.mjs";
+import { cacheFingerprint, commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, watchProgress } from "./release-state.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
@@ -145,7 +145,13 @@ try {
         await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
       },
       build: async () => {
-        await runProgress(process.execPath, [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"], appRoot, env, env.CARGO_TARGET_DIR);
+        await runProgress(
+          process.execPath,
+          [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"],
+          appRoot,
+          env,
+          [env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+        );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
         checkpoint(stateRoot, "hardened");
@@ -269,22 +275,25 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir) {
   const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
   const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
   let lastProgress = Date.now();
-  let lastMtime = newestMtime(watchDir);
+  const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
+  let lastMtime = Math.max(...watchDirs.map(newestMtime));
   const started = Date.now();
   await new Promise((resolve, reject) => {
     child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    const closeWatchers = watchProgress(watchDirs, () => { lastProgress = Date.now(); });
     for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
       stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
     }
     const monitor = setInterval(() => {
-      const mtime = newestMtime(watchDir);
+      const mtime = Math.max(...watchDirs.map(newestMtime));
       if (mtime > lastMtime) { lastMtime = mtime; lastProgress = Date.now(); }
       if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`);
       else if (Date.now() - lastProgress > inactivityMs) stop(`no output or file progress for ${Math.round(inactivityMs / 60000)}m`);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
-    const stop = (reason) => { clearInterval(monitor); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
-    child.once("error", (error) => { clearInterval(monitor); reject(error); });
-    child.once("exit", (code) => { clearInterval(monitor); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+    const cleanup = () => { clearInterval(monitor); closeWatchers(); };
+    const stop = (reason) => { cleanup(); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
+    child.once("error", (error) => { cleanup(); reject(error); });
+    child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-cli-contract.test.mjs

@@ -10,6 +10,7 @@ const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 const build = path.join(root, "build-release.mjs");
 const upload = path.join(root, "upload-release.mjs");
+const signWindows = path.join(root, "sign-windows.mjs");
 
 test("CLI routes build and release only to the build state machine", () => {
   const source = readFileSync(cli, "utf8");
@@ -41,3 +42,13 @@ test("upload requires an explicit patch or update tier before reading a release"
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /tier is required.*patch\|update/i);
 });
+
+test("Windows upload trust verification uses signtool instead of PowerShell modules", () => {
+  const uploadSource = readFileSync(upload, "utf8");
+  const signingSource = readFileSync(signWindows, "utf8");
+  assert.match(uploadSource, /SIGN_WINDOWS/);
+  assert.match(uploadSource, /--verify-only/);
+  assert.doesNotMatch(uploadSource, /Get-AuthenticodeSignature/);
+  assert.match(signingSource, /verifyOnly/);
+  assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
+});

package/release-state.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, watch } from "node:fs";
 import path from "node:path";
 
 export function cacheFingerprint({ cargoLockSha256, rustc, target, features = [] }) {
@@ -44,6 +44,21 @@ export function commandOutputPortable(cmd, args, { cwd, env = process.env } = {}
   return result.stdout.trim();
 }
 
+export function watchProgress(paths, onProgress) {
+  const watchers = [];
+  for (const candidate of paths) {
+    if (!candidate || !existsSync(candidate)) continue;
+    try {
+      watchers.push(watch(candidate, { recursive: true }, onProgress));
+    } catch {
+      try { watchers.push(watch(candidate, onProgress)); } catch { /* output still counts as progress */ }
+    }
+  }
+  return () => {
+    for (const watcher of watchers) watcher.close();
+  };
+}
+
 export function releaseEnvironment({ root, platform, cacheKey, kind = "release" }) {
   if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
   const targetKind = kind === "release" ? "cargo-target" : "test-target";

package/release-state.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
 import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -8,6 +9,7 @@ import test from "node:test";
 import {
   cacheFingerprint,
   commandOutputPortable,
+  watchProgress,
   resolveReleaseLayout,
   releaseEnvironment,
   runBuildStateMachine,
@@ -15,6 +17,24 @@ import {
   verifySealedRelease,
 } from "./release-state.mjs";
 
+test("progress watcher observes writes in nested Cargo target directories", async () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-watch-"));
+  const nested = path.join(root, "release", "build", "openssl");
+  mkdirSync(nested, { recursive: true });
+  let resolveProgress;
+  const progress = new Promise((resolve) => { resolveProgress = resolve; });
+  const close = watchProgress([root], resolveProgress);
+  try {
+    await writeFile(path.join(nested, "object.lib"), "progress");
+    await Promise.race([
+      progress,
+      new Promise((_, reject) => setTimeout(() => reject(new Error("nested progress event missing")), 2_000)),
+    ]);
+  } finally {
+    close();
+  }
+});
+
 test("portable command capture resolves Windows command shims", { skip: process.platform !== "win32" }, () => {
   assert.match(commandOutputPortable("pnpm", ["--version"]), /^11\.12\.0$/);
 });

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.34");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.36");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.34",
+    "@rightkit/release": "0.2.36",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/sign-windows.mjs

@@ -18,17 +18,24 @@ const userEnvCache = new Map();
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
-const files = args.filter((arg) => arg !== "--dry-run").map((arg) => path.resolve(arg));
+const verifyOnly = args.includes("--verify-only");
+const files = args.filter((arg) => arg !== "--dry-run" && arg !== "--verify-only").map((arg) => path.resolve(arg));
 
-if (!files.length) fail("usage: node sign-windows.mjs [--dry-run] <file>...");
+if (!files.length) fail("usage: node sign-windows.mjs [--dry-run|--verify-only] <file>...");
 if (dryRun) {
-  console.log(`dry-run: Azure Artifact Signing ${files.join(", ")}`);
+  console.log(`dry-run: ${verifyOnly ? "Authenticode verification" : "Azure Artifact Signing"} ${files.join(", ")}`);
   process.exit(0);
 }
 if (process.platform !== "win32") fail("Windows signing must run on Windows");
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
 
+const childEnv = signingEnv();
 const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
+if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
+if (verifyOnly) {
+  for (const file of files) run(signtool, ["verify", "/pa", "/v", file]);
+  process.exit(0);
+}
 const dlib = findFirst([
   env("AZURE_CODESIGN_DLIB_PATH"),
   env("AZURE_ARTIFACT_SIGNING_DLIB_PATH"),
@@ -36,12 +43,10 @@ const dlib = findFirst([
   "C:\\Program Files\\Microsoft Azure Artifact Signing Client Tools\\x64\\Azure.CodeSigning.Dlib.dll",
   "C:\\Program Files (x86)\\Microsoft\\ArtifactSigningClientTools\\bin\\x64\\Azure.CodeSigning.Dlib.dll",
 ]);
-if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
 if (!dlib) fail("Azure.CodeSigning.Dlib.dll not found; set AZURE_CODESIGN_DLIB_PATH or install Azure Artifact Signing Client Tools");
 
 const tempDir = mkdtempSync(path.join(os.tmpdir(), "right-sign-"));
 const metadata = metadataPath(tempDir);
-const childEnv = signingEnv();
 try {
   for (const file of files) {
     run(signtool, ["sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", "/dlib", dlib, "/dmdf", metadata, file]);

package/upload-release.mjs

@@ -9,6 +9,7 @@ import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs"
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const PUBLISH_UPDATE = path.join(TOOL_ROOT, "publish-update.mjs");
 const HARDENING = path.join(TOOL_ROOT, "hardeningscan.mjs");
+const SIGN_WINDOWS = path.join(TOOL_ROOT, "sign-windows.mjs");
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const PUBLIC_BASE = (process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev").replace(/\/$/, "");
 const API_BASE = (process.env.RIGHTAPPS_API_URL || "https://api.spoares.com").replace(/\/$/, "");
@@ -73,9 +74,7 @@ function verifyPlatformTrust(release) {
   if (platform === "win") {
     for (const artifact of artifacts) {
       const file = path.join(release.sealedDir, artifact.name);
-      const escaped = file.replaceAll("'", "''");
-      const status = commandOutput("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${escaped}').Status`]);
-      if (status.trim() !== "Valid") throw new Error(`Authenticode verification failed for ${artifact.name}: ${status}`);
+      runChecked(process.execPath, [SIGN_WINDOWS, "--verify-only", file], repoRoot);
     }
   } else {
     for (const artifact of artifacts.filter((file) => /\.dmg$/i.test(file.name))) {