@rightkit/release 0.2.35 → 0.2.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.35",
+  "version": "0.2.36",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-cli-contract.test.mjs

@@ -10,6 +10,7 @@ const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 const build = path.join(root, "build-release.mjs");
 const upload = path.join(root, "upload-release.mjs");
+const signWindows = path.join(root, "sign-windows.mjs");
 
 test("CLI routes build and release only to the build state machine", () => {
   const source = readFileSync(cli, "utf8");
@@ -41,3 +42,13 @@ test("upload requires an explicit patch or update tier before reading a release"
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /tier is required.*patch\|update/i);
 });
+
+test("Windows upload trust verification uses signtool instead of PowerShell modules", () => {
+  const uploadSource = readFileSync(upload, "utf8");
+  const signingSource = readFileSync(signWindows, "utf8");
+  assert.match(uploadSource, /SIGN_WINDOWS/);
+  assert.match(uploadSource, /--verify-only/);
+  assert.doesNotMatch(uploadSource, /Get-AuthenticodeSignature/);
+  assert.match(signingSource, /verifyOnly/);
+  assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
+});

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.35");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.36");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.35",
+    "@rightkit/release": "0.2.36",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/sign-windows.mjs

@@ -18,17 +18,24 @@ const userEnvCache = new Map();
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
-const files = args.filter((arg) => arg !== "--dry-run").map((arg) => path.resolve(arg));
+const verifyOnly = args.includes("--verify-only");
+const files = args.filter((arg) => arg !== "--dry-run" && arg !== "--verify-only").map((arg) => path.resolve(arg));
 
-if (!files.length) fail("usage: node sign-windows.mjs [--dry-run] <file>...");
+if (!files.length) fail("usage: node sign-windows.mjs [--dry-run|--verify-only] <file>...");
 if (dryRun) {
-  console.log(`dry-run: Azure Artifact Signing ${files.join(", ")}`);
+  console.log(`dry-run: ${verifyOnly ? "Authenticode verification" : "Azure Artifact Signing"} ${files.join(", ")}`);
   process.exit(0);
 }
 if (process.platform !== "win32") fail("Windows signing must run on Windows");
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
 
+const childEnv = signingEnv();
 const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
+if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
+if (verifyOnly) {
+  for (const file of files) run(signtool, ["verify", "/pa", "/v", file]);
+  process.exit(0);
+}
 const dlib = findFirst([
   env("AZURE_CODESIGN_DLIB_PATH"),
   env("AZURE_ARTIFACT_SIGNING_DLIB_PATH"),
@@ -36,12 +43,10 @@ const dlib = findFirst([
   "C:\\Program Files\\Microsoft Azure Artifact Signing Client Tools\\x64\\Azure.CodeSigning.Dlib.dll",
   "C:\\Program Files (x86)\\Microsoft\\ArtifactSigningClientTools\\bin\\x64\\Azure.CodeSigning.Dlib.dll",
 ]);
-if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
 if (!dlib) fail("Azure.CodeSigning.Dlib.dll not found; set AZURE_CODESIGN_DLIB_PATH or install Azure Artifact Signing Client Tools");
 
 const tempDir = mkdtempSync(path.join(os.tmpdir(), "right-sign-"));
 const metadata = metadataPath(tempDir);
-const childEnv = signingEnv();
 try {
   for (const file of files) {
     run(signtool, ["sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", "/dlib", dlib, "/dmdf", metadata, file]);

package/upload-release.mjs

@@ -9,6 +9,7 @@ import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs"
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const PUBLISH_UPDATE = path.join(TOOL_ROOT, "publish-update.mjs");
 const HARDENING = path.join(TOOL_ROOT, "hardeningscan.mjs");
+const SIGN_WINDOWS = path.join(TOOL_ROOT, "sign-windows.mjs");
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const PUBLIC_BASE = (process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev").replace(/\/$/, "");
 const API_BASE = (process.env.RIGHTAPPS_API_URL || "https://api.spoares.com").replace(/\/$/, "");
@@ -73,9 +74,7 @@ function verifyPlatformTrust(release) {
   if (platform === "win") {
     for (const artifact of artifacts) {
       const file = path.join(release.sealedDir, artifact.name);
-      const escaped = file.replaceAll("'", "''");
-      const status = commandOutput("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${escaped}').Status`]);
-      if (status.trim() !== "Valid") throw new Error(`Authenticode verification failed for ${artifact.name}: ${status}`);
+      runChecked(process.execPath, [SIGN_WINDOWS, "--verify-only", file], repoRoot);
     }
   } else {
     for (const artifact of artifacts.filter((file) => /\.dmg$/i.test(file.name))) {