@rightkit/release 0.2.35 → 0.2.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/release-cli-contract.test.mjs

@@ -10,6 +10,7 @@ const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 const build = path.join(root, "build-release.mjs");
 const upload = path.join(root, "upload-release.mjs");
+const signWindows = path.join(root, "sign-windows.mjs");
 
 test("CLI routes build and release only to the build state machine", () => {
   const source = readFileSync(cli, "utf8");
@@ -41,3 +42,19 @@ test("upload requires an explicit patch or update tier before reading a release"
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /tier is required.*patch\|update/i);
 });
+
+test("Windows upload trust verification uses signtool instead of PowerShell modules", () => {
+  const uploadSource = readFileSync(upload, "utf8");
+  const signingSource = readFileSync(signWindows, "utf8");
+  assert.match(uploadSource, /SIGN_WINDOWS/);
+  assert.match(uploadSource, /--verify-only/);
+  assert.doesNotMatch(uploadSource, /Get-AuthenticodeSignature/);
+  assert.match(signingSource, /verifyOnly/);
+  assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
+});
+
+test("upload uses only the pinned pnpm runner", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);
+  assert.doesNotMatch(source, /\bnpx\b/);
+});

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.35");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.37");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.35",
+    "@rightkit/release": "0.2.37",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/sign-windows.mjs

@@ -18,17 +18,24 @@ const userEnvCache = new Map();
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
-const files = args.filter((arg) => arg !== "--dry-run").map((arg) => path.resolve(arg));
+const verifyOnly = args.includes("--verify-only");
+const files = args.filter((arg) => arg !== "--dry-run" && arg !== "--verify-only").map((arg) => path.resolve(arg));
 
-if (!files.length) fail("usage: node sign-windows.mjs [--dry-run] <file>...");
+if (!files.length) fail("usage: node sign-windows.mjs [--dry-run|--verify-only] <file>...");
 if (dryRun) {
-  console.log(`dry-run: Azure Artifact Signing ${files.join(", ")}`);
+  console.log(`dry-run: ${verifyOnly ? "Authenticode verification" : "Azure Artifact Signing"} ${files.join(", ")}`);
   process.exit(0);
 }
 if (process.platform !== "win32") fail("Windows signing must run on Windows");
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
 
+const childEnv = signingEnv();
 const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
+if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
+if (verifyOnly) {
+  for (const file of files) run(signtool, ["verify", "/pa", "/v", file]);
+  process.exit(0);
+}
 const dlib = findFirst([
   env("AZURE_CODESIGN_DLIB_PATH"),
   env("AZURE_ARTIFACT_SIGNING_DLIB_PATH"),
@@ -36,12 +43,10 @@ const dlib = findFirst([
   "C:\\Program Files\\Microsoft Azure Artifact Signing Client Tools\\x64\\Azure.CodeSigning.Dlib.dll",
   "C:\\Program Files (x86)\\Microsoft\\ArtifactSigningClientTools\\bin\\x64\\Azure.CodeSigning.Dlib.dll",
 ]);
-if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
 if (!dlib) fail("Azure.CodeSigning.Dlib.dll not found; set AZURE_CODESIGN_DLIB_PATH or install Azure Artifact Signing Client Tools");
 
 const tempDir = mkdtempSync(path.join(os.tmpdir(), "right-sign-"));
 const metadata = metadataPath(tempDir);
-const childEnv = signingEnv();
 try {
   for (const file of files) {
     run(signtool, ["sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", "/dlib", dlib, "/dmdf", metadata, file]);

package/upload-large.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/upload-large.test.mjs

@@ -46,10 +46,7 @@ test("refuses unknown bucket aliases", () => {
 test("resolves a real package runner for wrangler on this machine", () => {
   const result = run("public");
   assert.equal(result.status, 0, result.stderr);
-  // A node install carrying neither npm nor npx is normal where pnpm is the pinned package
-  // manager; the uploader must find a runner that actually exists rather than assume npx.
-  // Assuming npx once made every R2 upload a silent no-op while the publish reported success.
-  assert.match(result.stdout, /^runner: (npx|pnpm dlx)$/m);
+  assert.match(result.stdout, /^runner: pnpm dlx$/m);
 });
 
 test("fails loudly when no package runner exists instead of skipping the upload", () => {
@@ -71,16 +68,3 @@ test("fails loudly when no package runner exists instead of skipping the upload"
   assert.notEqual(result.status, 0, "a box with no runner must not report a successful upload");
   assert.match(result.stderr, /no package runner found/);
 });
-
-test("honours an explicit runner override", () => {
-  const result = spawnSync(
-    process.execPath,
-    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
-    {
-      encoding: "utf8",
-      env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1", RIGHT_RELEASE_WRANGLER_RUNNER: "pnpm dlx" },
-    },
-  );
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /^runner: pnpm dlx$/m);
-});

package/upload-release.mjs

@@ -9,6 +9,7 @@ import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs"
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const PUBLISH_UPDATE = path.join(TOOL_ROOT, "publish-update.mjs");
 const HARDENING = path.join(TOOL_ROOT, "hardeningscan.mjs");
+const SIGN_WINDOWS = path.join(TOOL_ROOT, "sign-windows.mjs");
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 const PUBLIC_BASE = (process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev").replace(/\/$/, "");
 const API_BASE = (process.env.RIGHTAPPS_API_URL || "https://api.spoares.com").replace(/\/$/, "");
@@ -73,9 +74,7 @@ function verifyPlatformTrust(release) {
   if (platform === "win") {
     for (const artifact of artifacts) {
       const file = path.join(release.sealedDir, artifact.name);
-      const escaped = file.replaceAll("'", "''");
-      const status = commandOutput("powershell", ["-NoProfile", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${escaped}').Status`]);
-      if (status.trim() !== "Valid") throw new Error(`Authenticode verification failed for ${artifact.name}: ${status}`);
+      runChecked(process.execPath, [SIGN_WINDOWS, "--verify-only", file], repoRoot);
     }
   } else {
     for (const artifact of artifacts.filter((file) => /\.dmg$/i.test(file.name))) {
@@ -183,7 +182,7 @@ function bucketName(bucket) {
 }
 
 function wrangler(runArgs) {
-  return spawnSync("npx", ["wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
+  return spawnSync("pnpm", ["dlx", "wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
 }
 
 function hashFile(file) {