@rightkit/release 0.2.58 → 0.2.59

package/addon-command.mjs

@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { addonManifestSha256, addonRoutes, canonicalAddonManifest, createAddonManifest, downloadImmutableAddOn, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
+import { addonManifestSha256, addonRoutes, canonicalAddonManifest, createAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 
@@ -80,6 +80,7 @@ function signExecutableRoles(config, root, platform) {
 }
 
 async function upload({ config, root, repoRoot, options }) {
+  if (config.distribution?.provider === "github-releases") fail("this add-on publishes with right-release github --addon <config> --platform <platform>");
   if (!new Set(["patch", "update"]).has(options.tier)) fail("add-on upload requires --tier patch|update");
   const commit = git(repoRoot, ["rev-parse", "HEAD"]);
   const sealed = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), options.platform);
@@ -124,8 +125,7 @@ async function adopt(options) {
   const manifest = JSON.parse(readFileSync(path.join(source, "addon-manifest.json"), "utf8"));
   validateAddonManifest(manifest);
   if (addonManifestSha256(manifest) !== entry.manifestSha256) fail("add-on lock manifest SHA mismatch");
-  const immutableSuffix = `/${manifest.addon}/addons/${manifest.platform}/sha256/${entry.manifestSha256}/addon-manifest.json`;
-  if (!entry.manifestUrl.endsWith(immutableSuffix) || /[?#]/.test(entry.manifestUrl)) fail("add-on lock manifestUrl is not immutable");
+  if (!immutableAddonManifestUrl(manifest, entry.manifestUrl, entry.manifestSha256)) fail("add-on lock manifestUrl is not immutable");
   const output = path.resolve(options.output);
   const destination = path.join(output, manifest.addon);
   const stage = `${destination}.tmp-${process.pid}`;

package/addon-command.test.mjs

@@ -5,7 +5,7 @@ import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import test from "node:test";
-import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn } from "./addon-contract.mjs";
+import { createAddonManifest, addonManifestSha256, canonicalAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl } from "./addon-contract.mjs";
 
 const command = fileURLToPath(new URL("./addon-command.mjs", import.meta.url));
 function fixture() {
@@ -50,4 +50,5 @@ test("remote downloader accepts only immutable manifest plus file routes", async
   const destination = path.join(root, "remote"); mkdirSync(destination);
   await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
   assert.equal(readFileSync(path.join(destination, "crypt-service"), "utf8"), "service");
+  assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
 });

package/addon-contract.mjs

@@ -6,12 +6,14 @@ const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const ROLES = new Set(["command", "service", "icon", "license", "eula", "privacy", "third-party-notices"]);
 const LEGAL_ROLES = new Set(["license", "eula", "privacy", "third-party-notices"]);
 const PLATFORM = new Set(["mac", "win"]);
+const GITHUB_REPOSITORY = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 
 export function validateAddonConfig(config, { root, platform, allowMissingExecutables = false }) {
   if (!PLATFORM.has(platform)) throw new Error("add-on platform must be mac or win");
   if (!config || config.schema !== 1 || config.kind !== "headless-addon") throw new Error("add-on config must use schema 1 headless-addon");
   for (const key of ["addon", "version", "packageManager"]) if (typeof config[key] !== "string" || !SAFE_NAME.test(config[key])) throw new Error(`unsafe add-on ${key}`);
   if (!Array.isArray(config.checks)) throw new Error("add-on checks must be an array");
+  if (config.distribution && (config.distribution.provider !== "github-releases" || !GITHUB_REPOSITORY.test(config.distribution.repository ?? ""))) throw new Error("add-on distribution must name a GitHub Releases repository");
   validateBuildInputs(config.buildInputs);
   const target = config.targets?.[platform];
   if (!target?.targetTriple || !target?.build?.cmd || !Array.isArray(target.build.args)) throw new Error(`add-on ${platform} target requires targetTriple and build command`);
@@ -79,6 +81,14 @@ export function addonRoutes(manifest) {
   return [...manifest.files.map((file) => ({ name: file.name, key: `${root}/${file.name}`, sha256: file.sha256, manifest: false })), { name: "addon-manifest.json", key: `${root}/addon-manifest.json`, sha256: digest, manifest: true }];
 }
 
+export function immutableAddonManifestUrl(manifest, manifestUrl, digest = addonManifestSha256(manifest)) {
+  if (/[?#]/.test(manifestUrl)) return false;
+  const r2Suffix = `/${manifest.addon}/addons/${manifest.platform}/sha256/${digest}/addon-manifest.json`;
+  const githubTag = `addon-${manifest.addon}-v${manifest.version}-${manifest.platform}-sha256-${digest}`;
+  const githubSuffix = `/releases/download/${githubTag}/addon-manifest.json`;
+  return manifestUrl.endsWith(r2Suffix) || (/^https:\/\/github\.com\//.test(manifestUrl) && manifestUrl.endsWith(githubSuffix));
+}
+
 export async function downloadImmutableAddOn(manifestUrl, destination, { fetchImpl = fetch } = {}) {
   if (!/^https:\/\//.test(manifestUrl) || !manifestUrl.endsWith("/addon-manifest.json") || /[?#]/.test(manifestUrl)) throw new Error("add-on lock manifestUrl must be an immutable HTTPS manifest URL");
   const download = async (url, file) => {

package/github-release.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
+import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
@@ -37,24 +38,69 @@ export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stat
       `Build commit: \`${sealed.manifest.commit}\``,
       `SHA-256: \`${installers[0].sha256}\``,
     ].join("\n"),
+    notesFile: path.join(releaseState, "release-notes.md"),
+  };
+}
+
+export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoRoot, platform, repo }) {
+  if (platform !== "mac" && platform !== "win") throw new Error("platform must be mac or win");
+  if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
+  validateAddonConfig(config, { root: configRoot, platform, allowMissingExecutables: true });
+  const commit = runCommand("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+  const sealedDir = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), platform);
+  const manifestPath = path.join(sealedDir, "addon-manifest.json");
+  if (!existsSync(manifestPath)) throw new Error(`sealed add-on manifest not found: ${manifestPath}`);
+  const manifest = validateAddonManifest(JSON.parse(readFileSync(manifestPath, "utf8")));
+  if (manifest.addon !== config.addon || manifest.version !== config.version || manifest.platform !== platform || manifest.commit !== commit) throw new Error("sealed add-on identity mismatch");
+  const assets = manifest.files.map((file) => {
+    const asset = path.join(sealedDir, file.name);
+    if (!existsSync(asset) || statSync(asset).size !== file.sizeBytes || sha256(asset) !== file.sha256) throw new Error(`sealed add-on file mismatch: ${file.name}`);
+    return asset;
+  });
+  const digest = addonManifestSha256(manifest);
+  const tag = `addon-${manifest.addon}-v${manifest.version}-${platform}-sha256-${digest}`;
+  const stateDir = path.join(repoRoot, ".right-release", "state", "addons", manifest.addon, manifest.version, commit.slice(0, 8), platform, "github");
+  mkdirSync(stateDir, { recursive: true });
+  return {
+    kind: "addon", manifest, manifestPath, sealedDir, assets: [...assets, manifestPath], tag,
+    title: `${manifest.addon} ${manifest.version} ${platform} add-on`,
+    notes: [`Signed ${platform === "mac" ? "macOS" : "Windows"} add-on component set.`, "", `Build commit: \`${manifest.commit}\``, `Manifest SHA-256: \`${digest}\``].join("\n"),
+    notesFile: path.join(stateDir, "release-notes.md"),
+    manifestUrl: `https://github.com/${repo}/releases/download/${tag}/addon-manifest.json`,
   };
 }
 
 export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC") throw new Error(`GitHub releases require a public repository: ${repo}`);
-  verifyPlatformTrust(plan);
+  if (plan.kind === "addon") verifyAddonTrust(plan);
+  else verifyPlatformTrust(plan);
   const existing = run("gh", ["release", "view", plan.tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
-  if (dryRun) return { status: existing.ok ? "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
+  if (dryRun) return { status: existing.ok ? plan.kind === "addon" ? "would-verify" : "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
+  if (plan.kind === "addon" && existing.ok) {
+    for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
+    return { status: "already-verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
+  }
   if (!existing.ok) {
-    const notesFile = `${plan.assets[1]}.notes.md`;
+    const notesFile = plan.notesFile;
     writeFileSync(notesFile, `${plan.notes}\n`);
     run("gh", ["release", "create", plan.tag, "--repo", repo, "--title", plan.title, "--notes-file", notesFile]);
     rmSync(notesFile, { force: true });
   }
   run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo, "--clobber"]);
   for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
-  return { status: "verified", tag: plan.tag, assets: plan.assets };
+  return { status: "verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
+}
+
+function verifyAddonTrust(plan) {
+  for (const file of plan.manifest.files.filter((entry) => entry.executable)) {
+    const executable = path.join(plan.sealedDir, file.name);
+    if (plan.manifest.platform === "mac") {
+      const output = runCombined("codesign", ["-dv", "--verbose=4", executable]);
+      if (!/TeamIdentifier=6KLGD3LLKF/.test(output)) throw new Error(`codesign team mismatch: ${file.name}`);
+      runCommand("codesign", ["--verify", "--strict", "--verbose=2", executable]);
+    } else runCommand(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "sign-windows.mjs"), "--verify-only", executable]);
+  }
 }
 
 function verifyPlatformTrust(plan) {
@@ -77,8 +123,8 @@ function sha256(file) {
   return createHash("sha256").update(readFileSync(file)).digest("hex");
 }
 
-function runCommand(command, args, { allowFailure = false } = {}) {
-  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+function runCommand(command, args, { allowFailure = false, cwd } = {}) {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8", windowsHide: true });
   const output = result.stdout?.trim() ?? "";
   if (result.status !== 0) {
     if (allowFailure) return { ok: false, output, error: result.stderr?.trim() ?? "" };
@@ -87,25 +133,43 @@ function runCommand(command, args, { allowFailure = false } = {}) {
   return allowFailure ? { ok: true, output } : output;
 }
 
+function runCombined(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
+  return `${result.stdout ?? ""}${result.stderr ?? ""}`;
+}
+
 function usage(code) {
-  console.log("usage: right-release github --release <sealed-id> --platform mac|win --repo owner/repo [--dry-run]");
+  console.log("usage: right-release github (--release <sealed-id> | --addon <config>) --platform mac|win [--repo owner/repo] [--dry-run]");
   process.exit(code);
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const args = process.argv.slice(2);
-  const options = { platform: process.platform === "win32" ? "win" : "mac", releaseId: "", repo: "", dryRun: false };
+  const options = { platform: process.platform === "win32" ? "win" : "mac", releaseId: "", addon: "", repo: "", dryRun: false };
   for (let index = 0; index < args.length; index += 1) {
     if (args[index] === "--platform") options.platform = args[++index];
     else if (args[index] === "--release") options.releaseId = args[++index];
+    else if (args[index] === "--addon") options.addon = args[++index];
     else if (args[index] === "--repo") options.repo = args[++index];
     else if (args[index] === "--dry-run") options.dryRun = true;
     else if (args[index] === "-h" || args[index] === "--help") usage(0);
     else throw new Error(`unknown argument: ${args[index]}`);
   }
-  if (!options.releaseId || !options.repo) usage(2);
+  if (Boolean(options.releaseId) === Boolean(options.addon)) usage(2);
   const repoRoot = runCommand("git", ["rev-parse", "--show-toplevel"]);
-  const plan = prepareGitHubRelease({ repoRoot, ...options });
+  let plan;
+  if (options.addon) {
+    const configPath = path.resolve(options.addon);
+    const config = (await import(`${pathToFileURL(configPath).href}?github=${Date.now()}`)).default;
+    options.repo ||= config.distribution?.repository ?? "";
+    if (config.distribution?.provider !== "github-releases") throw new Error("add-on config must select github-releases distribution");
+    plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
+  } else {
+    if (!options.repo) usage(2);
+    plan = prepareGitHubRelease({ repoRoot, ...options });
+  }
   const result = publishGitHubRelease(plan, options);
   console.log(`right-release github: ${result.status} ${result.tag}`);
+  if (result.manifestUrl) console.log(`manifestUrl: ${result.manifestUrl}`);
 }

package/github-release.test.mjs

@@ -4,7 +4,9 @@ import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
-import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
+import { execFileSync } from "node:child_process";
+import { canonicalAddonManifest, createAddonManifest } from "./addon-contract.mjs";
+import { prepareGitHubAddonRelease, prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
 
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 
@@ -22,6 +24,24 @@ function fixture() {
   return { root, releaseId };
 }
 
+function addonFixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
+  mkdirSync(path.join(root, "out"));
+  for (const [name, bytes] of [["membrane", "command"], ["crypt-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
+  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
+  execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
+  execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
+  writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
+  const files = [["command", "membrane", true], ["service", "crypt-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
+  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "orthic-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
+  const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+  const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
+  const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });
+  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, "out", file.name)));
+  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
+  return { root, config };
+}
+
 test("GitHub plan derives tag, notes, installer, manifest & checksums only from sealed bytes", () => {
   const fx = fixture();
   const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
@@ -44,3 +64,26 @@ test("dry-run checks public visibility without creating or uploading a release",
   assert.equal(publishGitHubRelease(plan, { repo: "Orthic-Labs/CutRight", dryRun: true, run }).status, "would-create");
   assert.equal(calls.length, 2);
 });
+
+test("GitHub add-on plan uses a content-addressed platform tag and manifest URL", () => {
+  const fx = addonFixture();
+  const plan = prepareGitHubAddonRelease({ repoRoot: fx.root, config: fx.config, platform: "win", repo: "Orthic-Labs/Membrane" });
+  assert.match(plan.tag, /^addon-membrane-v0\.1\.0-win-sha256-[0-9a-f]{64}$/);
+  assert.equal(plan.assets.at(-1), plan.manifestPath);
+  assert.equal(plan.manifestUrl, `https://github.com/Orthic-Labs/Membrane/releases/download/${plan.tag}/addon-manifest.json`);
+});
+
+test("existing GitHub add-on release is verified without upload mutation", () => {
+  const asset = path.join(mkdtempSync(path.join(os.tmpdir(), "right-release-existing-")), "addon-manifest.json"); writeFileSync(asset, "sealed");
+  const calls = [];
+  const run = (_command, args, options = {}) => {
+    calls.push(args);
+    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
+    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: true } : "";
+    if (args[0] === "release" && args[1] === "download") { mkdirSync(args[args.indexOf("--dir") + 1], { recursive: true }); writeFileSync(path.join(args[args.indexOf("--dir") + 1], path.basename(asset)), "sealed"); return ""; }
+    throw new Error(`unexpected mutation: ${args.join(" ")}`);
+  };
+  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: path.dirname(asset), tag: "immutable", assets: [asset], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
+  assert.equal(result.status, "already-verified");
+  assert.equal(calls.some((args) => args[0] === "release" && args[1] === "upload"), false);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.58",
+  "version": "0.2.59",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/right-suite-contract.test.mjs

@@ -464,7 +464,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.58",
+    "@rightkit/release": "0.2.59",
     "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {

package/rightkit-versions.json

@@ -18,7 +18,7 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.58",
+    "@rightkit/release": "0.2.59",
     "@rightkit/qa": "0.2.0"
   },
   "legacyNpm": {