@rightkit/release 0.6.3 → 0.6.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -5
- package/bin/darwin/rightkit-swap +0 -0
- package/bin/rightkit-gate.mjs +4 -4
- package/cli/right-release.mjs +3 -2
- package/deterministic-scans.mjs +21 -10
- package/development.mjs +3 -2
- package/hosted-workflow-policy.mjs +111 -0
- package/ios-dev.mjs +2 -2
- package/ios-host.mjs +7 -7
- package/ios-package-recipe.mjs +2 -2
- package/local-publish.mjs +1 -1
- package/local-qualify.mjs +3 -3
- package/local-runtime.mjs +1 -1
- package/package.json +1 -1
- package/pipeline-admission.mjs +5 -4
- package/pipeline-receipts.mjs +302 -302
- package/pipeline-scan.mjs +3 -3
- package/pipeline-tools.mjs +175 -171
- package/prebuild-gates.mjs +187 -0
- package/progress-control.mjs +1 -1
- package/publish-update.mjs +4 -3
- package/qa-admission-policy.json +5 -0
- package/release-config.mjs +353 -330
- package/release-qa-audit.mjs +37 -11
- package/release-qa-command.mjs +46 -5
- package/release-qa-fixtures.mjs +127 -0
- package/release-qa-floor.json +6 -1
- package/release-qa-hardening.mjs +173 -0
- package/release-qa-policy.mjs +168 -0
- package/release-qa-receipt.mjs +21 -1
- package/release-switch-scan.mjs +137 -6
- package/release.mjs +244 -197
- package/rightapps-register.mjs +3 -1
- package/rightkit-drift.mjs +1 -1
- package/rightkit-ownership.json +15 -5
- package/rightkit-versions.json +43 -32
- package/stage-sidecar.mjs +17 -15
- package/suite-api-literal.mjs +109 -0
- package/suite-api.generated.mjs +78 -0
- package/swap-helper-bundle.mjs +2 -2
- package/win-package-recipe.mjs +7 -4
package/win-package-recipe.mjs
CHANGED
|
@@ -130,6 +130,9 @@ export function validateWinPackage({ appRoot, config = {}, target } = {}) {
|
|
|
130
130
|
}
|
|
131
131
|
}
|
|
132
132
|
if (spec.updater === true && target.updater !== undefined && !isPlainObject(target.updater)) issues.push("target.updater must be an object when winPackage.updater is true");
|
|
133
|
+
if (isPlainObject(target.updater) && Object.prototype.hasOwnProperty.call(target.updater, "keyFile")) {
|
|
134
|
+
issues.push("target.updater.keyFile is not supported: updater signing keys come from the OS credential provider (rightkit-credentials, namespace rightsuite-updater-key; see protected-credentials.mjs and sign-updater.mjs), never from a key file. Remove updater.keyFile");
|
|
135
|
+
}
|
|
133
136
|
|
|
134
137
|
if (issues.length) throw new WinPackageConfigError(issues);
|
|
135
138
|
return Object.freeze({
|
|
@@ -142,7 +145,6 @@ export function validateWinPackage({ appRoot, config = {}, target } = {}) {
|
|
|
142
145
|
installerFile,
|
|
143
146
|
sidecars: Object.freeze(sidecars),
|
|
144
147
|
tauriCwd,
|
|
145
|
-
updaterKeyFile: typeof target.updater?.keyFile === "string" ? target.updater.keyFile : null,
|
|
146
148
|
});
|
|
147
149
|
}
|
|
148
150
|
|
|
@@ -181,11 +183,12 @@ export function defaultWinPackageDeps({ appRoot, target, env }) {
|
|
|
181
183
|
const evidence = JSON.parse(readFileSync(receipt, "utf8"));
|
|
182
184
|
return evidence.files.map((item) => ({ file: path.resolve(item.file), sha256: item.after?.sha256 }));
|
|
183
185
|
},
|
|
184
|
-
|
|
186
|
+
// The signing key comes from the OS credential provider inside sign-updater; no key path is ever passed down.
|
|
187
|
+
signUpdater(file, { dryRun = false } = {}) {
|
|
185
188
|
const childEnv = { ...env };
|
|
186
189
|
delete childEnv.TAURI_SIGNING_PRIVATE_KEY;
|
|
187
190
|
delete childEnv.TAURI_SIGNING_PRIVATE_KEY_PASSWORD;
|
|
188
|
-
const result = spawn("node", [SIGN_UPDATER, "--file", file, ...(dryRun ? ["--dry-run"] : [])
|
|
191
|
+
const result = spawn("node", [SIGN_UPDATER, "--file", file, ...(dryRun ? ["--dry-run"] : [])], { cwd: appRoot, env: childEnv });
|
|
189
192
|
if (result.error || result.status !== 0) throw new Error(`sign-updater exited ${result.status ?? result.error?.message}`);
|
|
190
193
|
},
|
|
191
194
|
patchMarker: (file, options) => patchTauriBundleType(file, options),
|
|
@@ -299,7 +302,7 @@ export function runWinPackageRecipe({ appRoot, config = {}, target, deps = {} }
|
|
|
299
302
|
if (plan.updater) {
|
|
300
303
|
phase("updater", () => {
|
|
301
304
|
if (!dry) fs.rmSync(`${installer}.sig`, { force: true });
|
|
302
|
-
d.signUpdater(installer, {
|
|
305
|
+
d.signUpdater(installer, { dryRun: dry });
|
|
303
306
|
if (dry) return;
|
|
304
307
|
if (!fs.existsSync(`${installer}.sig`)) throw new Error(`sign-updater did not write ${installer}.sig`);
|
|
305
308
|
updaterSignature = `${installer}.sig`;
|