biucingcli 0.9.1__py3-none-any.whl

biucingcli/template_data/harmonyos/template/scripts/release-build

@@ -0,0 +1,199 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HVIGOR_BIN="${HVIGOR:-hvigorw}"
+MODULE_NAME="{{HARMONY_MODULE_NAME}}"
+BUILD_PROFILE="build-profile.json5"
+BACKUP_DIR=".biucing/release"
+BACKUP_PROFILE="${BACKUP_DIR}/build-profile.json5.backup"
+GENERATED_PROFILE="${BACKUP_DIR}/build-profile.json5.generated"
+RESTORE_PROFILE="${BACKUP_DIR}/build-profile.json5.restore"
+BUILD_MARKER="${BACKUP_DIR}/release-build.started"
+
+if [[ ! -f "local.properties" ]]; then
+  cat >&2 <<'EOF'
+local.properties is missing.
+
+Copy docs/release-signing.local.properties.example to local.properties and fill in
+your HarmonyOS signing material before running make release.
+EOF
+  exit 1
+fi
+
+./scripts/verify-supply-chain
+./scripts/release-preflight
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1 || \
+  ! git ls-files --error-unmatch "$BUILD_PROFILE" >/dev/null 2>&1; then
+  echo "$BUILD_PROFILE must be tracked in a Git repository before a signed release." >&2
+  exit 1
+fi
+
+if ! git diff --quiet -- "$BUILD_PROFILE" || ! git diff --cached --quiet -- "$BUILD_PROFILE"; then
+  echo "$BUILD_PROFILE has staged or unstaged changes." >&2
+  echo "Commit or stash those changes before running a signed release." >&2
+  exit 1
+fi
+
+if ORIGINAL_MODE="$(stat -f '%Lp' "$BUILD_PROFILE" 2>/dev/null)"; then
+  :
+else
+  ORIGINAL_MODE="$(stat -c '%a' "$BUILD_PROFILE")"
+fi
+
+umask 077
+mkdir -p "$BACKUP_DIR"
+cp -p "$BUILD_PROFILE" "$BACKUP_PROFILE"
+chmod 600 "$BACKUP_PROFILE"
+
+restore_build_profile() {
+  local original_status=$?
+  local restore_status=0
+
+  trap - EXIT HUP INT TERM
+  rm -f "$GENERATED_PROFILE" "$RESTORE_PROFILE" "$BUILD_MARKER"
+
+  if [[ -f "$BACKUP_PROFILE" ]]; then
+    if cp -p "$BACKUP_PROFILE" "$RESTORE_PROFILE" && \
+      mv -f "$RESTORE_PROFILE" "$BUILD_PROFILE" && chmod "$ORIGINAL_MODE" "$BUILD_PROFILE"; then
+      if cmp -s "$BACKUP_PROFILE" "$BUILD_PROFILE"; then
+        rm -f "$BACKUP_PROFILE"
+        rmdir "$BACKUP_DIR" 2>/dev/null || true
+      else
+        echo "Failed to verify restoration of $BUILD_PROFILE; backup retained at $BACKUP_PROFILE." >&2
+        restore_status=1
+      fi
+    else
+      echo "Failed to restore $BUILD_PROFILE; backup retained at $BACKUP_PROFILE." >&2
+      restore_status=1
+    fi
+  fi
+
+  if [[ "$restore_status" -ne 0 ]]; then
+    exit "$restore_status"
+  fi
+  exit "$original_status"
+}
+trap restore_build_profile EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+BUILD_PROFILE_PATH="$BUILD_PROFILE" GENERATED_PROFILE_PATH="$GENERATED_PROFILE" node <<'NODE'
+const fs = require('fs');
+const path = require('path');
+
+const localPropertiesPath = 'local.properties';
+const buildProfilePath = process.env.BUILD_PROFILE_PATH;
+const generatedProfilePath = process.env.GENERATED_PROFILE_PATH;
+const requiredKeys = [
+  'biucing.harmony.signing.certpath',
+  'biucing.harmony.signing.profile',
+  'biucing.harmony.signing.storeFile',
+  'biucing.harmony.signing.storePassword',
+  'biucing.harmony.signing.keyAlias',
+  'biucing.harmony.signing.keyPassword'
+];
+
+function parseProperties(raw) {
+  const values = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const separator = trimmed.indexOf('=');
+    if (separator < 0) {
+      continue;
+    }
+    const key = trimmed.slice(0, separator).trim();
+    const value = trimmed.slice(separator + 1).trim();
+    values[key] = value;
+  }
+  return values;
+}
+
+const properties = parseProperties(fs.readFileSync(localPropertiesPath, 'utf8'));
+const missing = requiredKeys.filter((key) => !properties[key]);
+if (missing.length > 0) {
+  console.error(`Missing signing key(s) in ${localPropertiesPath}:`);
+  for (const key of missing) {
+    console.error(`  - ${key}`);
+  }
+  process.exit(1);
+}
+
+for (const key of [
+  'biucing.harmony.signing.certpath',
+  'biucing.harmony.signing.profile',
+  'biucing.harmony.signing.storeFile'
+]) {
+  const value = properties[key];
+  const resolved = path.isAbsolute(value) ? value : path.resolve(value);
+  if (!fs.existsSync(resolved)) {
+    console.error(`Signing file for ${key} does not exist: ${value}`);
+    process.exit(1);
+  }
+}
+
+const buildProfile = JSON.parse(fs.readFileSync(buildProfilePath, 'utf8'));
+const material = {
+  certpath: properties['biucing.harmony.signing.certpath'],
+  profile: properties['biucing.harmony.signing.profile'],
+  storeFile: properties['biucing.harmony.signing.storeFile'],
+  storePassword: properties['biucing.harmony.signing.storePassword'],
+  keyAlias: properties['biucing.harmony.signing.keyAlias'],
+  keyPassword: properties['biucing.harmony.signing.keyPassword'],
+  signAlg: properties['biucing.harmony.signing.signAlg'] || 'SHA256withECDSA'
+};
+
+buildProfile.app.signingConfigs = [
+  {
+    name: 'release',
+    type: 'HarmonyOS',
+    material
+  }
+];
+for (const product of buildProfile.app.products || []) {
+  product.signingConfig = 'release';
+}
+
+fs.writeFileSync(generatedProfilePath, `${JSON.stringify(buildProfile, null, 2)}\n`, { mode: 0o600 });
+console.log('Injected release signing config from local.properties.');
+NODE
+
+mv -f "$GENERATED_PROFILE" "$BUILD_PROFILE"
+
+touch "$BUILD_MARKER"
+"$HVIGOR_BIN" assembleHap --mode module -p "module=${MODULE_NAME}" -p buildMode=release
+release_artifact="$(MODULE_BUILD_ROOT="${MODULE_NAME}/build" BUILD_MARKER_PATH="$BUILD_MARKER" node <<'NODE'
+const fs = require('fs');
+const path = require('path');
+const markerTime = fs.statSync(process.env.BUILD_MARKER_PATH).mtimeMs;
+const candidates = [];
+
+function visit(directory) {
+  if (!fs.existsSync(directory)) return;
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const candidate = path.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      visit(candidate);
+    } else if (entry.isFile() && candidate.endsWith('.hap')) {
+      const modified = fs.statSync(candidate).mtimeMs;
+      if (modified > markerTime) candidates.push({ candidate, modified });
+    }
+  }
+}
+
+visit(process.env.MODULE_BUILD_ROOT);
+candidates.sort((left, right) => right.modified - left.modified);
+if (candidates.length > 0) process.stdout.write(candidates[0].candidate);
+NODE
+)"
+if [[ -z "$release_artifact" ]]; then
+  echo "Release build did not produce a new HAP artifact." >&2
+  exit 1
+fi
+./scripts/verify-release-artifact "$release_artifact"
+
+echo "Release build finished. Restoring build-profile.json5."

biucingcli/template_data/harmonyos/template/scripts/release-preflight

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "HarmonyOS release signing preflight"
+
+node <<'NODE'
+const fs = require('fs');
+
+const buildProfilePath = 'build-profile.json5';
+let buildProfile;
+try {
+  buildProfile = JSON.parse(fs.readFileSync(buildProfilePath, 'utf8'));
+} catch (_error) {
+  console.error(`${buildProfilePath} is missing or is not valid JSON.`);
+  process.exit(1);
+}
+
+const signingConfigs = buildProfile?.app?.signingConfigs;
+const containsPasswordField = (value) => {
+  if (Array.isArray(value)) {
+    return value.some(containsPasswordField);
+  }
+  if (!value || typeof value !== 'object') {
+    return false;
+  }
+
+  return Object.entries(value).some(([key, child]) => {
+    if ((key === 'storePassword' || key === 'keyPassword') && String(child || '').length > 0) {
+      return true;
+    }
+    return containsPasswordField(child);
+  });
+};
+
+if (!Array.isArray(signingConfigs) || signingConfigs.length > 0 || containsPasswordField(buildProfile)) {
+  console.error(`${buildProfilePath} contains signing material.`);
+  console.error('Restore the committed unsigned build profile before running a release.');
+  process.exit(1);
+}
+NODE
+
+if [[ ! -f "local.properties" ]]; then
+  cat >&2 <<'EOF'
+local.properties is missing.
+
+Copy docs/release-signing.local.properties.example to local.properties and fill in
+your HarmonyOS signing material before running make release.
+EOF
+  exit 1
+fi
+
+node <<'NODE'
+const fs = require('fs');
+const path = require('path');
+
+const localPropertiesPath = 'local.properties';
+const requiredKeys = [
+  'biucing.harmony.signing.certpath',
+  'biucing.harmony.signing.profile',
+  'biucing.harmony.signing.storeFile',
+  'biucing.harmony.signing.storePassword',
+  'biucing.harmony.signing.keyAlias',
+  'biucing.harmony.signing.keyPassword'
+];
+const fileKeys = [
+  'biucing.harmony.signing.certpath',
+  'biucing.harmony.signing.profile',
+  'biucing.harmony.signing.storeFile'
+];
+
+function parseProperties(raw) {
+  const values = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const separator = trimmed.indexOf('=');
+    if (separator < 0) {
+      continue;
+    }
+    const key = trimmed.slice(0, separator).trim();
+    const value = trimmed.slice(separator + 1).trim();
+    values[key] = value;
+  }
+  return values;
+}
+
+const properties = parseProperties(fs.readFileSync(localPropertiesPath, 'utf8'));
+const missing = requiredKeys.filter((key) => !properties[key]);
+if (missing.length > 0) {
+  console.error(`Missing signing key(s) in ${localPropertiesPath}:`);
+  for (const key of missing) {
+    console.error(`  - ${key}`);
+  }
+  process.exit(1);
+}
+
+for (const key of fileKeys) {
+  const value = properties[key];
+  const resolved = path.isAbsolute(value) ? value : path.resolve(value);
+  if (!fs.existsSync(resolved)) {
+    console.error(`Signing file for ${key} does not exist: ${value}`);
+    process.exit(1);
+  }
+}
+
+console.log('Release signing material is present and file paths resolve.');
+NODE

biucingcli/template_data/harmonyos/template/scripts/test

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HVIGOR_BIN="${HVIGOR:-hvigorw}"
+MODULE_NAME="{{HARMONY_MODULE_NAME}}"
+
+echo "Running HarmonyOS ArkTS unit tests with hvigor..."
+
+if [[ ! -f "entry/src/test/List.test.ets" ]]; then
+  cat >&2 <<'EOF'
+entry/src/test/List.test.ets is missing.
+
+Keep at least one Hypium test suite in the generated project before treating
+the project as release-ready.
+EOF
+  exit 1
+fi
+
+if [[ ! -d "oh_modules/@ohos/hypium" && ! -d "entry/oh_modules/@ohos/hypium" ]]; then
+  cat >&2 <<'EOF'
+@ohos/hypium is not installed.
+
+Run make bootstrap before make test so ohpm can install test dependencies.
+EOF
+  exit 1
+fi
+
+"$HVIGOR_BIN" test --mode module -p "module=${MODULE_NAME}"

biucingcli/template_data/harmonyos/template/scripts/verify-release-artifact

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+EXPECTED_BUNDLE_NAME="{{BUNDLE_NAME}}"
+properties_path="local.properties"
+keytool_bin="${KEYTOOL:-keytool}"
+
+property_value() {
+  local key="$1"
+  awk -F= -v expected="$key" '
+    $0 !~ /^[[:space:]]*#/ && $1 ~ "^[[:space:]]*" expected "[[:space:]]*$" {
+      sub(/^[^=]*=/, ""); sub(/^[[:space:]]+/, ""); sub(/[[:space:]]+$/, ""); print; exit
+    }
+  ' "$properties_path"
+}
+
+fingerprint_from_certificate() {
+  LC_ALL=C "$keytool_bin" -printcert -file "$1" 2>/dev/null \
+    | sed -nE 's/.*SHA-?256:[[:space:]]*([0-9A-Fa-f:]+).*/\1/p' \
+    | head -n 1 \
+    | tr '[:lower:]' '[:upper:]' \
+    | tr -d ':[:space:]'
+}
+
+find_sign_tool() {
+  if [[ -n "${HAP_SIGN_TOOL:-}" ]]; then
+    printf '%s' "$HAP_SIGN_TOOL"
+    return
+  fi
+  local sdk_root="${DEVECO_SDK_HOME:-${HOS_SDK_HOME:-${OHOS_SDK_HOME:-}}}"
+  local candidate
+  for candidate in \
+    "$sdk_root/default/openharmony/toolchains/lib/hap-sign-tool.jar" \
+    "/Applications/DevEco-Studio.app/Contents/sdk/default/openharmony/toolchains/lib/hap-sign-tool.jar"; do
+    if [[ -f "$candidate" ]]; then
+      printf '%s' "$candidate"
+      return
+    fi
+  done
+}
+
+artifact_path="${1:-}"
+if [[ -z "$artifact_path" ]]; then
+  artifact_path="$(find "{{HARMONY_MODULE_NAME}}/build" -type f -name '*.hap' -print 2>/dev/null | sort | tail -n 1)"
+fi
+
+echo "HarmonyOS release artifact signature verification"
+
+if [[ -z "$artifact_path" || ! -s "$artifact_path" ]]; then
+  echo "Signed HAP artifact is missing or empty." >&2
+  exit 1
+fi
+if ! unzip -tqq "$artifact_path"; then
+  echo "HAP archive validation failed: $artifact_path" >&2
+  exit 1
+fi
+if [[ ! -f "$properties_path" ]]; then
+  echo "$properties_path is required to verify the expected signer and profile." >&2
+  exit 1
+fi
+if ! command -v "$keytool_bin" >/dev/null 2>&1 && [[ ! -x "$keytool_bin" ]]; then
+  echo "keytool is required to compare signing certificate fingerprints." >&2
+  exit 1
+fi
+
+cert_path="$(property_value biucing.harmony.signing.certpath)"
+profile_path="$(property_value biucing.harmony.signing.profile)"
+for variable_name in cert_path profile_path; do
+  value="${!variable_name:-}"
+  if [[ -z "$value" ]]; then
+    echo "Missing signing property for $variable_name." >&2
+    exit 1
+  fi
+  if [[ "$value" != /* ]]; then
+    printf -v "$variable_name" '%s' "$PWD/$value"
+  fi
+  if [[ ! -f "${!variable_name}" ]]; then
+    echo "Configured signing input does not exist: ${!variable_name}" >&2
+    exit 1
+  fi
+done
+
+sign_tool="$(find_sign_tool)"
+if [[ -z "$sign_tool" || ( ! -f "$sign_tool" && ! -x "$sign_tool" ) ]]; then
+  echo "hap-sign-tool is unavailable. Set HAP_SIGN_TOOL or DEVECO_SDK_HOME." >&2
+  exit 1
+fi
+
+verification_dir="$(mktemp -d "${TMPDIR:-/tmp}/biucing-hap-verify.XXXXXX")"
+chmod 700 "$verification_dir"
+out_certchain="$verification_dir/certificate-chain.cer"
+out_profile="$verification_dir/profile.p7b"
+profile_result="$verification_dir/profile-verification.json"
+cleanup() {
+  rm -f "$out_certchain" "$out_profile" "$profile_result"
+  rmdir "$verification_dir" 2>/dev/null || true
+}
+trap cleanup EXIT HUP INT TERM
+
+if [[ "$sign_tool" == *.jar ]]; then
+  java -jar "$sign_tool" verify-app \
+    -inFile "$artifact_path" \
+    -outCertChain "$out_certchain" \
+    -outProfile "$out_profile" \
+    -inForm zip >/dev/null
+else
+  "$sign_tool" verify-app \
+    -inFile "$artifact_path" \
+    -outCertChain "$out_certchain" \
+    -outProfile "$out_profile" \
+    -inForm zip >/dev/null
+fi
+
+if [[ ! -s "$out_certchain" || ! -s "$out_profile" ]]; then
+  echo "hap-sign-tool did not export a signer certificate chain and profile." >&2
+  exit 1
+fi
+
+expected_fingerprint="$(fingerprint_from_certificate "$cert_path")"
+actual_fingerprint="$(fingerprint_from_certificate "$out_certchain")"
+if [[ -z "$expected_fingerprint" || -z "$actual_fingerprint" ]]; then
+  echo "Unable to read the configured or embedded signer certificate fingerprint." >&2
+  exit 1
+fi
+if [[ "$actual_fingerprint" != "$expected_fingerprint" ]]; then
+  echo "HAP signer certificate does not match the configured release certificate." >&2
+  echo "expected: $expected_fingerprint" >&2
+  echo "actual:   $actual_fingerprint" >&2
+  exit 1
+fi
+if ! cmp -s "$profile_path" "$out_profile"; then
+  echo "HAP embedded signing profile does not match the configured release profile." >&2
+  exit 1
+fi
+
+if [[ "$sign_tool" == *.jar ]]; then
+  java -jar "$sign_tool" verify-profile -inFile "$out_profile" -outFile "$profile_result" >/dev/null
+else
+  "$sign_tool" verify-profile -inFile "$out_profile" -outFile "$profile_result" >/dev/null
+fi
+if [[ ! -s "$profile_result" ]]; then
+  echo "hap-sign-tool did not produce a verified profile result." >&2
+  exit 1
+fi
+EXPECTED_BUNDLE_NAME="$EXPECTED_BUNDLE_NAME" PROFILE_RESULT="$profile_result" node <<'NODE'
+const fs = require('fs');
+const result = JSON.parse(fs.readFileSync(process.env.PROFILE_RESULT, 'utf8'));
+const found = [];
+function visit(value) {
+  if (Array.isArray(value)) {
+    value.forEach(visit);
+  } else if (typeof value === 'string' && value.trim().startsWith('{')) {
+    try { visit(JSON.parse(value)); } catch (_error) { /* not an embedded JSON object */ }
+  } else if (value && typeof value === 'object') {
+    for (const [key, child] of Object.entries(value)) {
+      if (key.toLowerCase().replace(/[-_.]/g, '') === 'bundlename') {
+        found.push(String(child));
+      }
+      visit(child);
+    }
+  }
+}
+visit(result);
+if (!found.includes(process.env.EXPECTED_BUNDLE_NAME)) {
+  console.error('Verified HAP profile bundle identity does not match the template release bundle.');
+  console.error(`expected: ${process.env.EXPECTED_BUNDLE_NAME}`);
+  console.error(`actual:   ${found.length > 0 ? found.join(', ') : '<missing>'}`);
+  process.exit(1);
+}
+NODE
+
+echo "HAP signature is valid; signer and embedded profile match local release inputs."
+echo "Bundle: $EXPECTED_BUNDLE_NAME"

biucingcli/template_data/harmonyos/template/scripts/verify-supply-chain

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "HarmonyOS ohpm supply-chain verification"
+
+node <<'NODE'
+const fs = require('fs');
+
+const manifestPath = 'oh-package.json5';
+const lockPath = 'oh-package-lock.json5';
+const allowedRegistryPrefix = 'https://ohpm.openharmony.cn/ohpm/';
+const failures = [];
+
+function load(path) {
+  try {
+    return JSON.parse(fs.readFileSync(path, 'utf8'));
+  } catch (_error) {
+    failures.push(`${path} is missing or is not valid JSON.`);
+    return {};
+  }
+}
+
+const manifest = load(manifestPath);
+const lock = load(lockPath);
+const declared = { ...(manifest.dependencies || {}), ...(manifest.devDependencies || {}) };
+const specifiers = lock.specifiers || {};
+const packages = lock.packages || {};
+
+if (lock.lockfileVersion !== 3) {
+  failures.push(`${lockPath} must use lockfileVersion 3.`);
+}
+if (lock?.meta?.stableOrder !== true) {
+  failures.push(`${lockPath} must enable meta.stableOrder.`);
+}
+
+for (const [name, version] of Object.entries(declared)) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(version))) {
+    failures.push(`${name} must use an exact version; found ${version}.`);
+    continue;
+  }
+  const key = `${name}@${version}`;
+  if (specifiers[key] !== key) {
+    failures.push(`${key} is not pinned by lockfile specifiers.`);
+  }
+  if (!packages[key]) {
+    failures.push(`${key} is missing from lockfile packages.`);
+  }
+}
+
+for (const [key, pkg] of Object.entries(packages)) {
+  if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(String(pkg.integrity || ''))) {
+    failures.push(`${key} is missing a valid sha512 integrity value.`);
+  }
+  if (!String(pkg.resolved || '').startsWith(allowedRegistryPrefix)) {
+    failures.push(`${key} resolves outside the approved ohpm registry.`);
+  }
+  if (pkg.registryType !== 'ohpm') {
+    failures.push(`${key} must use registryType ohpm.`);
+  }
+}
+
+if (failures.length > 0) {
+  for (const failure of failures) {
+    console.error(`[fail] ${failure}`);
+  }
+  process.exit(1);
+}
+
+console.log(`Pinned ${Object.keys(packages).length} package(s) with registry and integrity checks.`);
+NODE