Carlos Florêncio
119 lines
3.3 KiB
Bash
Executable File
119 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Verify desktop installer artifacts and checksums before publishing a release.
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: verify-desktop-assets.sh [--require-updaters] <assets-dir> [platform...]
|
|
|
|
Checks that each required platform has at least one desktop artifact named:
|
|
|
|
kandev-desktop-<platform>-*
|
|
|
|
and that every matching artifact has a sibling .sha256 file. If no platform is
|
|
given, all supported desktop platforms are required. Signed Tauri updater
|
|
artifacts (`*.app.tar.gz`, `*.AppImage.tar.gz`, and `*.nsis.zip`) must have a
|
|
matching `*.sig` file, and signatures without their updater bundle are rejected.
|
|
When --require-updaters is set, every requested platform must also include its
|
|
signed updater bundle.
|
|
EOF
|
|
}
|
|
|
|
if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
|
|
REQUIRE_UPDATERS=false
|
|
if [ "${1:-}" = "--require-updaters" ]; then
|
|
REQUIRE_UPDATERS=true
|
|
shift
|
|
fi
|
|
|
|
ASSETS_DIR="${1:?Usage: verify-desktop-assets.sh [--require-updaters] <assets-dir> [platform...]}"
|
|
shift || true
|
|
|
|
if [ "$#" -gt 0 ]; then
|
|
REQUIRED_PLATFORMS=("$@")
|
|
else
|
|
REQUIRED_PLATFORMS=(macos-arm64 macos-x64 linux-x64 linux-arm64 windows-x64)
|
|
fi
|
|
|
|
if [ ! -d "$ASSETS_DIR" ]; then
|
|
echo "Missing desktop assets directory: $ASSETS_DIR" >&2
|
|
exit 1
|
|
fi
|
|
|
|
verify_checksum() {
|
|
local assets_dir="$1"
|
|
local checksum_file="$2"
|
|
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
(cd "$assets_dir" && shasum -a 256 -c "$checksum_file")
|
|
elif command -v sha256sum >/dev/null 2>&1; then
|
|
(cd "$assets_dir" && sha256sum -c "$checksum_file")
|
|
else
|
|
echo "Missing checksum tool: need shasum or sha256sum" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
shopt -s nullglob
|
|
|
|
updater_suffix_for_platform() {
|
|
case "$1" in
|
|
macos-*) printf '%s\n' '*.app.tar.gz' ;;
|
|
linux-*) printf '%s\n' '*.AppImage.tar.gz' ;;
|
|
windows-*) printf '%s\n' '*.nsis.zip' ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
for platform in "${REQUIRED_PLATFORMS[@]}"; do
|
|
found=0
|
|
|
|
for artifact in "$ASSETS_DIR"/kandev-desktop-"$platform"-*; do
|
|
if [[ "$artifact" == *.sha256 ]]; then
|
|
continue
|
|
fi
|
|
found=$((found + 1))
|
|
checksum_file="$artifact.sha256"
|
|
if [ ! -f "$checksum_file" ]; then
|
|
echo "Missing desktop checksum: $checksum_file" >&2
|
|
exit 1
|
|
fi
|
|
verify_checksum "$ASSETS_DIR" "$(basename "$checksum_file")" >/dev/null || {
|
|
echo "Checksum verification failed for: $artifact" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
if [ "$found" -eq 0 ]; then
|
|
echo "Missing desktop artifact for platform: $platform" >&2
|
|
exit 1
|
|
fi
|
|
|
|
updater_suffix="$(updater_suffix_for_platform "$platform")"
|
|
updater_found=0
|
|
for updater_bundle in "$ASSETS_DIR"/kandev-desktop-"$platform"-$updater_suffix; do
|
|
updater_found=$((updater_found + 1))
|
|
if [ ! -f "$updater_bundle.sig" ]; then
|
|
echo "Missing updater signature: $updater_bundle.sig" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
for updater_signature in "$ASSETS_DIR"/kandev-desktop-"$platform"-$updater_suffix.sig; do
|
|
updater_bundle="${updater_signature%.sig}"
|
|
if [ ! -f "$updater_bundle" ]; then
|
|
echo "Missing updater bundle for signature: $updater_signature" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
if [ "$REQUIRE_UPDATERS" = true ] && [ "$updater_found" -eq 0 ]; then
|
|
echo "Missing updater artifact for platform: $platform" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "Desktop release assets verified in $ASSETS_DIR"
|