mirror of
https://github.com/yaklang/yaklang-chrome-extension.git
synced 2026-09-25 12:41:53 +08:00
ci: rebuild release pipeline around OSS manifest protocol
Replace the broken yarn/Node 18 release workflow (wrong package manager, missing build/ dir, archived actions) with a manifest-based distribution flow modeled on yaklang/browser-binaries-mirror: - scripts/package-release.mjs: package the four variants, emit release-entry.json and per-artifact sha256 checksums - scripts/build-manifest.mjs: merge into a bounded public manifest (10 versions) with invariant validation - scripts/publish-oss.mjs: immutable artifacts (forbid-overwrite, one-year cache) and mutable manifest (5-minute cache, checksum published second), idempotent via head + sha256 comparison - scripts/verify-public.mjs: post-publish verification from the public endpoint (bytes, headers, zip layout) - release.yml: pnpm + Node 22, full verify:production, OSS publish, GitHub Release, separate public verify job, publish concurrency group - ci.yml: run verify:production on push/PR - single-source the extension version in package.json (wxt.config reads) - document the distribution protocol in README
This commit is contained in:
go0p
@@ -0,0 +1,120 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Merges the freshly packaged release (dist/release-entry.json) into the
|
||||
* public manifest and writes manifest.json + manifest.json.sha256.txt.
|
||||
*
|
||||
* The manifest is the single entry point consumers read: `latest` plus a
|
||||
* bounded `versions[]` history. Artifact objects are immutable and their URLs
|
||||
* are never rewritten; only this manifest moves.
|
||||
*
|
||||
* Usage:
|
||||
* node scripts/build-manifest.mjs --release-entry=dist/release-entry.json \
|
||||
* [--existing-manifest=dist/existing-manifest.json] [--max-versions=10] \
|
||||
* --output=dist/manifest.json --checksum-output=dist/manifest.json.sha256.txt
|
||||
*/
|
||||
import { createHash } from 'node:crypto';
|
||||
import { readFile, writeFile } from 'node:fs/promises';
|
||||
import { resolve } from 'node:path';
|
||||
|
||||
const root = resolve(import.meta.dirname, '..');
|
||||
|
||||
function parseArgs(argv) {
|
||||
const out = {};
|
||||
for (const arg of argv) {
|
||||
if (!arg.startsWith('--')) throw new Error(`unexpected argument: ${arg}`);
|
||||
const eq = arg.indexOf('=');
|
||||
const key = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
|
||||
out[key] = eq === -1 ? true : arg.slice(eq + 1);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function artifactFingerprint(artifacts) {
|
||||
return artifacts.map((a) => `${a.variant}:${a.sha256}`).sort().join('|');
|
||||
}
|
||||
|
||||
function toVersionEntry(entry) {
|
||||
return {
|
||||
version: entry.version,
|
||||
published_at: entry.built_at,
|
||||
commit: entry.commit ?? null,
|
||||
artifacts: entry.artifacts.map((a) => ({
|
||||
variant: a.variant,
|
||||
browser: a.browser,
|
||||
mode: a.mode,
|
||||
filename: a.filename,
|
||||
url: a.url,
|
||||
sha256: a.sha256,
|
||||
size: a.size,
|
||||
checksum_url: a.checksum_url,
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
function validate(manifest) {
|
||||
if (!Array.isArray(manifest.versions) || manifest.versions.length === 0) {
|
||||
throw new Error('manifest must contain at least one version');
|
||||
}
|
||||
if (manifest.latest !== manifest.versions[0].version) {
|
||||
throw new Error(`manifest.latest (${manifest.latest}) must equal versions[0].version (${manifest.versions[0].version})`);
|
||||
}
|
||||
const seen = new Set();
|
||||
for (const versionEntry of manifest.versions) {
|
||||
if (seen.has(versionEntry.version)) throw new Error(`duplicate version in manifest: ${versionEntry.version}`);
|
||||
seen.add(versionEntry.version);
|
||||
if (!Array.isArray(versionEntry.artifacts) || versionEntry.artifacts.length === 0) {
|
||||
throw new Error(`version ${versionEntry.version} has no artifacts`);
|
||||
}
|
||||
const variants = new Set();
|
||||
for (const artifact of versionEntry.artifacts) {
|
||||
if (variants.has(artifact.variant)) throw new Error(`duplicate variant ${artifact.variant} in version ${versionEntry.version}`);
|
||||
variants.add(artifact.variant);
|
||||
if (!/^[0-9a-f]{64}$/.test(artifact.sha256)) throw new Error(`artifact ${artifact.filename}: bad sha256`);
|
||||
if (!Number.isInteger(artifact.size) || artifact.size <= 0) throw new Error(`artifact ${artifact.filename}: bad size`);
|
||||
if (!/^https?:\/\//.test(artifact.url)) throw new Error(`artifact ${artifact.filename}: url must be absolute`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const args = parseArgs(process.argv.slice(2));
|
||||
if (!args['release-entry']) throw new Error('--release-entry is required');
|
||||
if (!args.output) throw new Error('--output is required');
|
||||
if (!args['checksum-output']) throw new Error('--checksum-output is required');
|
||||
|
||||
const entry = JSON.parse(await readFile(resolve(root, String(args['release-entry'])), 'utf8'));
|
||||
const maxVersions = Number.parseInt(String(args['max-versions'] ?? '10'), 10);
|
||||
if (!Number.isInteger(maxVersions) || maxVersions < 1) throw new Error('--max-versions must be a positive integer');
|
||||
|
||||
let versions = [];
|
||||
if (args['existing-manifest']) {
|
||||
try {
|
||||
const existing = JSON.parse(await readFile(resolve(root, String(args['existing-manifest'])), 'utf8'));
|
||||
versions = Array.isArray(existing.versions) ? existing.versions : [];
|
||||
} catch (err) {
|
||||
if (err?.code !== 'ENOENT') throw err;
|
||||
console.log('existing manifest not found; starting a fresh history');
|
||||
}
|
||||
}
|
||||
|
||||
const newEntry = toVersionEntry(entry);
|
||||
const idx = versions.findIndex((v) => v.version === entry.version);
|
||||
if (idx >= 0 && artifactFingerprint(versions[idx].artifacts) === artifactFingerprint(entry.artifacts)) {
|
||||
// Idempotent rerun: keep the original entry (published_at stays stable).
|
||||
console.log(`version ${entry.version} already in manifest with identical artifacts; kept as-is`);
|
||||
} else {
|
||||
if (idx >= 0) {
|
||||
versions.splice(idx, 1);
|
||||
console.log(`version ${entry.version} re-published with different artifacts; replaced entry`);
|
||||
}
|
||||
versions.unshift(newEntry);
|
||||
}
|
||||
versions = versions.slice(0, maxVersions);
|
||||
|
||||
const manifest = { latest: versions[0].version, updated_at: new Date().toISOString(), versions };
|
||||
validate(manifest);
|
||||
|
||||
const bytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
|
||||
await writeFile(resolve(root, String(args.output)), bytes);
|
||||
const sha256 = createHash('sha256').update(bytes).digest('hex');
|
||||
await writeFile(resolve(root, String(args['checksum-output'])), `${sha256} manifest.json\n`);
|
||||
console.log(`manifest written: ${args.output} (latest=${manifest.latest}, ${versions.length} version(s) retained)`);
|
||||
@@ -0,0 +1,117 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Packages the release variants from .output into dist/<version>/ and writes
|
||||
* dist/release-entry.json recording filename/size/sha256/url for every
|
||||
* artifact, plus per-artifact .sha256.txt checksum files.
|
||||
*
|
||||
* The variant table must stay in sync with `verify:production` (package.json)
|
||||
* and scripts/audit-build.mjs — those define the published surface.
|
||||
*
|
||||
* Usage:
|
||||
* node scripts/package-release.mjs --public-base-url=https://aliyun-oss.yaklang.com/chrome-extension [--dist=dist]
|
||||
*/
|
||||
import { execFile } from 'node:child_process';
|
||||
import { createHash } from 'node:crypto';
|
||||
import { createReadStream } from 'node:fs';
|
||||
import { access } from 'node:fs/promises';
|
||||
import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
|
||||
import { resolve } from 'node:path';
|
||||
import { pipeline } from 'node:stream/promises';
|
||||
import { promisify } from 'node:util';
|
||||
import AdmZip from 'adm-zip';
|
||||
|
||||
const execFileAsync = promisify(execFile);
|
||||
const root = resolve(import.meta.dirname, '..');
|
||||
|
||||
const VARIANTS = [
|
||||
{ variant: 'chrome-store', browser: 'chrome', mode: 'store', dir: '.output/chrome-mv3-store' },
|
||||
{ variant: 'chrome-enterprise', browser: 'chrome', mode: 'enterprise', dir: '.output/chrome-mv3-enterprise' },
|
||||
{ variant: 'firefox', browser: 'firefox', mode: 'production', dir: '.output/firefox-mv2' },
|
||||
{ variant: 'firefox-amo', browser: 'firefox', mode: 'store', dir: '.output/firefox-mv3-store' },
|
||||
];
|
||||
|
||||
function parseArgs(argv) {
|
||||
const out = {};
|
||||
for (const arg of argv) {
|
||||
if (!arg.startsWith('--')) throw new Error(`unexpected argument: ${arg}`);
|
||||
const eq = arg.indexOf('=');
|
||||
const key = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
|
||||
out[key] = eq === -1 ? true : arg.slice(eq + 1);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
async function exists(path) {
|
||||
try {
|
||||
await access(path);
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
async function sha256File(path) {
|
||||
const hash = createHash('sha256');
|
||||
await pipeline(createReadStream(path), hash);
|
||||
return hash.digest('hex');
|
||||
}
|
||||
|
||||
const args = parseArgs(process.argv.slice(2));
|
||||
if (!args['public-base-url']) {
|
||||
throw new Error('--public-base-url is required (e.g. https://aliyun-oss.yaklang.com/chrome-extension)');
|
||||
}
|
||||
const baseUrl = String(args['public-base-url']).replace(/\/+$/, '');
|
||||
const distDir = resolve(root, String(args.dist ?? 'dist'));
|
||||
|
||||
const pkg = JSON.parse(await readFile(resolve(root, 'package.json'), 'utf8'));
|
||||
const { version } = pkg;
|
||||
|
||||
let commit = null;
|
||||
try {
|
||||
const { stdout } = await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: root });
|
||||
commit = stdout.trim();
|
||||
} catch {
|
||||
// Not fatal: local runs outside a git worktree still package fine.
|
||||
}
|
||||
|
||||
const versionDir = resolve(distDir, version);
|
||||
await mkdir(versionDir, { recursive: true });
|
||||
|
||||
const artifacts = [];
|
||||
for (const target of VARIANTS) {
|
||||
const outputDir = resolve(root, target.dir);
|
||||
if (!(await exists(resolve(outputDir, 'manifest.json')))) {
|
||||
throw new Error(`${target.variant}: ${target.dir}/manifest.json missing — run the build first (pnpm verify:production)`);
|
||||
}
|
||||
const builtManifest = JSON.parse(await readFile(resolve(outputDir, 'manifest.json'), 'utf8'));
|
||||
if (builtManifest.version !== version) {
|
||||
throw new Error(`${target.variant}: built manifest version ${builtManifest.version} != package.json version ${version}`);
|
||||
}
|
||||
|
||||
const filename = `${target.variant}-${version}.zip`;
|
||||
const zipPath = resolve(versionDir, filename);
|
||||
// Entry paths are relative to the output dir so manifest.json sits at the
|
||||
// zip root, which is what browsers expect from a sideloaded extension.
|
||||
const zip = new AdmZip();
|
||||
zip.addLocalFolder(outputDir);
|
||||
await zip.writeZipPromise(zipPath);
|
||||
const sha256 = await sha256File(zipPath);
|
||||
const size = (await stat(zipPath)).size;
|
||||
await writeFile(resolve(versionDir, `${filename}.sha256.txt`), `${sha256} ${filename}\n`);
|
||||
|
||||
artifacts.push({
|
||||
variant: target.variant,
|
||||
browser: target.browser,
|
||||
mode: target.mode,
|
||||
filename,
|
||||
url: `${baseUrl}/${version}/${filename}`,
|
||||
sha256,
|
||||
size,
|
||||
checksum_url: `${baseUrl}/${version}/${filename}.sha256.txt`,
|
||||
});
|
||||
console.log(`packaged ${filename} (${size} bytes, sha256 ${sha256.slice(0, 12)}…)`);
|
||||
}
|
||||
|
||||
const entry = { version, commit, built_at: new Date().toISOString(), artifacts };
|
||||
await writeFile(resolve(distDir, 'release-entry.json'), `${JSON.stringify(entry, null, 2)}\n`);
|
||||
console.log(`release entry written: ${resolve(distDir, 'release-entry.json').slice(root.length + 1)} (version ${version})`);
|
||||
@@ -0,0 +1,148 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Publishes release artifacts and the manifest to Aliyun OSS.
|
||||
*
|
||||
* The contract mirrors yaklang/browser-binaries-mirror:
|
||||
* - versioned artifacts are immutable: one-year immutable cache headers,
|
||||
* sha256 user meta, x-oss-forbid-overwrite on upload; an existing object
|
||||
* with a different sha256 is a hard error, an identical one is skipped
|
||||
* - manifest.json is mutable: five-minute cache; it is published first and
|
||||
* its checksum second, so consumers can always detect a torn publish by
|
||||
* verifying the checksum file
|
||||
*
|
||||
* Credentials come from OSS_KEY_ID / OSS_KEY_SECRET (org-level secrets).
|
||||
*
|
||||
* Usage:
|
||||
* OSS_KEY_ID=… OSS_KEY_SECRET=… node scripts/publish-oss.mjs release \
|
||||
* --release-entry=dist/release-entry.json [--dist=dist]
|
||||
* [--endpoint=https://oss-accelerate.aliyuncs.com] [--bucket=yaklang] [--prefix=chrome-extension]
|
||||
* OSS_KEY_ID=… OSS_KEY_SECRET=… node scripts/publish-oss.mjs manifest \
|
||||
* --manifest=dist/manifest.json --manifest-checksum=dist/manifest.json.sha256.txt [endpoint/bucket/prefix]
|
||||
*/
|
||||
import { createHash } from 'node:crypto';
|
||||
import { readFile } from 'node:fs/promises';
|
||||
import { resolve } from 'node:path';
|
||||
import OSSModule from 'ali-oss';
|
||||
|
||||
const OSS = OSSModule.default ?? OSSModule;
|
||||
const root = resolve(import.meta.dirname, '..');
|
||||
|
||||
const ARTIFACT_CACHE = 'public, max-age=31536000, immutable';
|
||||
const MANIFEST_CACHE = 'public, max-age=300, must-revalidate';
|
||||
|
||||
function parseArgs(argv) {
|
||||
const out = {};
|
||||
for (const arg of argv) {
|
||||
if (!arg.startsWith('--')) throw new Error(`unexpected argument: ${arg}`);
|
||||
const eq = arg.indexOf('=');
|
||||
const key = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
|
||||
out[key] = eq === -1 ? true : arg.slice(eq + 1);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
const [subcommand, ...rest] = process.argv.slice(2);
|
||||
const args = parseArgs(rest);
|
||||
const endpoint = String(args.endpoint ?? 'https://oss-accelerate.aliyuncs.com');
|
||||
const bucket = String(args.bucket ?? 'yaklang');
|
||||
const prefix = String(args.prefix ?? 'chrome-extension').replace(/^\/+|\/+$/g, '');
|
||||
|
||||
const accessKeyId = process.env.OSS_KEY_ID;
|
||||
const accessKeySecret = process.env.OSS_KEY_SECRET;
|
||||
if (!accessKeyId || !accessKeySecret) {
|
||||
throw new Error('OSS_KEY_ID and OSS_KEY_SECRET must be set in the environment');
|
||||
}
|
||||
if (subcommand !== 'release' && subcommand !== 'manifest') {
|
||||
throw new Error(`unknown subcommand: ${subcommand ?? '(none)'} — expected "release" or "manifest"`);
|
||||
}
|
||||
|
||||
const client = new OSS({ accessKeyId, accessKeySecret, bucket, endpoint, secure: true });
|
||||
|
||||
const sha256 = (buffer) => createHash('sha256').update(buffer).digest('hex');
|
||||
|
||||
async function headObject(key) {
|
||||
try {
|
||||
const res = await client.head(key);
|
||||
return {
|
||||
size: Number(res.headers['content-length']),
|
||||
sha256: res.headers['x-oss-meta-sha256'] ?? null,
|
||||
};
|
||||
} catch (err) {
|
||||
if (err && (err.status === 404 || err.code === 'NoSuchKey')) return null;
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
async function putObject(key, buffer, { mime, cacheControl, forbidOverwrite }) {
|
||||
const digest = sha256(buffer);
|
||||
await client.put(key, buffer, {
|
||||
mime,
|
||||
headers: {
|
||||
'Cache-Control': cacheControl,
|
||||
...(forbidOverwrite ? { 'x-oss-forbid-overwrite': 'true' } : {}),
|
||||
},
|
||||
meta: { sha256: digest },
|
||||
});
|
||||
const head = await headObject(key);
|
||||
if (!head) throw new Error(`upload verification failed, object missing: oss://${bucket}/${key}`);
|
||||
if (head.size !== buffer.length || head.sha256 !== digest) {
|
||||
throw new Error(`upload verification failed: oss://${bucket}/${key} (size ${head.size}/${buffer.length}, sha256 ${head.sha256}/${digest})`);
|
||||
}
|
||||
}
|
||||
|
||||
async function putImmutable(key, buffer, mime) {
|
||||
const digest = sha256(buffer);
|
||||
const existing = await headObject(key);
|
||||
if (existing) {
|
||||
if (existing.size === buffer.length && existing.sha256 === digest) {
|
||||
console.log(`skip (identical object already published): oss://${bucket}/${key}`);
|
||||
return;
|
||||
}
|
||||
throw new Error(
|
||||
`refusing to overwrite non-matching immutable object: oss://${bucket}/${key} ` +
|
||||
`(remote size=${existing.size} sha256=${existing.sha256 ?? 'unknown'}, local size=${buffer.length} sha256=${digest})`,
|
||||
);
|
||||
}
|
||||
await putObject(key, buffer, { mime, cacheControl: ARTIFACT_CACHE, forbidOverwrite: true });
|
||||
console.log(`uploaded: oss://${bucket}/${key} (${buffer.length} bytes)`);
|
||||
}
|
||||
|
||||
async function putMutable(key, buffer, mime) {
|
||||
await putObject(key, buffer, { mime, cacheControl: MANIFEST_CACHE, forbidOverwrite: false });
|
||||
console.log(`published: oss://${bucket}/${key}`);
|
||||
}
|
||||
|
||||
async function runRelease() {
|
||||
if (!args['release-entry']) throw new Error('release subcommand requires --release-entry');
|
||||
const entry = JSON.parse(await readFile(resolve(root, String(args['release-entry'])), 'utf8'));
|
||||
const versionDir = resolve(root, String(args.dist ?? 'dist'), entry.version);
|
||||
for (const artifact of entry.artifacts) {
|
||||
const zip = await readFile(resolve(versionDir, artifact.filename));
|
||||
const digest = sha256(zip);
|
||||
if (digest !== artifact.sha256) {
|
||||
throw new Error(`${artifact.filename}: on-disk sha256 ${digest} != release entry ${artifact.sha256}`);
|
||||
}
|
||||
await putImmutable(`${prefix}/${entry.version}/${artifact.filename}`, zip, 'application/zip');
|
||||
const checksum = await readFile(resolve(versionDir, `${artifact.filename}.sha256.txt`));
|
||||
await putImmutable(`${prefix}/${entry.version}/${artifact.filename}.sha256.txt`, checksum, 'text/plain; charset=utf-8');
|
||||
}
|
||||
}
|
||||
|
||||
async function runManifest() {
|
||||
if (!args.manifest) throw new Error('manifest subcommand requires --manifest');
|
||||
if (!args['manifest-checksum']) throw new Error('manifest subcommand requires --manifest-checksum');
|
||||
const manifest = await readFile(resolve(root, String(args.manifest)));
|
||||
const checksum = await readFile(resolve(root, String(args['manifest-checksum'])), 'utf8');
|
||||
const expected = `${sha256(manifest)} manifest.json\n`;
|
||||
if (checksum !== expected) {
|
||||
throw new Error('manifest checksum file does not match manifest.json content');
|
||||
}
|
||||
await putMutable(`${prefix}/manifest.json`, manifest, 'application/json; charset=utf-8');
|
||||
await putMutable(`${prefix}/manifest.json.sha256.txt`, Buffer.from(checksum, 'utf8'), 'text/plain; charset=utf-8');
|
||||
}
|
||||
|
||||
if (subcommand === 'release') {
|
||||
await runRelease();
|
||||
} else {
|
||||
await runManifest();
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Verifies a freshly published release from the public endpoint: artifact
|
||||
* bytes and checksum files, cache headers, manifest consistency, and zip
|
||||
* layout (manifest.json at the zip root with the expected version).
|
||||
*
|
||||
* Usage:
|
||||
* node scripts/verify-public.mjs --public-base-url=https://aliyun-oss.yaklang.com/chrome-extension \
|
||||
* --release-entry=dist/release-entry.json
|
||||
*/
|
||||
import { createHash } from 'node:crypto';
|
||||
import { readFile } from 'node:fs/promises';
|
||||
import { resolve } from 'node:path';
|
||||
import AdmZip from 'adm-zip';
|
||||
const root = resolve(import.meta.dirname, '..');
|
||||
|
||||
function parseArgs(argv) {
|
||||
const out = {};
|
||||
for (const arg of argv) {
|
||||
if (!arg.startsWith('--')) throw new Error(`unexpected argument: ${arg}`);
|
||||
const eq = arg.indexOf('=');
|
||||
const key = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
|
||||
out[key] = eq === -1 ? true : arg.slice(eq + 1);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function assert(condition, message) {
|
||||
if (!condition) throw new Error(message);
|
||||
}
|
||||
|
||||
const sha256 = (buffer) => createHash('sha256').update(buffer).digest('hex');
|
||||
|
||||
const args = parseArgs(process.argv.slice(2));
|
||||
if (!args['public-base-url']) throw new Error('--public-base-url is required');
|
||||
if (!args['release-entry']) throw new Error('--release-entry is required');
|
||||
const baseUrl = String(args['public-base-url']).replace(/\/+$/, '');
|
||||
|
||||
// Cache-busting query parameter: the manifest may be served from a 5-minute
|
||||
// CDN cache, and we must observe the state right after this publish.
|
||||
const bust = `verify=${Date.now()}`;
|
||||
|
||||
async function fetchOk(url) {
|
||||
const res = await fetch(`${url}?${bust}`);
|
||||
if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
|
||||
return res;
|
||||
}
|
||||
|
||||
const entry = JSON.parse(await readFile(resolve(root, String(args['release-entry'])), 'utf8'));
|
||||
|
||||
for (const artifact of entry.artifacts) {
|
||||
const res = await fetchOk(artifact.url);
|
||||
const contentType = res.headers.get('content-type') ?? '';
|
||||
const cacheControl = res.headers.get('cache-control') ?? '';
|
||||
assert(contentType.startsWith('application/'), `${artifact.filename}: unexpected content-type "${contentType}"`);
|
||||
assert(cacheControl.includes('max-age=31536000') && cacheControl.includes('immutable'),
|
||||
`${artifact.filename}: unexpected cache-control "${cacheControl}" for an immutable artifact`);
|
||||
const body = Buffer.from(await res.arrayBuffer());
|
||||
assert(body.length === artifact.size, `${artifact.filename}: content-length ${body.length} != expected ${artifact.size}`);
|
||||
assert(sha256(body) === artifact.sha256, `${artifact.filename}: sha256 mismatch`);
|
||||
|
||||
const checksumRes = await fetchOk(artifact.checksum_url);
|
||||
assert((await checksumRes.text()) === `${artifact.sha256} ${artifact.filename}\n`,
|
||||
`${artifact.filename}: checksum file content mismatch`);
|
||||
|
||||
const zip = new AdmZip(body);
|
||||
const innerEntry = zip.getEntry('manifest.json');
|
||||
assert(innerEntry, `${artifact.filename}: manifest.json missing at zip root`);
|
||||
const innerManifest = JSON.parse(zip.readAsText(innerEntry));
|
||||
assert(innerManifest.version === entry.version,
|
||||
`${artifact.filename}: zip manifest version ${innerManifest.version} != ${entry.version}`);
|
||||
const backgroundEntry = zip.getEntry('background.js');
|
||||
assert(backgroundEntry && backgroundEntry.getData().length > 0,
|
||||
`${artifact.filename}: background.js missing or empty in zip`);
|
||||
|
||||
console.log(`verified ${artifact.filename} (${artifact.size} bytes)`);
|
||||
}
|
||||
|
||||
const manifestRes = await fetchOk(`${baseUrl}/manifest.json`);
|
||||
const manifestBytes = Buffer.from(await manifestRes.arrayBuffer());
|
||||
const manifestCache = manifestRes.headers.get('cache-control') ?? '';
|
||||
assert(manifestCache.includes('max-age=300'), `manifest.json: unexpected cache-control "${manifestCache}"`);
|
||||
const manifest = JSON.parse(manifestBytes.toString('utf8'));
|
||||
assert(manifest.latest === entry.version, `manifest.latest ${manifest.latest} != ${entry.version}`);
|
||||
const versionEntry = manifest.versions.find((v) => v.version === entry.version);
|
||||
assert(versionEntry, `manifest has no entry for version ${entry.version}`);
|
||||
assert(versionEntry.artifacts.length === entry.artifacts.length,
|
||||
`manifest artifacts count ${versionEntry.artifacts.length} != ${entry.artifacts.length}`);
|
||||
for (const artifact of entry.artifacts) {
|
||||
const remote = versionEntry.artifacts.find((a) => a.variant === artifact.variant);
|
||||
assert(remote, `manifest missing variant ${artifact.variant} for version ${entry.version}`);
|
||||
assert(remote.sha256 === artifact.sha256, `manifest sha256 mismatch for variant ${artifact.variant}`);
|
||||
assert(remote.url === artifact.url, `manifest url mismatch for variant ${artifact.variant}`);
|
||||
}
|
||||
|
||||
const checksumRes = await fetchOk(`${baseUrl}/manifest.json.sha256.txt`);
|
||||
assert((await checksumRes.text()) === `${sha256(manifestBytes)} manifest.json\n`,
|
||||
'manifest.json.sha256.txt does not match the served manifest');
|
||||
|
||||
console.log(`manifest verified: latest=${manifest.latest}, ${manifest.versions.length} version(s) in history`);
|
||||
Reference in New Issue
Block a user