build(release): 加固 v0.1.0 桌面发布链路 (#3)

frontend/scripts/create-desktop-update-feed.mjs

@@ -1,6 +1,6 @@
+import { createHash } from "node:crypto";
 import { copyFile, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
-import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
@@ -25,7 +25,7 @@ const assert = (condition, message) => {
   if (!condition) fail(message);
 };
 
-const artifactPath = value("--artifact") || process.env.DESKTOP_UPDATE_ARTIFACT;
+const macosArtifactPath = value("--artifact") || process.env.DESKTOP_UPDATE_ARTIFACT;
 const outputDir = resolve(
   frontendDir,
   value("--output-dir") || process.env.DESKTOP_UPDATE_OUTPUT_DIR || "src-tauri/target/release/desktop-update-feed",
@@ -34,18 +34,40 @@ const baseUrlRaw = value("--base-url") || process.env.DESKTOP_UPDATE_BASE_URL;
 const pubDate = value("--date") || process.env.DESKTOP_UPDATE_PUB_DATE || new Date().toISOString();
 const notes = value("--notes") || process.env.DESKTOP_UPDATE_NOTES;
 const includes = values("--include").map((path) => resolve(frontendDir, path));
+const platformArtifactSpecs = values("--platform-artifact");
+const platformPattern = /^(?:darwin|windows|linux)-(?:x86_64|aarch64|i686|armv7)$/;
 
-assert(Boolean(artifactPath), "--artifact or DESKTOP_UPDATE_ARTIFACT is required.");
+assert(Boolean(macosArtifactPath), "--artifact or DESKTOP_UPDATE_ARTIFACT is required for the Universal macOS updater artifact.");
 assert(Boolean(baseUrlRaw), "--base-url or DESKTOP_UPDATE_BASE_URL is required.");
 
-const resolvedArtifactPath = artifactPath ? resolve(frontendDir, artifactPath) : undefined;
-const artifactName = resolvedArtifactPath ? basename(resolvedArtifactPath) : undefined;
-const signaturePath = resolvedArtifactPath ? `${resolvedArtifactPath}.sig` : undefined;
-const uploadFiles = [];
+const platformArtifacts = new Map();
+if (macosArtifactPath) {
+  const resolvedMacosArtifact = resolve(frontendDir, macosArtifactPath);
+  platformArtifacts.set("darwin-aarch64", resolvedMacosArtifact);
+  platformArtifacts.set("darwin-x86_64", resolvedMacosArtifact);
+}
+
+for (const spec of platformArtifactSpecs) {
+  const separator = spec.indexOf("=");
+  if (separator <= 0 || separator === spec.length - 1) {
+    fail(`--platform-artifact must use <os>-<arch>=<path>: ${spec}`);
+    continue;
+  }
+
+  const platform = spec.slice(0, separator);
+  const path = spec.slice(separator + 1);
+  assert(platformPattern.test(platform), `Unsupported updater platform key: ${platform}`);
+  assert(!platformArtifacts.has(platform), `Updater platform is configured more than once: ${platform}`);
+  if (platformPattern.test(platform) && !platformArtifacts.has(platform)) {
+    platformArtifacts.set(platform, resolve(frontendDir, path));
+  }
+}
 
 const readRequiredFile = async (path, description) => {
   try {
-    return await readFile(path);
+    const data = await readFile(path);
+    assert(data.length > 0, `${description} must not be empty: ${path}`);
+    return data;
   } catch (error) {
     fail(`${description} cannot be read: ${path} (${error.message})`);
     return undefined;
@@ -72,20 +94,16 @@ const normalizedBaseUrl = () => {
   }
 };
 
-const copyIntoOutput = async (sourcePath) => {
-  const destination = resolve(outputDir, basename(sourcePath));
-  if (sourcePath !== destination) {
-    await copyFile(sourcePath, destination);
-  }
-  return destination;
-};
-
-if (resolvedArtifactPath && signaturePath) {
-  await readRequiredFile(resolvedArtifactPath, "Updater artifact");
+const artifactSignatures = new Map();
+const uniqueArtifactPaths = [...new Set(platformArtifacts.values())];
+for (const artifactPath of uniqueArtifactPaths) {
+  const signaturePath = `${artifactPath}.sig`;
+  await readRequiredFile(artifactPath, "Updater artifact");
   const signature = await readRequiredFile(signaturePath, "Updater artifact signature");
   if (signature) {
     const signatureText = signature.toString("utf8").trim();
-    assert(signatureText.length > 80, "Updater artifact signature is unexpectedly short.");
+    assert(signatureText.length > 80, `Updater artifact signature is unexpectedly short: ${signaturePath}`);
+    artifactSignatures.set(artifactPath, signatureText);
   }
 }
 
@@ -98,56 +116,75 @@ for (const includePath of includes) {
   }
 }
 
+for (const [platform, artifactPath] of platformArtifacts) {
+  if (platform.startsWith("darwin-")) {
+    assert(artifactPath.endsWith(".app.tar.gz"), `${platform} must use a macOS .app.tar.gz updater artifact.`);
+  }
+  if (platform === "windows-x86_64") {
+    assert(artifactPath.endsWith(".nsis.zip"), "windows-x86_64 must use an NSIS .nsis.zip updater artifact.");
+  }
+}
+
+const uploadSources = [
+  ...uniqueArtifactPaths.flatMap((path) => [path, `${path}.sig`]),
+  ...includes,
+];
+const sourceByName = new Map();
+for (const sourcePath of uploadSources) {
+  const name = basename(sourcePath);
+  const existing = sourceByName.get(name);
+  assert(!existing || existing === sourcePath, `Release files must have unique basenames: ${name}`);
+  sourceByName.set(name, sourcePath);
+}
+
 const baseUrl = normalizedBaseUrl();
 
-if (failures.length === 0 && resolvedArtifactPath && signaturePath && artifactName && baseUrl) {
+if (failures.length === 0 && baseUrl) {
   await mkdir(outputDir, { recursive: true });
 
-  const artifactUrl = new URL(artifactName, baseUrl).toString();
-  assert(!artifactUrl.endsWith("/latest.json"), "Updater artifact URL must not point at latest.json.");
-  assert(!/[?&]token=/i.test(new URL(artifactUrl).search), "Updater artifact URL must not include token query parameters.");
+  const platforms = {};
+  for (const [platform, artifactPath] of platformArtifacts) {
+    const artifactUrl = new URL(basename(artifactPath), baseUrl).toString();
+    assert(!artifactUrl.endsWith("/latest.json"), "Updater artifact URL must not point at latest.json.");
+    assert(!/[?&]token=/i.test(new URL(artifactUrl).search), "Updater artifact URL must not include token query parameters.");
+    platforms[platform] = {
+      signature: artifactSignatures.get(artifactPath),
+      url: artifactUrl,
+    };
+  }
 
-  const signature = (await readFile(signaturePath, "utf8")).trim();
   const latest = {
     version: packageInfo.version,
     pub_date: pubDate,
-    platforms: {
-      "darwin-aarch64": {
-        signature,
-        url: artifactUrl,
-      },
-      "darwin-x86_64": {
-        signature,
-        url: artifactUrl,
-      },
-    },
+    platforms,
   };
-
   if (notes) {
     latest.notes = notes;
   }
 
-  uploadFiles.push(await copyIntoOutput(resolvedArtifactPath));
-  uploadFiles.push(await copyIntoOutput(signaturePath));
-  for (const includePath of includes) {
-    uploadFiles.push(await copyIntoOutput(includePath));
+  const copiedFiles = [];
+  for (const sourcePath of sourceByName.values()) {
+    const destination = resolve(outputDir, basename(sourcePath));
+    if (sourcePath !== destination) {
+      await copyFile(sourcePath, destination);
+    }
+    copiedFiles.push(destination);
   }
 
   const latestPath = resolve(outputDir, "latest.json");
   await writeFile(latestPath, `${JSON.stringify(latest, null, 2)}\n`);
-  uploadFiles.push(latestPath);
+  copiedFiles.push(latestPath);
 
-  const uniqueFiles = [...new Map(uploadFiles.map((path) => [basename(path), path])).values()];
   const checksumLines = [];
-  for (const filePath of uniqueFiles) {
+  for (const filePath of copiedFiles) {
     checksumLines.push(`${await sha256(filePath)}  ${basename(filePath)}`);
   }
   const checksumPath = resolve(outputDir, "SHA256SUMS.txt");
   await writeFile(checksumPath, `${checksumLines.join("\n")}\n`);
 
   console.log(`Desktop update feed created in ${outputDir}`);
-  console.log(`  - ${uniqueFiles.map((path) => basename(path)).join("\n  - ")}`);
-  console.log(`  - SHA256SUMS.txt`);
+  console.log(`  - ${copiedFiles.map((path) => basename(path)).join("\n  - ")}`);
+  console.log("  - SHA256SUMS.txt");
 }
 
 if (failures.length > 0) {

frontend/scripts/verify-desktop-release-readiness.mjs

@@ -11,13 +11,11 @@ const failures = [];
 const env = process.env;
 const fullShaPattern = /^[0-9a-f]{40}$/i;
 const expectedTag = `v${packageInfo.version}`;
-const requiredSecretLikeEnv = [
-  "TAURI_SIGNING_PRIVATE_KEY",
-  "TAURI_SIGNING_PRIVATE_KEY_PASSWORD",
-  "APPLE_ID",
-  "APPLE_PASSWORD",
-  "APPLE_TEAM_ID",
-];
+const requiresMacosSigning = env.REQUIRE_DESKTOP_SIGNING === "true";
+const requiresWindowsSigning = env.REQUIRE_WINDOWS_SIGNING === "true";
+const requiredUpdaterEnv = ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"];
+const requiredMacosEnv = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_TEAM_ID"];
+const requiredWindowsEnv = ["WINDOWS_CERTIFICATE", "WINDOWS_CERTIFICATE_PASSWORD"];
 
 const fail = (message) => failures.push(message);
 const assert = (condition, message) => {
@@ -65,6 +63,24 @@ const validateBaseUrl = () => {
   );
 };
 
+const validateWindowsTimestampUrl = () => {
+  const raw = env.WINDOWS_TIMESTAMP_URL;
+  requireEnv("WINDOWS_TIMESTAMP_URL");
+  if (!raw) return;
+
+  let url;
+  try {
+    url = new URL(raw);
+  } catch (error) {
+    fail(`WINDOWS_TIMESTAMP_URL is invalid: ${error.message}`);
+    return;
+  }
+
+  assert(["http:", "https:"].includes(url.protocol), "WINDOWS_TIMESTAMP_URL must use HTTP or HTTPS.");
+  assert(url.username === "" && url.password === "", "WINDOWS_TIMESTAMP_URL must not include credentials.");
+  assert(!/[?&]token=/i.test(url.search), "WINDOWS_TIMESTAMP_URL must not include token query parameters.");
+};
+
 const headSha = gitMaybe(["rev-parse", "HEAD"]);
 const exactTag = gitMaybe(["describe", "--tags", "--exact-match", "HEAD"]);
 const status = gitMaybe(["status", "--porcelain"]);
@@ -79,16 +95,39 @@ if (headSha && env.VITE_BUILD_COMMIT) {
   assert(env.VITE_BUILD_COMMIT === headSha, "VITE_BUILD_COMMIT must match the current release commit.");
 }
 
-for (const name of requiredSecretLikeEnv) {
+assert(
+  requiresMacosSigning || requiresWindowsSigning,
+  "Release readiness requires REQUIRE_DESKTOP_SIGNING=true or REQUIRE_WINDOWS_SIGNING=true.",
+);
+assert(
+  !(requiresMacosSigning && requiresWindowsSigning),
+  "macOS and Windows signing readiness must be checked in their native jobs.",
+);
+
+for (const name of requiredUpdaterEnv) {
   requireEnv(name);
 }
 
-assert(
-  Boolean(env.APPLE_CERTIFICATE || env.APPLE_SIGNING_IDENTITY),
-  "APPLE_CERTIFICATE or APPLE_SIGNING_IDENTITY must be configured for macOS signing.",
-);
-if (env.APPLE_CERTIFICATE) {
-  requireEnv("APPLE_CERTIFICATE_PASSWORD");
+if (requiresMacosSigning) {
+  assert(process.platform === "darwin", "Signed macOS desktop release readiness must run on macOS.");
+  for (const name of requiredMacosEnv) {
+    requireEnv(name);
+  }
+  assert(
+    Boolean(env.APPLE_CERTIFICATE || env.APPLE_SIGNING_IDENTITY),
+    "APPLE_CERTIFICATE or APPLE_SIGNING_IDENTITY must be configured for macOS signing.",
+  );
+  if (env.APPLE_CERTIFICATE) {
+    requireEnv("APPLE_CERTIFICATE_PASSWORD");
+  }
+}
+
+if (requiresWindowsSigning) {
+  assert(process.platform === "win32", "Signed Windows desktop release readiness must run on Windows.");
+  for (const name of requiredWindowsEnv) {
+    requireEnv(name);
+  }
+  validateWindowsTimestampUrl();
 }
 
 validateBaseUrl();

frontend/scripts/verify-desktop-release.mjs

@@ -392,6 +392,7 @@ const verifyWorkflowGates = async () => {
   assert(packageInfo.engines?.node === ">=22.13.0", "package.json must require Node.js >=22.13.0.");
   const requiredScripts = [
     "desktop:build:macos-release",
+    "desktop:build:windows-release",
     "desktop:update-feed:create",
     "desktop:update-feed:check",
     "desktop:release-readiness:check",
@@ -424,15 +425,30 @@ const verifyWorkflowGates = async () => {
 
   const releaseWorkflow = await readFile(resolve(rootDir, ".github/workflows/desktop-release-candidate.yml"), "utf8");
   const requiredReleaseWorkflowTokens = [
+    "runs-on: macos-latest",
+    "runs-on: windows-latest",
     "REQUIRE_DESKTOP_SIGNING",
+    "REQUIRE_WINDOWS_SIGNING",
     "TAURI_SIGNING_PRIVATE_KEY",
     "APPLE_ID",
     "APPLE_PASSWORD",
     "APPLE_TEAM_ID",
+    "WINDOWS_CERTIFICATE",
+    "WINDOWS_CERTIFICATE_PASSWORD",
+    "WINDOWS_TIMESTAMP_URL",
+    "npm audit",
     "npm run desktop:build:macos-release",
+    "npm run desktop:build:windows-release",
+    "Get-AuthenticodeSignature",
+    "EnhancedKeyUsageList",
+    "TimeStamperCertificate",
+    ".nsis.zip",
     "npm run desktop:update-feed:create",
+    "--platform-artifact",
     "npm run desktop:update-feed:check",
+    "--require-platform windows-x86_64",
     "npm run desktop:release-readiness:check",
+    "actions/download-artifact",
     "actions/upload-artifact",
   ];
 

frontend/scripts/verify-desktop-update-feed.mjs

@@ -12,6 +12,8 @@ const optionValue = (name) => {
   const index = args.indexOf(name);
   return index >= 0 ? args[index + 1] : undefined;
 };
+const optionValues = (name) =>
+  args.reduce((result, argument, index) => (argument === name && args[index + 1] ? [...result, args[index + 1]] : result), []);
 
 const feedPath = resolve(
   frontendDir,
@@ -19,6 +21,12 @@ const feedPath = resolve(
 );
 const artifactDir = optionValue("--artifacts-dir") || process.env.DESKTOP_UPDATE_ARTIFACTS_DIR;
 const expectedBaseUrl = optionValue("--base-url") || process.env.DESKTOP_UPDATE_BASE_URL;
+const requiredPlatforms = new Set([
+  "darwin-aarch64",
+  "darwin-x86_64",
+  ...optionValues("--require-platform"),
+]);
+const platformPattern = /^(?:darwin|windows|linux)-(?:x86_64|aarch64|i686|armv7)$/;
 const checksumManifestPath =
   optionValue("--checksum-manifest") ||
   process.env.DESKTOP_UPDATE_CHECKSUM_MANIFEST ||
@@ -103,15 +111,16 @@ if (feed) {
 
   assert(normalizedFeedVersion === packageInfo.version, `latest.json version must match package version ${packageInfo.version}.`);
   assert(Boolean(feed.pub_date || feed.pubDate), "latest.json must include a publication date.");
-  assert(Boolean(darwinArm), "latest.json must include darwin-aarch64.");
-  assert(Boolean(darwinIntel), "latest.json must include darwin-x86_64.");
+  for (const platform of requiredPlatforms) {
+    assert(platformPattern.test(platform), `Required updater platform key is unsupported: ${platform}.`);
+    assert(Boolean(platforms[platform]), `latest.json must include ${platform}.`);
+  }
 
-  const entries = [
-    ["darwin-aarch64", darwinArm],
-    ["darwin-x86_64", darwinIntel],
-  ];
+  const entries = Object.entries(platforms);
+  assert(entries.length > 0, "latest.json must include at least one platform entry.");
 
   for (const [platform, entry] of entries) {
+    assert(platformPattern.test(platform), `latest.json contains an unsupported platform key: ${platform}.`);
     const rawUrl = entry?.url;
     const signature = entry?.signature;
     assert(typeof signature === "string" && signature.length > 80, `${platform} must include an updater signature.`);
@@ -133,6 +142,12 @@ if (feed) {
     if (expectedBaseUrl) {
       assert(rawUrl.startsWith(expectedBaseUrl), `${platform} artifact URL must start with ${expectedBaseUrl}.`);
     }
+    if (platform.startsWith("darwin-")) {
+      assert(url.pathname.endsWith(".app.tar.gz"), `${platform} must point to a macOS .app.tar.gz updater artifact.`);
+    }
+    if (platform === "windows-x86_64") {
+      assert(url.pathname.endsWith(".nsis.zip"), "windows-x86_64 must point to an NSIS .nsis.zip updater artifact.");
+    }
 
     if (artifactDir) {
       const artifactPath = resolve(artifactDir, basename(url.pathname));

frontend/scripts/verify-release-build-env.mjs

@@ -1,8 +1,10 @@
+import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
+const rootDir = resolve(frontendDir, "..");
 const packageInfo = JSON.parse(await readFile(resolve(frontendDir, "package.json"), "utf8"));
 const failures = [];
 
@@ -16,6 +18,8 @@ const commit = env.VITE_BUILD_COMMIT || "local";
 const isCi = env.CI === "true" || env.GITHUB_ACTIONS === "true";
 const isTagBuild = env.GITHUB_REF_TYPE === "tag";
 const isReleaseBuild = env.RELEASE_BUILD === "true" || isTagBuild || channel === "release";
+const requiresMacosSigning = env.REQUIRE_DESKTOP_SIGNING === "true";
+const requiresWindowsSigning = env.REQUIRE_WINDOWS_SIGNING === "true";
 
 const fail = (message) => failures.push(message);
 const assert = (condition, message) => {
@@ -26,6 +30,18 @@ const requireEnv = (name) => {
   assert(Boolean(env[name]), `${name} must be configured for signed desktop release builds.`);
 };
 
+const gitHead = () => {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return undefined;
+  }
+};
+
 assert(allowedChannels.has(channel), `VITE_BUILD_CHANNEL must be one of ${[...allowedChannels].join(", ")}.`);
 
 if (isCi || isReleaseBuild) {
@@ -40,12 +56,25 @@ if (env.GITHUB_SHA) {
   );
 }
 
+if (isReleaseBuild && fullShaPattern.test(commit)) {
+  const headSha = gitHead();
+  assert(Boolean(headSha), "Release builds must be able to resolve the current Git commit.");
+  if (headSha) {
+    assert(commit === headSha, "VITE_BUILD_COMMIT must match the current Git HEAD for release builds.");
+  }
+}
+
 if (isTagBuild) {
   assert(env.GITHUB_REF_NAME === semverTag, `Release tag must be ${semverTag}; found ${env.GITHUB_REF_NAME || "<missing>"}.`);
   assert(channel === "release", "Release tag builds must set VITE_BUILD_CHANNEL=release.");
 }
 
-if (env.REQUIRE_DESKTOP_SIGNING === "true") {
+assert(
+  !(requiresMacosSigning && requiresWindowsSigning),
+  "macOS and Windows signing requirements must be checked in their native jobs.",
+);
+
+if (requiresMacosSigning) {
   assert(process.platform === "darwin", "Signed macOS desktop release builds must run on macOS.");
   if (isCi) {
     assert(isTagBuild, "Signed desktop release candidate builds in CI must run from a release tag.");
@@ -64,6 +93,18 @@ if (env.REQUIRE_DESKTOP_SIGNING === "true") {
   }
 }
 
+if (requiresWindowsSigning) {
+  assert(process.platform === "win32", "Signed Windows desktop release builds must run on Windows.");
+  if (isCi) {
+    assert(isTagBuild, "Signed Windows desktop release candidate builds in CI must run from a release tag.");
+  }
+  requireEnv("TAURI_SIGNING_PRIVATE_KEY");
+  requireEnv("TAURI_SIGNING_PRIVATE_KEY_PASSWORD");
+  requireEnv("WINDOWS_CERTIFICATE");
+  requireEnv("WINDOWS_CERTIFICATE_PASSWORD");
+  requireEnv("WINDOWS_TIMESTAMP_URL");
+}
+
 if (failures.length > 0) {
   console.error(`Release build environment check failed:\n${failures.map((item) => `  - ${item}`).join("\n")}`);
   process.exitCode = 1;