build(release): 加固 v0.1.0 桌面发布链路 (#3)

frontend/scripts/verify-desktop-update-feed.mjs

@@ -12,6 +12,8 @@ const optionValue = (name) => {
   const index = args.indexOf(name);
   return index >= 0 ? args[index + 1] : undefined;
 };
+const optionValues = (name) =>
+  args.reduce((result, argument, index) => (argument === name && args[index + 1] ? [...result, args[index + 1]] : result), []);
 
 const feedPath = resolve(
   frontendDir,
@@ -19,6 +21,12 @@ const feedPath = resolve(
 );
 const artifactDir = optionValue("--artifacts-dir") || process.env.DESKTOP_UPDATE_ARTIFACTS_DIR;
 const expectedBaseUrl = optionValue("--base-url") || process.env.DESKTOP_UPDATE_BASE_URL;
+const requiredPlatforms = new Set([
+  "darwin-aarch64",
+  "darwin-x86_64",
+  ...optionValues("--require-platform"),
+]);
+const platformPattern = /^(?:darwin|windows|linux)-(?:x86_64|aarch64|i686|armv7)$/;
 const checksumManifestPath =
   optionValue("--checksum-manifest") ||
   process.env.DESKTOP_UPDATE_CHECKSUM_MANIFEST ||
@@ -103,15 +111,16 @@ if (feed) {
 
   assert(normalizedFeedVersion === packageInfo.version, `latest.json version must match package version ${packageInfo.version}.`);
   assert(Boolean(feed.pub_date || feed.pubDate), "latest.json must include a publication date.");
-  assert(Boolean(darwinArm), "latest.json must include darwin-aarch64.");
-  assert(Boolean(darwinIntel), "latest.json must include darwin-x86_64.");
+  for (const platform of requiredPlatforms) {
+    assert(platformPattern.test(platform), `Required updater platform key is unsupported: ${platform}.`);
+    assert(Boolean(platforms[platform]), `latest.json must include ${platform}.`);
+  }
 
-  const entries = [
-    ["darwin-aarch64", darwinArm],
-    ["darwin-x86_64", darwinIntel],
-  ];
+  const entries = Object.entries(platforms);
+  assert(entries.length > 0, "latest.json must include at least one platform entry.");
 
   for (const [platform, entry] of entries) {
+    assert(platformPattern.test(platform), `latest.json contains an unsupported platform key: ${platform}.`);
     const rawUrl = entry?.url;
     const signature = entry?.signature;
     assert(typeof signature === "string" && signature.length > 80, `${platform} must include an updater signature.`);
@@ -133,6 +142,12 @@ if (feed) {
     if (expectedBaseUrl) {
       assert(rawUrl.startsWith(expectedBaseUrl), `${platform} artifact URL must start with ${expectedBaseUrl}.`);
     }
+    if (platform.startsWith("darwin-")) {
+      assert(url.pathname.endsWith(".app.tar.gz"), `${platform} must point to a macOS .app.tar.gz updater artifact.`);
+    }
+    if (platform === "windows-x86_64") {
+      assert(url.pathname.endsWith(".nsis.zip"), "windows-x86_64 must point to an NSIS .nsis.zip updater artifact.");
+    }
 
     if (artifactDir) {
       const artifactPath = resolve(artifactDir, basename(url.pathname));