build(desktop): allow controlled unsigned v0.1.0 release

frontend/scripts/desktop-release-policy.mjs

@@ -0,0 +1,86 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const frontendDir = fileURLToPath(new URL("../", import.meta.url));
+export const desktopReleasePolicyPath = resolve(frontendDir, "desktop-release-policy.json");
+
+const semverPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+
+const validatePolicy = (policy) => {
+  const failures = [];
+  const assert = (condition, message) => {
+    if (!condition) failures.push(message);
+  };
+
+  assert(policy?.schemaVersion === 1, "desktop release policy schemaVersion must be 1.");
+  assert(
+    policy?.defaultPlatformSigningMode === "signed",
+    "desktop release policy must default platform signing to signed.",
+  );
+  assert(policy?.updaterSigningRequired === true, "desktop release policy must always require updater signing.");
+  assert(
+    Array.isArray(policy?.unsignedPlatformExceptions),
+    "desktop release policy unsignedPlatformExceptions must be an array.",
+  );
+
+  const versions = new Set();
+  for (const exception of policy?.unsignedPlatformExceptions || []) {
+    const prefix = `unsigned platform exception ${exception?.version || "<missing>"}`;
+    assert(semverPattern.test(exception?.version || ""), `${prefix} must use an exact X.Y.Z version.`);
+    assert(!versions.has(exception?.version), `${prefix} is duplicated.`);
+    versions.add(exception?.version);
+    assert(exception?.status === "approved", `${prefix} must have status approved.`);
+    assert(exception?.macos === "ad-hoc", `${prefix} must constrain macOS to ad-hoc signing.`);
+    assert(exception?.windows === "unsigned", `${prefix} must constrain Windows to unsigned.`);
+    assert(exception?.distribution === "controlled", `${prefix} must constrain distribution to controlled.`);
+    assert(/^\d{4}-\d{2}-\d{2}$/.test(exception?.approvedOn || ""), `${prefix} must record an approval date.`);
+    assert(
+      typeof exception?.reason === "string" && exception.reason.trim().length >= 30,
+      `${prefix} must record a substantive reason.`,
+    );
+  }
+
+  if (failures.length > 0) {
+    throw new Error(failures.join("\n"));
+  }
+};
+
+export const loadDesktopReleasePolicy = async () => {
+  const policy = JSON.parse(await readFile(desktopReleasePolicyPath, "utf8"));
+  validatePolicy(policy);
+  return policy;
+};
+
+export const resolveDesktopReleasePolicy = (version, policy) => {
+  if (!semverPattern.test(version || "")) {
+    throw new Error(`Desktop release version must use exact X.Y.Z semver; found ${version || "<missing>"}.`);
+  }
+
+  const exception = policy.unsignedPlatformExceptions.find(
+    (candidate) => candidate.version === version && candidate.status === "approved",
+  );
+
+  if (!exception) {
+    return {
+      version,
+      platformSigningMode: "signed",
+      macosSigning: "apple-developer",
+      windowsSigning: "authenticode",
+      artifactLabel: "SIGNED-PLATFORM",
+      distribution: "formal",
+      warningRequired: false,
+    };
+  }
+
+  return {
+    version,
+    platformSigningMode: "unsigned-exception",
+    macosSigning: exception.macos,
+    windowsSigning: exception.windows,
+    artifactLabel: "UNSIGNED-PLATFORM",
+    distribution: exception.distribution,
+    warningRequired: true,
+    exception,
+  };
+};