ERP-Team/kaidi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

feat: add verified clean reinstall workflow
Release / release (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Qiufeng
2026-08-18 01:13:05 +08:00
parent 2c73ad7eb0
commit fa4517c263
10 changed files with 374 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/verify-release.sh
+14 -3
View File
@@ -40,6 +40,7 @@ printf '%s\n' \
bootstrap-checksums.txt \
frontend-sbom.cdx.json \
install.sh \
purge.sh \
"$ARTIFACT" \
release-manifest.json \
release-manifest.sig \
@@ -49,7 +50,7 @@ for path in ./* ./.[!.]* ./..?*; do
basename "$path"
done | LC_ALL=C sort > "$WORK/actual-assets.txt"
diff -u "$WORK/expected-assets.txt" "$WORK/actual-assets.txt" \
|| { printf 'Release directory must contain exactly the nine published assets\n' >&2; exit 1; }
|| { printf 'Release directory must contain exactly the ten published assets\n' >&2; exit 1; }
EXPECTED_ARTIFACT_SHA256=$(jq -er \
'.sha256 | strings | ascii_downcase | select(test("^[0-9a-f]{64}$"))' \
release-manifest.json)
@@ -109,16 +110,21 @@ done
PUBLIC_KEY_SHA256=$(sha256_file release-public.pem)
INSTALLER_SHA256=$(sha256_file install.sh)
PURGER_SHA256=$(sha256_file purge.sh)
BOOTSTRAP_SHA256=$(sha256_file bootstrap-checksums.txt)
SIGNED_INSTALLER=$(jq -er '.bootstrap.installer' release-manifest.json)
SIGNED_PURGER=$(jq -er '.bootstrap.purger' release-manifest.json)
SIGNED_PUBLIC_KEY=$(jq -er '.bootstrap.publicKey' release-manifest.json)
SIGNED_BOOTSTRAP=$(jq -er '.bootstrap.checksums' release-manifest.json)
[ "$SIGNED_INSTALLER" = install.sh ] && [ "$SIGNED_PUBLIC_KEY" = release-public.pem ] \
[ "$SIGNED_INSTALLER" = install.sh ] && [ "$SIGNED_PURGER" = purge.sh ] \
&& [ "$SIGNED_PUBLIC_KEY" = release-public.pem ] \
&& [ "$SIGNED_BOOTSTRAP" = bootstrap-checksums.txt ] \
|| { printf 'Release manifest bootstrap asset names are invalid\n' >&2; exit 1; }
jq -e --arg installer "$INSTALLER_SHA256" --arg publicKey "$PUBLIC_KEY_SHA256" \
jq -e --arg installer "$INSTALLER_SHA256" --arg purger "$PURGER_SHA256" \
--arg publicKey "$PUBLIC_KEY_SHA256" \
--arg bootstrap "$BOOTSTRAP_SHA256" \
'.bootstrap.installerSha256 == $installer
and .bootstrap.purgerSha256 == $purger
and .bootstrap.publicKeySha256 == $publicKey
and .bootstrap.checksumsSha256 == $bootstrap' release-manifest.json >/dev/null \
|| { printf 'Bootstrap assets do not match the signed manifest\n' >&2; exit 1; }
@@ -131,6 +137,8 @@ NORMALIZED_TRUSTED_PUBLIC_KEY_SHA256=$(printf '%s' "$TRUSTED_PUBLIC_KEY_SHA256"
|| { printf 'Bootstrap public-key fingerprint does not match\n' >&2; exit 1; }
[ "$(sed -n 's/^KAIDI_INSTALLER_SHA256=//p' bootstrap-checksums.txt)" = "$INSTALLER_SHA256" ] \
|| { printf 'Bootstrap installer digest does not match\n' >&2; exit 1; }
[ "$(sed -n 's/^KAIDI_PURGER_SHA256=//p' bootstrap-checksums.txt)" = "$PURGER_SHA256" ] \
|| { printf 'Bootstrap purger digest does not match\n' >&2; exit 1; }
ARCHIVE_LIST=$(tar -tzf "$ARTIFACT")
if grep -Eq '(^/|(^|/)\.\.(/|$))' <<< "$ARCHIVE_LIST"; then
@@ -171,5 +179,8 @@ tar -tvzf "$ARTIFACT" ./ops/baota-start.sh | grep -Eq '^-.{2}x.{2}x.{2}x' \
bash -n "$ROOT/deploy/baota-start.sh"
cmp install.sh "$ROOT/deploy/install.sh" \
|| { printf 'Release installer does not match deploy/install.sh\n' >&2; exit 1; }
bash -n "$ROOT/deploy/purge.sh"
cmp purge.sh "$ROOT/deploy/purge.sh" \
|| { printf 'Release purger does not match deploy/purge.sh\n' >&2; exit 1; }
printf 'Release %s verified; installer SHA-256: %s\n' "$VERSION" "$INSTALLER_SHA256"