59 lines
2.4 KiB
JavaScript
59 lines
2.4 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto'
|
|
import { mkdir, readFile, writeFile } from 'node:fs/promises'
|
|
import { basename, join, resolve } from 'node:path'
|
|
import { canonicalJson } from '../lib/canonical-json.mjs'
|
|
import { parseStable } from '../lib/contracts.mjs'
|
|
|
|
const [configArg, privateKeyArg, outputArg] = process.argv.slice(2)
|
|
if (configArg === undefined || privateKeyArg === undefined || outputArg === undefined) {
|
|
console.error('usage: build-release.mjs <release-config.json> <current-release-private.pem> <output-dir>')
|
|
process.exit(64)
|
|
}
|
|
const config = JSON.parse(await readFile(resolve(configArg), 'utf8'))
|
|
const privateKey = createPrivateKey(await readFile(resolve(privateKeyArg)))
|
|
if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error('Release private key must be Ed25519')
|
|
const publicDer = createPublicKey(privateKey).export({ format: 'der', type: 'spki' })
|
|
const keyId = createHash('sha256').update(publicDer).digest('hex')
|
|
if (keyId !== config.currentKeyId) throw new Error('Release private key is not the configured current key')
|
|
const artifacts = []
|
|
for (const artifact of config.artifacts) {
|
|
const bytes = await readFile(resolve(artifact.path))
|
|
artifacts.push({
|
|
id: artifact.id,
|
|
mediaType: artifact.mediaType,
|
|
sha256: createHash('sha256').update(bytes).digest('hex'),
|
|
size: bytes.byteLength,
|
|
url: new URL(basename(artifact.path), config.artifactBaseUrl).href,
|
|
})
|
|
}
|
|
let issuedAt
|
|
if (process.env.SOURCE_DATE_EPOCH === undefined) issuedAt = new Date().toISOString()
|
|
else {
|
|
const sourceDateEpoch = Number(process.env.SOURCE_DATE_EPOCH)
|
|
if (!Number.isSafeInteger(sourceDateEpoch) || sourceDateEpoch < 0) throw new Error('SOURCE_DATE_EPOCH must be a non-negative safe integer')
|
|
issuedAt = new Date(sourceDateEpoch * 1000).toISOString()
|
|
}
|
|
const stable = canonicalJson({
|
|
schema: 1,
|
|
updateApi: 1,
|
|
keyringGeneration: config.keyringGeneration,
|
|
targetSequence: config.targetSequence,
|
|
issuedAt,
|
|
artifacts,
|
|
desired: config.desired,
|
|
officialDshPolicy: config.officialDshPolicy,
|
|
})
|
|
parseStable(stable)
|
|
const signature = canonicalJson({
|
|
schema: 1,
|
|
algorithm: 'Ed25519',
|
|
keyId,
|
|
signature: sign(null, stable, privateKey).toString('base64'),
|
|
})
|
|
const output = resolve(outputArg)
|
|
await mkdir(output, { recursive: true })
|
|
await writeFile(join(output, 'stable.json'), stable, { flag: 'wx' })
|
|
await writeFile(join(output, 'stable.sig.json'), signature, { flag: 'wx' })
|