Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

release: prepare ForgeFlow 0.10.1
ForgeFlow quality gate / quality (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-30 00:49:58 +02:00
parent 6ef4620388
commit 60e8aa8fc2
15 changed files with 173 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/production-acceptance-harness.cjs
+2 -4
View File
@@ -128,21 +128,19 @@ class ProductionAcceptanceHarness {
const binary = Buffer.from(options.binary || "MZ-forgeflow-acceptance-binary");
const name = `ForgeFlow-Portable-${version}-win-x64.exe`;
const checksum = crypto.createHash("sha256").update(binary).digest("hex");
const manifest = { version, draft: options.draft === true, assets: options.missingAsset ? [] : [{ name, sha256: options.badChecksum ? "0".repeat(64) : checksum, signer: options.signer || "CN=ForgeFlow Test", timestamped: options.timestamped !== false }], provenance: { commitSha: options.commitSha || this.initialSha }, sbom: { bomFormat: "CycloneDX" } };
const manifest = { version, draft: options.draft === true, assets: options.missingAsset ? [] : [{ name, sha256: options.badChecksum ? "0".repeat(64) : checksum }], provenance: { commitSha: options.commitSha || this.initialSha }, sbom: { bomFormat: "CycloneDX" } };
await fs.writeFile(path.join(this.paths.releases, `${version}.json`), JSON.stringify(manifest, null, 2));
if (!options.missingAsset) await fs.writeFile(path.join(this.paths.releases, name), binary);
return manifest;
}
async verifyRelease(version, expectedSigner = "CN=ForgeFlow Test") {
async verifyRelease(version) {
const manifest = JSON.parse(await fs.readFile(path.join(this.paths.releases, `${version}.json`), "utf8"));
if (manifest.draft) throw new Error("Incomplete draft release rejected.");
const asset = manifest.assets[0];
if (!asset) throw new Error("Required release asset is missing.");
const binary = await fs.readFile(path.join(this.paths.releases, asset.name));
if (crypto.createHash("sha256").update(binary).digest("hex") !== asset.sha256) throw new Error("Release checksum mismatch.");
if (asset.signer !== expectedSigner) throw new Error("Release signer mismatch.");
if (!asset.timestamped) throw new Error("Release signature timestamp is missing.");
if (!manifest.provenance?.commitSha || manifest.sbom?.bomFormat !== "CycloneDX") throw new Error("Release provenance or SBOM is missing.");
return { verified: true, version, asset: asset.name };
}