Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

fix: make packaged updates certificate-free
ForgeFlow quality gate / quality (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-29 23:11:24 +02:00
parent 18f42621c2
commit 6ef4620388
10 changed files with 46 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/update-service.test.mjs
+10 -13
View File
@@ -507,7 +507,7 @@ test("packaged updater rejects a binary whose checksum does not match", async ()
await rm(temp, { recursive: true, force: true });
});
test("Windows release pipeline fails closed on signatures and emits provenance plus SBOM", async () => {
test("Windows release pipeline preserves optional signing checks and emits provenance plus SBOM", async () => {
const [pkgSource, signatureSource, checksumSource] = await Promise.all([
readFile(new URL("../package.json", import.meta.url), "utf8"),
readFile(new URL("../scripts/verify-release-signatures.mjs", import.meta.url), "utf8"),
@@ -528,20 +528,17 @@ test("Windows release pipeline fails closed on signatures and emits provenance p
assert.match(publisher, /sbom\.cdx\.json/);
});
test("production signing build supports classic and Azure identities but always fails closed", async () => {
const [pkg, validator, signedConfig] = await Promise.all([
test("the supported Windows build is free, checksum-protected and updater-compatible", async () => {
const [pkg, signatureCheck, checksumWriter] = await Promise.all([
readFile(new URL("../package.json", import.meta.url), "utf8"),
readFile(new URL("../scripts/validate-signing-environment.mjs", import.meta.url), "utf8"),
readFile(new URL("../scripts/signed-electron-builder-config.cjs", import.meta.url), "utf8"),
readFile(new URL("../scripts/verify-release-signatures.mjs", import.meta.url), "utf8"),
readFile(new URL("../scripts/write-release-checksums.mjs", import.meta.url), "utf8"),
]);
assert.match(pkg, /dist:win:signed/);
assert.match(validator, /FORGEFLOW_SIGNED_RELEASE/);
assert.match(validator, /WIN_CSC_LINK/);
assert.match(validator, /FORGEFLOW_AZURE_CERTIFICATE_PROFILE/);
assert.match(validator, /exact certificate subject/);
assert.match(signedConfig, /forceCodeSigning:\s*true/);
assert.match(signedConfig, /azureSignOptions/);
assert.match(signedConfig, /timestamp\.acs\.microsoft\.com/);
assert.doesNotMatch(pkg, /dist:win:signed/);
assert.match(pkg, /dist:win/);
assert.match(pkg, /write-release-checksums\.mjs/);
assert.match(signatureCheck, /checksum-protected unsigned artifact/);
assert.match(checksumWriter, /sha256/);
});
test("binary update helper verifies, waits, applies and records restart state", async () => {