Publish Ludarium source

scripts/validate-public-source.mjs

@@ -0,0 +1,33 @@
+import { readFile, readdir, stat } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+
+const root = resolve(new URL("..", import.meta.url).pathname.replace(/^\/(.:)/, "$1"));
+const manifest = JSON.parse(await readFile(join(root, "PUBLIC_SOURCE_MANIFEST.json"), "utf8"));
+if (manifest.schemaVersion !== 1 || !/^[0-9a-f]{40}$/.test(manifest.sourceRevision) || !Array.isArray(manifest.files))
+  throw new Error("The public source manifest is malformed.");
+
+const expected = new Map(manifest.files.map(entry => [entry.path, entry]));
+if (expected.size !== manifest.files.length || !expected.has("LICENSE"))
+  throw new Error("The public source manifest has duplicate entries or no LICENSE.");
+async function walk(directory, prefix = "") {
+  const found = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    if (!prefix && entry.name === ".git") continue;
+    const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) found.push(...await walk(join(directory, entry.name), path));
+    else if (entry.isFile() && path !== "PUBLIC_SOURCE_MANIFEST.json") found.push(path);
+    else if (!entry.isFile()) throw new Error(`Irregular public entry: ${path}`);
+  }
+  return found;
+}
+const actual = (await walk(root)).sort();
+if (actual.length !== expected.size || actual.some(path => !expected.has(path)))
+  throw new Error("Files outside the reviewed public manifest are present.");
+for (const path of actual) {
+  const data = await readFile(join(root, path));
+  const entry = expected.get(path);
+  if ((await stat(join(root, path))).size !== entry.bytes || createHash("sha256").update(data).digest("hex") !== entry.sha256)
+    throw new Error(`Public source integrity check failed: ${path}`);
+}
+console.log(`Validated ${actual.length} public files from canonical revision ${manifest.sourceRevision}`);