diff --git a/scripts/ci/verify-release-artifacts.sh b/scripts/ci/verify-release-artifacts.sh index ea57d2ff8..09898b93a 100755 --- a/scripts/ci/verify-release-artifacts.sh +++ b/scripts/ci/verify-release-artifacts.sh @@ -5,12 +5,16 @@ source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_common.sh" usage() { cat >&2 <<'EOF' -usage: verify-release-artifacts.sh [all|linux|macos|android|ios|web|latest-json ...] +usage: verify-release-artifacts.sh [all|present|linux|macos|android|ios|web|latest-json ...] Verifies downloaded release artifacts against their reproducibility proof files. The verifier recomputes final file hashes, canonical signed payload hashes, and Tauri updater signatures where the current host has the required platform tools. +The all target requires every release proof class. The present target verifies +only the proof classes found in the artifact directory, which is useful for +partial PR artifact bundles. + Set MAPLE_VERIFY_ALLOW_PLATFORM_SKIPS=1 to skip host-specific Apple container checks, such as DMG or IPA canonicalization on non-macOS hosts. EOF @@ -270,13 +274,9 @@ verify_tauri_signatures_in_artifacts() { done < <(find "${artifacts_dir}" -type f -name '*.sig' -print0 | LC_ALL=C sort -z) } -verify_linux() { - local final_manifest fake_pub_manifest - - final_manifest="$(proof_file_optional desktop-release-linux-final.sha256)" - if [ -z "${final_manifest}" ]; then - final_manifest="$(proof_file_required desktop-pr-linux-fake-signing-final.sha256)" - fi +verify_linux_manifest() { + local final_manifest="$1" + local fake_pub_manifest fake_pub_manifest="$(proof_file_optional desktop-pr-linux-fake-updater-public-key.sha256)" if [ -n "${fake_pub_manifest}" ]; then @@ -287,6 +287,24 @@ verify_linux() { verify_tauri_signatures_in_artifacts } +verify_linux() { + local final_manifest + + final_manifest="$(proof_file_required desktop-release-linux-final.sha256)" + verify_linux_manifest "${final_manifest}" +} + +verify_linux_present() { + local final_manifest + + final_manifest="$(proof_file_optional desktop-release-linux-final.sha256)" + if [ -z "${final_manifest}" ]; then + final_manifest="$(proof_file_required desktop-pr-linux-fake-signing-final.sha256)" + fi + + verify_linux_manifest "${final_manifest}" +} + verify_canonical_apple_manifest() { local manifest="$1" local expected_digest="${2:-}" @@ -569,19 +587,34 @@ target_present() { [ -n "$(proof_file_optional "${pattern}")" ] } -verify_all_present() { - target_present desktop-release-linux-final.sha256 && verify_linux +verify_present() { + if target_present desktop-release-linux-final.sha256 || target_present desktop-pr-linux-fake-signing-final.sha256; then + verify_linux_present + fi target_present desktop-release-macos-final.sha256 && verify_macos target_present android-release-final.sha256 && verify_android target_present ios-release-final.sha256 && verify_ios target_present web-final.sha256 && verify_web target_present latest-json-final.sha256 && verify_latest_json + return 0 +} + +verify_all() { + verify_linux + verify_macos + verify_android + verify_ios + verify_web + verify_latest_json } for target in "$@"; do case "${target}" in all) - verify_all_present + verify_all + ;; + present) + verify_present ;; linux) verify_linux