mirror of
https://github.com/kunkundi/crossdesk.git
synced 2026-10-17 09:23:10 +08:00
66 lines
2.6 KiB
PowerShell
66 lines
2.6 KiB
PowerShell
param(
|
|
[Parameter(Mandatory)]
|
|
[ValidateSet('PrepareBinaries', 'RestoreBinaries', 'VerifyInstaller')]
|
|
[string]$Operation,
|
|
[Parameter(Mandatory)] [string]$Artifact,
|
|
[string]$Directory,
|
|
[ValidateSet('test-signing', 'release-signing')] [string]$SigningPolicy
|
|
)
|
|
|
|
. "$PSScriptRoot/signpath-common.ps1"
|
|
|
|
if ($Operation -ne 'PrepareBinaries' -and !$SigningPolicy) {
|
|
throw 'SigningPolicy is required when verifying signed artifacts.'
|
|
}
|
|
if ($Operation -eq 'VerifyInstaller') {
|
|
Assert-CrossDeskSignature -Path $Artifact -SigningPolicy $SigningPolicy
|
|
return
|
|
}
|
|
if (!$Directory -or !(Test-Path -LiteralPath $Directory -PathType Container)) {
|
|
throw "Binaries directory does not exist: $Directory"
|
|
}
|
|
|
|
$files = @(Get-CrossDeskSigningFiles)
|
|
$temporaryDirectory = Join-Path ([IO.Path]::GetTempPath()) "crossdesk-signing-$([guid]::NewGuid())"
|
|
New-Item -ItemType Directory -Path $temporaryDirectory | Out-Null
|
|
try {
|
|
if ($Operation -eq 'PrepareBinaries') {
|
|
foreach ($name in $files) {
|
|
$source = Join-Path $Directory $name
|
|
if (!(Test-Path -LiteralPath $source -PathType Leaf)) {
|
|
throw "Missing CrossDesk binary: $source"
|
|
}
|
|
Copy-Item -LiteralPath $source -Destination (Join-Path $temporaryDirectory $name)
|
|
}
|
|
$artifactPath = [IO.Path]::GetFullPath($Artifact)
|
|
New-Item -ItemType Directory -Path (Split-Path -Parent $artifactPath) -Force | Out-Null
|
|
Compress-Archive -Path "$temporaryDirectory/*" -DestinationPath $artifactPath -Force
|
|
return
|
|
}
|
|
|
|
# Inspect the ZIP before extraction: reject missing, duplicate or unexpected
|
|
# entries (including paths) so only the four intended files can be replaced.
|
|
$archive = [IO.Compression.ZipFile]::OpenRead([IO.Path]::GetFullPath($Artifact))
|
|
try {
|
|
$entries = @($archive.Entries | ForEach-Object { $_.FullName })
|
|
$uniqueEntries = @($entries | Sort-Object -Unique)
|
|
if ($entries.Count -ne $files.Count -or $uniqueEntries.Count -ne $files.Count -or
|
|
@(Compare-Object $files $entries).Count -ne 0) {
|
|
throw "Signed archive must contain exactly: $($files -join ', ')"
|
|
}
|
|
} finally {
|
|
$archive.Dispose()
|
|
}
|
|
Expand-Archive -LiteralPath $Artifact -DestinationPath $temporaryDirectory
|
|
|
|
# Verify every file before replacing any build output.
|
|
foreach ($name in $files) {
|
|
Assert-CrossDeskSignature -Path (Join-Path $temporaryDirectory $name) -SigningPolicy $SigningPolicy
|
|
}
|
|
foreach ($name in $files) {
|
|
Copy-Item -LiteralPath (Join-Path $temporaryDirectory $name) -Destination (Join-Path $Directory $name) -Force
|
|
}
|
|
} finally {
|
|
Remove-Item -LiteralPath $temporaryDirectory -Recurse -Force
|
|
}
|