CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

desktop-release add: evidence-linux / evidence-windows files (run, commit, sizes, hashes, scan) and a check that every artifact of a version comes from one commit (--commit against the folder's other evidence); docs: check the downloads against the run before add

Browse source
This commit is contained in:
CRTkafa 2026-10-13 05:08:01 +08:00
parent 0b6c8cd7a0
commit 86cd79dd45
3 changed files with 49 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/desktop-release.md
View file

@ -163,11 +163,16 @@ Then on the Mac:
```sh
bun tools/desktop-release.ts add --out ~/.storebound-releases/desktop/0.1.0 \
--commit <the run's full commit hash> --run <the run's URL> \
storebound_0.1.0_amd64.AppImage storebound_0.1.0_amd64.deb storebound_0.1.0_x64-setup.exe
```
It scans and signs each file, renames the unsigned Windows installer to `-unsigned`, and updates latest.json
(`windows-x86_64`, `linux-x86_64`) and SHA256SUMS. For the scan, install `squashfs` and `sevenzip` from Homebrew.
(`windows-x86_64`, `linux-x86_64`) and SHA256SUMS. It writes `evidence-linux-<version>.json` and
`evidence-windows-<version>.json` (run, commit, sizes, hashes, the scan; they stay local like the macOS one) and
refuses a `--commit` other than the one in the folder's macOS evidence: every artifact of a version comes from one
commit. Before `add`, check the downloads against the run: the Linux artifact carries SHA256SUMS; for the Windows
installer compare with `Get-FileHash` of `C:\storebound-target\release\bundle\nsis\` on the runner. For the scan, install `squashfs` and `sevenzip` from Homebrew.
### Runner setup