ci: 增加Windows签名RC发布门禁

2026-09-12 02:59:53 +08:00
parent dbab4cba50
commit 46acc18248
3 changed files with 158 additions and 0 deletions
@@ -0,0 +1,42 @@
+$ErrorActionPreference = 'Stop'
+$root = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$bundle = Join-Path $root 'frontend\src-tauri\target\x86_64-pc-windows-msvc\release\bundle\nsis'
+$installers = @(Get-ChildItem -LiteralPath $bundle -Filter '*.exe' -File)
+if ($installers.Count -ne 1) { throw "应恰好生成一个 NSIS 安装包，实际为 $($installers.Count)" }
+$installer = $installers[0]
+if ($installer.Length -gt 300MB) { throw "基础安装包超过 300 MiB：$($installer.Length)" }
+
+$hostExecutable = Join-Path $root 'frontend\src-tauri\target\x86_64-pc-windows-msvc\release\notesagent-desktop.exe'
+if (-not (Test-Path -LiteralPath $hostExecutable -PathType Leaf)) { throw '缺少 MSVC Host 可执行文件' }
+foreach ($path in @($hostExecutable, $installer.FullName)) {
+  $signature = Get-AuthenticodeSignature -LiteralPath $path
+  if ($signature.Status -ne 'Valid') { throw "Authenticode 签名无效：$path ($($signature.Status))" }
+  if ($signature.SignerCertificate.Thumbprint -ne $env:OPENNEXUS_WINDOWS_CERTIFICATE_THUMBPRINT) {
+    throw "签名证书与受控证书不匹配：$path"
+  }
+}
+
+$manifest = Join-Path $root '.build\sidecar\manifest.json'
+$manifestSignature = Join-Path $root '.build\sidecar\manifest.sig'
+$publicKey = Join-Path $root '.build\sidecar\public-key.hex'
+foreach ($path in @($manifest, $manifestSignature, $publicKey)) {
+  if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { throw "缺少 Core 发布文件：$path" }
+}
+if ((Get-Item -LiteralPath $manifestSignature).Length -ne 64) { throw 'Core 清单签名长度必须为 64 字节' }
+if ((Get-Content -LiteralPath $publicKey -Raw).Trim() -notmatch '^[0-9a-f]{64}$') { throw 'Core 发布公钥格式无效' }
+
+$result = [ordered]@{
+  schema = 1
+  product = 'OpenNexus'
+  target = 'x86_64-pc-windows-msvc'
+  installer_bytes = $installer.Length
+  certificate_thumbprint = $env:OPENNEXUS_WINDOWS_CERTIFICATE_THUMBPRINT
+  files = [ordered]@{}
+}
+foreach ($path in @($installer.FullName, $hostExecutable, $manifest, $manifestSignature, $publicKey)) {
+  $relative = [IO.Path]::GetRelativePath($root, $path).Replace('\', '/')
+  $result.files[$relative] = (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+$output = Join-Path $root '.build\windows-rc-sha256.json'
+[IO.File]::WriteAllText($output, ($result | ConvertTo-Json -Depth 5), [Text.UTF8Encoding]::new($false))
+Write-Host "Windows RC 校验通过：$($installer.Name)，$([math]::Round($installer.Length / 1MB, 2)) MiB"