Release 3.8.0.2: app.zip updates, lock hygiene, secret-safe getState.

2026-07-29 22:00:39 +03:00
parent 54b5b87990
commit 6a7480dceb
31 changed files with 2058 additions and 1537 deletions
@@ -3,6 +3,11 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."

+# Prefer local toolchain if present.
+export PATH="$(pwd)/.tools/go/bin:/tmp/go-sdk/go/bin:/usr/local/go/bin:$PATH"
+
+python3 scripts/sync-version.py
+
 VERSION="$(python3 - <<'PY'
 import re
 from pathlib import Path
@@ -26,7 +31,6 @@ OUT="dist/navis-release/darwin-arm64"
 mkdir -p "$OUT"
 LDFLAGS="-s -w"

-export PATH="/tmp/go-sdk/go/bin:/usr/local/go/bin:$PATH"
 CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
  go build -ldflags="$LDFLAGS" -trimpath -o "$OUT/Navis" ./cmd/vpnapp
 CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
@@ -35,18 +39,14 @@ CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
 printf '%s\n' "$FULL" > "$OUT/VERSION"
 printf '%s\n' "${VERSION}+${BUILD}" > "$OUT/Navis.version"

+# Ad-hoc sign CLI/bin; packmac also signs the .app (honors NAVIS_CODESIGN_IDENTITY).
 if command -v codesign >/dev/null 2>&1; then
-  codesign -s - --force "$OUT/Navis"
-  codesign -s - --force "$OUT/Navis-cli"
+  ID="${NAVIS_CODESIGN_IDENTITY:--}"
+  codesign -s "$ID" --force "$OUT/Navis" || codesign -s - --force "$OUT/Navis"
+  codesign -s "$ID" --force "$OUT/Navis-cli" || codesign -s - --force "$OUT/Navis-cli"
 fi

-go build -o tools/packmac/packmac ./tools/packmac
-tools/packmac/packmac \
-  -bin "$OUT/Navis" \
-  -out "$OUT" \
-  -version "$VERSION" \
-  -build "$FULL" \
-  -arch arm64
+go run ./tools/packmac -bin "$OUT/Navis" -out "$OUT" -version "$VERSION" -build "$FULL" -arch arm64

 cp -f "$OUT/Navis.dmg" "$OUT/Navis-${FULL}-arm64.dmg"
 cp -f "$OUT/Navis.app.zip" "$OUT/Navis-${FULL}-arm64.app.zip"
@@ -57,10 +57,23 @@ from pathlib import Path
 ver = "${VERSION}"
 build = "${BUILD}"
 full = "${FULL}"
-binp = Path('dist/navis-release/darwin-arm64/Navis')
+out = Path('dist/navis-release/darwin-arm64')
+binp = out / 'Navis'
+zipp = out / 'Navis.app.zip'
+dmgp = out / 'Navis.dmg'
 h = hashlib.sha256(binp.read_bytes()).hexdigest()
-notes = f"Navis {ver}+{build}: единый apphost (Win/macOS); lifecycle Connect/Disconnect; SHA cores; Config snapshot."
-for p in [Path('dist/update.json'), Path('dist/navis-release/update.json')]:
+zh = hashlib.sha256(zipp.read_bytes()).hexdigest() if zipp.exists() else ""
+dh = hashlib.sha256(dmgp.read_bytes()).hexdigest() if dmgp.exists() else ""
+notes = (
+    f"Navis {ver}+{build}: Mac .app zip update; EnsureCore lock; "
+    f"getState без секретов; подпись/notarize pipeline; UI split."
+)
+paths = [
+    Path('dist/update.json'),
+    Path('dist/navis-release/update.json'),
+    Path('server/update.json'),
+]
+for p in paths:
    if not p.exists():
        continue
    d = json.loads(p.read_text())
@@ -69,8 +82,20 @@ for p in [Path('dist/update.json'), Path('dist/navis-release/update.json')]:
    plats = d.setdefault('platforms', {})
    if 'darwin-arm64' in plats:
        plats['darwin-arm64']['sha256'] = h
+        if zh:
+            plats['darwin-arm64']['zip_sha256'] = zh
+        if dh:
+            plats['darwin-arm64']['dmg_sha256'] = dh
+        plats['darwin-arm64'].setdefault(
+            'zip_url',
+            'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release/darwin-arm64/Navis.app.zip',
+        )
+        plats['darwin-arm64'].setdefault(
+            'dmg_url',
+            'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release/darwin-arm64/Navis.dmg',
+        )
    p.write_text(json.dumps(d, ensure_ascii=False, indent=2) + '\n')
-    print('updated', p, '->', ver, 'sha', h[:12])
+    print('updated', p, '->', ver, 'bin', h[:12], 'zip', zh[:12] if zh else '-')
 PY

 echo ""
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Optional release signing / notarization for macOS Navis.app / DMG.
+# Requires Apple Developer ID + notarytool credentials in the environment.
+#
+# Usage:
+#   export NAVIS_CODESIGN_IDENTITY="Developer ID Application: Example Ltd (TEAMID)"
+#   export NAVIS_NOTARY_PROFILE="navis-notary"   # xcrun notarytool store-credentials
+#   ./scripts/sign-macos.sh dist/navis-release/darwin-arm64/Navis.dmg
+#   # or a staged .app:
+#   ./scripts/sign-macos.sh /path/to/Navis.app
+set -euo pipefail
+
+TARGET="${1:-}"
+if [[ -z "$TARGET" || ! -e "$TARGET" ]]; then
+  echo "usage: $0 <Navis.app|Navis.dmg>" >&2
+  exit 2
+fi
+
+IDENTITY="${NAVIS_CODESIGN_IDENTITY:-}"
+if [[ -z "$IDENTITY" ]]; then
+  echo "NAVIS_CODESIGN_IDENTITY is required (Developer ID Application: …)" >&2
+  exit 1
+fi
+
+sign_app() {
+  local app="$1"
+  echo "codesign $app as $IDENTITY"
+  codesign -s "$IDENTITY" --force --deep --options runtime --timestamp "$app"
+  codesign --verify --deep --strict "$app"
+}
+
+if [[ "$TARGET" == *.app || -d "$TARGET" ]]; then
+  sign_app "$TARGET"
+  echo "Signed app. Notarize the DMG that contains it via notarytool."
+  exit 0
+fi
+
+if [[ "$TARGET" == *.dmg ]]; then
+  # Sign nested .app if present after attach is awkward; prefer signing .app before packmac.
+  # Here we submit the DMG for notarization when credentials exist.
+  if [[ -n "${NAVIS_NOTARY_PROFILE:-}" ]]; then
+    echo "notarytool submit $TARGET (profile=$NAVIS_NOTARY_PROFILE)"
+    xcrun notarytool submit "$TARGET" --keychain-profile "$NAVIS_NOTARY_PROFILE" --wait
+    xcrun stapler staple "$TARGET"
+    echo "Notarized + stapled: $TARGET"
+  else
+    echo "DMG ready. Set NAVIS_NOTARY_PROFILE and re-run to notarize."
+    echo "Tip: packmac with NAVIS_CODESIGN_IDENTITY set signs the .app before zip/dmg."
+  fi
+  exit 0
+fi
+
+echo "unsupported target: $TARGET" >&2
+exit 2
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Sync versioninfo.json + build-macos.bat from internal/update/update.go constants."""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+UPDATE_GO = ROOT / "internal" / "update" / "update.go"
+VERSIONINFO = ROOT / "versioninfo.json"
+BUILD_BAT = ROOT / "build-macos.bat"
+
+
+def read_consts() -> tuple[str, int]:
+    text = UPDATE_GO.read_text(encoding="utf-8")
+    m = re.search(r'CurrentVersion\s*=\s*"([^"]+)"', text)
+    b = re.search(r"const BuildNumber\s*=\s*(\d+)", text)
+    if not m or not b:
+        raise SystemExit("cannot parse CurrentVersion/BuildNumber from update.go")
+    return m.group(1), int(b.group(1))
+
+
+def main() -> None:
+    ver, build = read_consts()
+    parts = [int(x) for x in ver.split(".")]
+    while len(parts) < 3:
+        parts.append(0)
+    major, minor, patch = parts[0], parts[1], parts[2]
+    full = f"{ver}.{build}"
+
+    data = json.loads(VERSIONINFO.read_text(encoding="utf-8"))
+    data["FixedFileInfo"]["FileVersion"] = {
+        "Major": major,
+        "Minor": minor,
+        "Patch": patch,
+        "Build": build,
+    }
+    data["FixedFileInfo"]["ProductVersion"] = dict(data["FixedFileInfo"]["FileVersion"])
+    data["StringFileInfo"]["FileVersion"] = full
+    data["StringFileInfo"]["ProductVersion"] = full
+    VERSIONINFO.write_text(json.dumps(data, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    print("updated", VERSIONINFO, "->", full)
+
+    bat = BUILD_BAT.read_text(encoding="utf-8")
+    bat2 = re.sub(
+        r'-version\s+\d+\.\d+\.\d+\s+-build\s+\d+\.\d+\.\d+\.\d+',
+        f"-version {ver} -build {full}",
+        bat,
+    )
+    if bat2 != bat:
+        BUILD_BAT.write_text(bat2, encoding="utf-8")
+        print("updated", BUILD_BAT, "->", ver, full)
+    else:
+        print("build-macos.bat already in sync")
+
+
+if __name__ == "__main__":
+    main()