fix: restart Dever releases at 0.0.1 with complete signed assets

sdk/release-assets.py

@@ -12,11 +12,35 @@ import shutil
 import subprocess
 import tarfile
 import tempfile
+import zipfile
 
 
 MAX_PACKAGE = 2 * 1024**3
 
 
+def verify_complete(manifest, editor):
+    groups = packages(manifest)
+    expected = {f"ext-runtime-{ecosystem}-{target}"
+                for ecosystem in ("pip", "npm", "go")
+                for target in ("linux-x86_64", "linux-aarch64")}
+    expected.update(f"ext-build-{ecosystem}-{manifest['platform']}" for ecosystem in ("pip", "npm"))
+    expected.update(f"ext-target-{target}" for target in ("linux-x86_64", "linux-aarch64")
+                    if target != manifest["platform"])
+    missing = expected - groups.keys()
+    if missing:
+        raise ValueError("complete release is missing: " + ", ".join(sorted(missing)))
+    if editor is None or editor.is_symlink() or editor.stat().st_size > 16 * 1024**2:
+        raise ValueError("complete release requires a bounded editor VSIX")
+    with zipfile.ZipFile(editor) as archive:
+        info = archive.getinfo("extension/package.json")
+        if info.file_size > 64 * 1024:
+            raise ValueError("editor metadata exceeds limit")
+        package = json.loads(archive.read(info))
+        if (package.get("name") != "dever-language" or package.get("publisher") != "shemic"
+                or package.get("version") != manifest["version"]):
+            raise ValueError("editor identity/version does not match the release")
+
+
 def extension_suffix(extension):
     kind = extension["kind"]
     target = extension["target"]
@@ -126,7 +150,7 @@ def compress(release, artifacts, destination, zstd):
             process.stderr.close()
 
 
-def create(release, output, zstd):
+def create(release, output, zstd, complete=True, editor=None):
     release = release.absolute()
     output = output.absolute()
     if release.is_symlink() or not release.is_dir():
@@ -142,6 +166,8 @@ def create(release, output, zstd):
     if len(manifest_bytes) > 2 * 1024**2:
         raise ValueError("release metadata exceeds limit")
     manifest = json.loads(manifest_bytes)
+    if complete:
+        verify_complete(manifest, editor)
     groups = packages(manifest)
     verify_artifacts(release, groups)
     with tempfile.TemporaryDirectory(prefix=".dever-release-assets-", dir=output.parent) as scratch:
@@ -158,6 +184,8 @@ def create(release, output, zstd):
                 blob = prepared / f"{stem}.blob-{artifact['sha256']}"
                 if not blob.exists():
                     shutil.copyfile(release / artifact["path"], blob)
+        if complete:
+            shutil.copyfile(editor, prepared / f"dever-language-{manifest['version']}.vsix")
         publish(prepared, output)
     return sorted(path.name for path in output.iterdir())
 
@@ -179,11 +207,15 @@ def main():
     parser.add_argument("release", type=Path)
     parser.add_argument("--output", required=True, type=Path)
     parser.add_argument("--zstd", required=True, type=Path, help="explicit author-side zstd executable")
+    parser.add_argument("--partial-test-fixture", action="store_true", help="allow incomplete private test fixtures, not public releases")
+    parser.add_argument("--editor-vsix", type=Path, help="matching editor package required for public releases")
     args = parser.parse_args()
+    if args.partial_test_fixture and args.editor_vsix:
+        parser.error("partial test fixtures must not include a public editor package")
     try:
-        for name in create(args.release, args.output, args.zstd):
+        for name in create(args.release, args.output, args.zstd, not args.partial_test_fixture, args.editor_vsix):
             print(name)
-    except (OSError, ValueError, KeyError, TypeError, tarfile.TarError) as error:
+    except (OSError, ValueError, KeyError, TypeError, tarfile.TarError, zipfile.BadZipFile) as error:
         parser.exit(1, f"cannot prepare release assets: {error}\n")