fix(recovery): resolve metadata MAC desync after recovery (R-NEW-1) & complete release workflow (CI-01)
- R-NEW-1: Recalculate metadata HMAC upon recovery-key restore and mark backup restores as PendingRebuild to rebuild transparently on first mount - CI-01: Update release.yaml to compile both Windows x86_64 and Linux musl with pinned Zig 0.16.0 and cargo-zigbuild 0.23.4 - W-1: Implement statvfs quota determination on Unix via libc - Add RELEASE_PROCESS.md documenting release architecture and steps - Bump version to 0.9.2 across manifests, lockfile, docs, Scoop and WinGet
This commit is contained in:
@@ -8,7 +8,7 @@ on:
|
||||
jobs:
|
||||
# SA-02 & SA-04: Entkoppelte Build- & Test-Umgebung ohne Zugriff auf Signatur-Secrets
|
||||
build:
|
||||
name: Build & Test (Windows x86_64)
|
||||
name: Build & Test (Windows x86_64 & Linux musl)
|
||||
runs-on: windows-latest
|
||||
steps:
|
||||
- name: Checkout Code
|
||||
@@ -18,39 +18,101 @@ jobs:
|
||||
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master commit pinned
|
||||
with:
|
||||
toolchain: "1.85.0"
|
||||
targets: x86_64-pc-windows-msvc
|
||||
targets: x86_64-pc-windows-msvc,x86_64-unknown-linux-musl
|
||||
|
||||
- name: Install cargo-zigbuild (pinned)
|
||||
run: cargo install cargo-zigbuild --locked --version 0.23.4
|
||||
|
||||
- name: Install Zig (pinned, hash-verified)
|
||||
shell: pwsh
|
||||
run: |
|
||||
$ZigVersion = "0.16.0"
|
||||
$ZigUrl = "https://ziglang.org/download/$ZigVersion/zig-windows-x86_64-$ZigVersion.zip"
|
||||
$ExpectedZigHash = "68659eb5f1e4eb1437a722f1dd889c5a322c9954607f5edcf337bc3684a75a7e"
|
||||
Invoke-WebRequest -Uri $ZigUrl -OutFile "zig.zip"
|
||||
$ActualHash = (Get-FileHash -Path "zig.zip" -Algorithm SHA256).Hash.ToLower()
|
||||
if ($ActualHash -ne $ExpectedZigHash) {
|
||||
Write-Error "KRITISCHER SICHERHEITSFEHLER: Zig SHA-256 Pruefsumme ungueltig! Erwartet: $ExpectedZigHash, Erhalten: $ActualHash"
|
||||
exit 1
|
||||
}
|
||||
Expand-Archive -Path "zig.zip" -DestinationPath "zig-bin"
|
||||
echo "$PWD/zig-bin/zig-windows-x86_64-$ZigVersion" >> $env:GITHUB_PATH
|
||||
|
||||
- name: Run Tests
|
||||
run: cargo test --all --verbose
|
||||
|
||||
- name: Build Release Binary
|
||||
- name: Build Windows Release Binary
|
||||
run: cargo build --release
|
||||
|
||||
- name: Cross-build Linux musl binary
|
||||
run: cargo-zigbuild zigbuild --target x86_64-unknown-linux-musl --release
|
||||
|
||||
- name: Package Artifacts
|
||||
id: package
|
||||
shell: pwsh
|
||||
run: |
|
||||
$Tag = "${{ gitea.ref_name }}"
|
||||
$DistDir = "dist"
|
||||
$PackageName = "sanctum-${Tag}-windows-x86_64"
|
||||
$StagingDir = "${DistDir}/${PackageName}"
|
||||
$ZipFile = "${DistDir}/${PackageName}.zip"
|
||||
if (-not (Test-Path $DistDir)) { New-Item -ItemType Directory -Path $DistDir -Force | Out-Null }
|
||||
|
||||
New-Item -ItemType Directory -Path $StagingDir -Force | Out-Null
|
||||
Copy-Item "target/release/sanctum.exe" "$StagingDir/"
|
||||
Copy-Item "README.md" "$StagingDir/"
|
||||
Copy-Item "LICENSE" "$StagingDir/"
|
||||
Copy-Item "CHANGELOG.md" "$StagingDir/"
|
||||
# 1. Windows Package
|
||||
$PackageNameWin = "sanctum-${Tag}-windows-x86_64"
|
||||
$StagingDirWin = "${DistDir}/${PackageNameWin}"
|
||||
$ZipFile = "${DistDir}/${PackageNameWin}.zip"
|
||||
|
||||
Compress-Archive -Path "$StagingDir/*" -DestinationPath $ZipFile -Force
|
||||
New-Item -ItemType Directory -Path $StagingDirWin -Force | Out-Null
|
||||
Copy-Item "target/release/sanctum.exe" "$StagingDirWin/"
|
||||
Copy-Item "README.md" "$StagingDirWin/"
|
||||
Copy-Item "LICENSE" "$StagingDirWin/"
|
||||
Copy-Item "CHANGELOG.md" "$StagingDirWin/"
|
||||
Copy-Item "QUICKSTART.md" "$StagingDirWin/"
|
||||
Copy-Item "INSTALL.md" "$StagingDirWin/"
|
||||
Copy-Item "LEGAL.md" "$StagingDirWin/"
|
||||
Copy-Item "THIRD_PARTY_LICENSES.md" "$StagingDirWin/"
|
||||
if (Test-Path "assets") { Copy-Item "assets" "$StagingDirWin/" -Recurse }
|
||||
|
||||
Compress-Archive -Path "$StagingDirWin/*" -DestinationPath $ZipFile -Force
|
||||
Remove-Item $StagingDirWin -Recurse -Force
|
||||
|
||||
# Standalone Windows EXE nach dist/ kopieren
|
||||
Copy-Item "target/release/sanctum.exe" "${DistDir}/sanctum.exe" -Force
|
||||
|
||||
# 2. Linux Package
|
||||
$PackageNameLinux = "sanctum-${Tag}-linux-x86_64"
|
||||
$StagingDirLinux = "${DistDir}/${PackageNameLinux}"
|
||||
$TarGzFile = "${DistDir}/${PackageNameLinux}.tar.gz"
|
||||
|
||||
New-Item -ItemType Directory -Path $StagingDirLinux -Force | Out-Null
|
||||
Copy-Item "target/x86_64-unknown-linux-musl/release/sanctum" "$StagingDirLinux/sanctum"
|
||||
Copy-Item "README.md" "$StagingDirLinux/"
|
||||
Copy-Item "LICENSE" "$StagingDirLinux/"
|
||||
Copy-Item "CHANGELOG.md" "$StagingDirLinux/"
|
||||
Copy-Item "QUICKSTART.md" "$StagingDirLinux/"
|
||||
Copy-Item "INSTALL.md" "$StagingDirLinux/"
|
||||
Copy-Item "LEGAL.md" "$StagingDirLinux/"
|
||||
Copy-Item "THIRD_PARTY_LICENSES.md" "$StagingDirLinux/"
|
||||
|
||||
tar.exe -czf $TarGzFile -C $DistDir $PackageNameLinux
|
||||
Remove-Item $StagingDirLinux -Recurse -Force
|
||||
|
||||
# Standalone Linux ELF nach dist/ kopieren
|
||||
Copy-Item "target/x86_64-unknown-linux-musl/release/sanctum" "${DistDir}/sanctum" -Force
|
||||
|
||||
# 3. SHA-256 Checksums für alle 4 Assets
|
||||
$ZipHash = (Get-FileHash -Path $ZipFile -Algorithm SHA256).Hash.ToLower()
|
||||
$ExeHash = (Get-FileHash -Path "target/release/sanctum.exe" -Algorithm SHA256).Hash.ToLower()
|
||||
|
||||
@("$ZipHash ${PackageName}.zip", "$ExeHash sanctum.exe") | Set-Content -Path "${DistDir}/SHA256SUMS.txt" -Encoding utf8
|
||||
$ExeHash = (Get-FileHash -Path "${DistDir}/sanctum.exe" -Algorithm SHA256).Hash.ToLower()
|
||||
$TarHash = (Get-FileHash -Path $TarGzFile -Algorithm SHA256).Hash.ToLower()
|
||||
$ElfHash = (Get-FileHash -Path "${DistDir}/sanctum" -Algorithm SHA256).Hash.ToLower()
|
||||
|
||||
@(
|
||||
"$ZipHash ${PackageNameWin}.zip",
|
||||
"$ExeHash sanctum.exe",
|
||||
"$TarHash ${PackageNameLinux}.tar.gz",
|
||||
"$ElfHash sanctum"
|
||||
) | Set-Content -Path "${DistDir}/SHA256SUMS.txt" -Encoding utf8
|
||||
|
||||
echo "ZIP_FILE=$ZipFile" >> $env:GITHUB_OUTPUT
|
||||
echo "PACKAGE_NAME=$PackageName" >> $env:GITHUB_OUTPUT
|
||||
echo "PACKAGE_NAME=$PackageNameWin" >> $env:GITHUB_OUTPUT
|
||||
|
||||
- name: Upload Build Artifacts
|
||||
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
|
||||
@@ -103,10 +165,11 @@ jobs:
|
||||
$MinisignExe = "minisign"
|
||||
}
|
||||
|
||||
$Tag = "${{ gitea.ref_name }}"
|
||||
$KeyFile = "sanctum-ci-release.key"
|
||||
[System.IO.File]::WriteAllText($KeyFile, $env:MINISIGN_SECRET_KEY)
|
||||
try {
|
||||
& $MinisignExe -S -s $KeyFile -m "dist/SHA256SUMS.txt" -W -x "dist/SHA256SUMS.txt.minisig"
|
||||
& $MinisignExe -S -s $KeyFile -m "dist/SHA256SUMS.txt" -W -x "dist/SHA256SUMS.txt.minisig" -t "version:$Tag"
|
||||
if ($LASTEXITCODE -ne 0 -or -not (Test-Path "dist/SHA256SUMS.txt.minisig")) {
|
||||
Write-Error "Minisign-Signierung fehlgeschlagen!"
|
||||
exit 1
|
||||
@@ -120,6 +183,9 @@ jobs:
|
||||
with:
|
||||
files: |
|
||||
dist/*.zip
|
||||
dist/*.tar.gz
|
||||
dist/sanctum
|
||||
dist/sanctum.exe
|
||||
dist/SHA256SUMS.txt
|
||||
dist/SHA256SUMS.txt.minisig
|
||||
body_path: CHANGELOG.md
|
||||
|
||||
Reference in New Issue
Block a user