146 lines
6.1 KiB
Python
146 lines
6.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate the version and checked-in artifacts for a LinkLog release."""
|
|
|
|
import hashlib
|
|
import json
|
|
import re
|
|
import sys
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
VERSION_FILE = ROOT / 'frontend' / 'version.json'
|
|
SIGNED_DIR = ROOT / 'XPI' / 'signed'
|
|
MANIFEST_PATH = ROOT / 'webextension' / 'manifest.json'
|
|
UPDATES_PATH = ROOT / 'webextension' / 'updates.json'
|
|
ABOUT_TEMPLATE_PATH = ROOT / 'frontend' / 'templates' / 'about.html'
|
|
RAW_BASE_URL = 'https://git.kolkman.org/olaf/Link-Log/raw/branch/main'
|
|
VERSION_RE = re.compile(r'\d+\.\d+\.\d+')
|
|
|
|
|
|
def fail(message: str) -> None:
|
|
raise SystemExit(f'release validation failed: {message}')
|
|
|
|
|
|
def version_key(version: str) -> tuple[int, int, int]:
|
|
return tuple(int(part) for part in version.split('.'))
|
|
|
|
|
|
def find_latest_signed_xpi() -> tuple[str, Path]:
|
|
candidates = []
|
|
for xpi_path in SIGNED_DIR.glob('LinkLog-*.xpi'):
|
|
match = re.fullmatch(r'LinkLog-(\d+\.\d+\.\d+)\.xpi', xpi_path.name)
|
|
if match:
|
|
candidates.append((match.group(1), xpi_path))
|
|
if not candidates:
|
|
fail(f'no signed plugin artifacts found in {SIGNED_DIR.relative_to(ROOT)}')
|
|
return max(candidates, key=lambda candidate: version_key(candidate[0]))
|
|
|
|
|
|
def sha256_digest(xpi_path: Path) -> str:
|
|
digest = hashlib.sha256()
|
|
with xpi_path.open('rb') as xpi_file:
|
|
for block in iter(lambda: xpi_file.read(1024 * 1024), b''):
|
|
digest.update(block)
|
|
return digest.hexdigest()
|
|
|
|
|
|
def validate_self_update(source_manifest: dict, extension_version: str, xpi_path: Path) -> None:
|
|
gecko_settings = source_manifest.get('browser_specific_settings', {}).get('gecko', {})
|
|
addon_id = gecko_settings.get('id')
|
|
strict_min_version = gecko_settings.get('strict_min_version')
|
|
if not addon_id:
|
|
fail('webextension/manifest.json is missing browser_specific_settings.gecko.id')
|
|
|
|
updates_data = json.loads(UPDATES_PATH.read_text())
|
|
addon_entry = updates_data.get('addons', {}).get(addon_id)
|
|
if not addon_entry:
|
|
fail(f'{UPDATES_PATH.relative_to(ROOT)} has no entry for add-on id {addon_id!r}')
|
|
|
|
entry = next((u for u in addon_entry.get('updates', []) if u.get('version') == extension_version), None)
|
|
if entry is None:
|
|
fail(
|
|
f'{UPDATES_PATH.relative_to(ROOT)} has no update entry for version {extension_version!r}; '
|
|
'add one alongside the signed XPI so the self-update mechanism can find it'
|
|
)
|
|
|
|
expected_link = f'{RAW_BASE_URL}/{xpi_path.relative_to(ROOT).as_posix()}'
|
|
if entry.get('update_link') != expected_link:
|
|
fail(
|
|
f'{UPDATES_PATH.relative_to(ROOT)} update_link {entry.get("update_link")!r} does not match '
|
|
f'the expected raw signed XPI URL {expected_link!r}'
|
|
)
|
|
|
|
expected_hash = f'sha256:{sha256_digest(xpi_path)}'
|
|
if entry.get('update_hash') != expected_hash:
|
|
fail(
|
|
f'{UPDATES_PATH.relative_to(ROOT)} update_hash {entry.get("update_hash")!r} does not match '
|
|
f'the SHA-256 hash of {xpi_path.relative_to(ROOT)}'
|
|
)
|
|
|
|
entry_min_version = entry.get('applications', {}).get('gecko', {}).get('strict_min_version')
|
|
if entry_min_version != strict_min_version:
|
|
fail(
|
|
f'{UPDATES_PATH.relative_to(ROOT)} applications.gecko.strict_min_version {entry_min_version!r} '
|
|
f'does not match webextension/manifest.json strict_min_version {strict_min_version!r}'
|
|
)
|
|
|
|
|
|
def validate_about_plugin_link(xpi_path: Path) -> None:
|
|
expected_link = f'{RAW_BASE_URL}/{xpi_path.relative_to(ROOT).as_posix()}'
|
|
if expected_link not in ABOUT_TEMPLATE_PATH.read_text():
|
|
fail(
|
|
f'{ABOUT_TEMPLATE_PATH.relative_to(ROOT)} does not link to the latest signed XPI '
|
|
f'{xpi_path.relative_to(ROOT)}'
|
|
)
|
|
|
|
|
|
def main() -> None:
|
|
version_data = json.loads(VERSION_FILE.read_text())
|
|
backend_version = version_data.get('version')
|
|
if not backend_version:
|
|
fail(f'version could not be found in {VERSION_FILE.relative_to(ROOT)}')
|
|
if not VERSION_RE.fullmatch(backend_version):
|
|
fail(f'backend version {backend_version} is not a valid three-part version')
|
|
|
|
extension_version, xpi_path = find_latest_signed_xpi()
|
|
source_manifest = json.loads(MANIFEST_PATH.read_text())
|
|
if source_manifest.get('version') != extension_version:
|
|
fail(
|
|
f'webextension/manifest.json version {source_manifest.get("version")!r} does not match '
|
|
f'the latest signed XPI version {extension_version!r}'
|
|
)
|
|
with zipfile.ZipFile(xpi_path) as archive:
|
|
try:
|
|
packaged_manifest = json.loads(archive.read('manifest.json'))
|
|
except KeyError:
|
|
fail('signed XPI does not contain manifest.json')
|
|
if packaged_manifest.get('version') != extension_version:
|
|
fail('signed XPI manifest version does not match its filename')
|
|
gecko_settings = packaged_manifest.get('browser_specific_settings', {}).get('gecko', {})
|
|
data_permissions = gecko_settings.get('data_collection_permissions')
|
|
if data_permissions != {'required': ['websiteActivity'], 'optional': []}:
|
|
fail('Firefox data_collection_permissions must require websiteActivity and have no optional categories')
|
|
if archive.testzip() is not None:
|
|
fail('signed XPI contains a corrupt member')
|
|
|
|
validate_self_update(source_manifest, extension_version, xpi_path)
|
|
validate_about_plugin_link(xpi_path)
|
|
|
|
signed_xpi = xpi_path.relative_to(ROOT)
|
|
if len(sys.argv) == 3 and sys.argv[1] == '--github-output':
|
|
with Path(sys.argv[2]).open('a') as output:
|
|
print(f'backend_version={backend_version}', file=output)
|
|
print(f'plugin_version={extension_version}', file=output)
|
|
print(f'signed_xpi={signed_xpi}', file=output)
|
|
elif len(sys.argv) != 1:
|
|
fail('usage: validate_release.py [--github-output <path>]')
|
|
|
|
print(f'validated LinkLog backend release {backend_version}')
|
|
print(f'plugin_version={extension_version}')
|
|
print(f'signed_xpi={signed_xpi}')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |