#!/bin/bash
|
# Verify a packaged Aligner release directory before it can be referenced by a
|
# release manifest or uploaded as a direct-download artifact.
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
OUTPUT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
SOURCE_ROOT="$OUTPUT_ROOT/C1.source"
|
INFO_PLIST="$SOURCE_ROOT/Resources/Aligner-Info.plist"
|
|
fail() {
|
echo "verify-release-artifact.sh failed: $*" >&2
|
exit 1
|
}
|
|
usage() {
|
echo "Usage: 03-O/C3.tools/verify-release-artifact.sh <release-dir>" >&2
|
}
|
|
RELEASE_DIR="${1:-}"
|
[ -n "$RELEASE_DIR" ] || { usage; exit 2; }
|
[ -d "$RELEASE_DIR" ] || fail "release dir does not exist: $RELEASE_DIR"
|
|
VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$INFO_PLIST" 2>/dev/null)" \
|
|| fail "unable to read CFBundleShortVersionString"
|
BUILD="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$INFO_PLIST" 2>/dev/null)" \
|
|| fail "unable to read CFBundleVersion"
|
EXPECTED_DMG="Aligner-${VERSION}-build${BUILD}.dmg"
|
DMG="$RELEASE_DIR/$EXPECTED_DMG"
|
SUMS="$RELEASE_DIR/SHA256SUMS.txt"
|
|
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
|
|| fail "version must be MAJOR.MINOR.PATCH, got: $VERSION"
|
[[ "$BUILD" =~ ^[0-9]{8}\.[0-9]{4}$ ]] \
|
|| fail "build must be YYYYMMDD.HHMM, got: $BUILD"
|
[ -f "$DMG" ] || fail "missing expected DMG: $DMG"
|
[ -f "$SUMS" ] || fail "missing SHA256SUMS.txt: $SUMS"
|
|
EXPECTED_SHA="$(awk -v name="$EXPECTED_DMG" '$2 == name { print $1 }' "$SUMS")"
|
[ -n "$EXPECTED_SHA" ] || fail "SHA256SUMS.txt does not contain $EXPECTED_DMG"
|
ACTUAL_SHA="$(shasum -a 256 "$DMG" | awk '{ print $1 }')"
|
[ "$EXPECTED_SHA" = "$ACTUAL_SHA" ] || fail "SHA256 mismatch for $EXPECTED_DMG"
|
|
if codesign -dv "$DMG" >/tmp/aligner-dmg-codesign.$$ 2>&1; then
|
if ! rg -q "Developer ID Application" /tmp/aligner-dmg-codesign.$$; then
|
rm -f /tmp/aligner-dmg-codesign.$$
|
fail "DMG signature is not Developer ID Application"
|
fi
|
else
|
rm -f /tmp/aligner-dmg-codesign.$$
|
fail "DMG is not signed; formal release artifacts must be Developer ID signed"
|
fi
|
rm -f /tmp/aligner-dmg-codesign.$$
|
|
echo "Release artifact verified: $DMG"
|
