mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-21 18:26:51 +00:00
325 lines
12 KiB
JavaScript
325 lines
12 KiB
JavaScript
import { createHash } from "node:crypto";
|
|
import { escapeRegExp } from "./regexp.mjs";
|
|
|
|
const STABLE_RELEASE_TAG_RE = /^v(?<version>\d{4}\.\d{1,2}\.\d{1,2})(?:-[1-9]\d*)?$/u;
|
|
const STABLE_PACKAGE_VERSION_RE =
|
|
/^(?<year>\d{4})\.(?<month>\d{1,2})\.(?<patch>\d{1,2})(?:-(?<correction>[1-9]\d*))?$/u;
|
|
const MAX_ROLLBACK_DRILL_AGE_MS = 90 * 24 * 60 * 60 * 1000;
|
|
|
|
function parseStableReleaseTagDetails(tag) {
|
|
const match = STABLE_RELEASE_TAG_RE.exec(tag);
|
|
if (!match?.groups?.version) {
|
|
throw new Error(`expected a stable release tag, got ${tag}`);
|
|
}
|
|
return {
|
|
baseVersion: match.groups.version,
|
|
tagVersion: tag.slice(1),
|
|
};
|
|
}
|
|
|
|
function sha256(value) {
|
|
return createHash("sha256").update(value).digest("hex");
|
|
}
|
|
|
|
export function parseStableReleaseTag(tag) {
|
|
return parseStableReleaseTagDetails(tag).baseVersion;
|
|
}
|
|
|
|
function parseStablePackageVersion(version) {
|
|
const match = STABLE_PACKAGE_VERSION_RE.exec(version);
|
|
if (!match?.groups) {
|
|
return null;
|
|
}
|
|
return [
|
|
Number.parseInt(match.groups.year, 10),
|
|
Number.parseInt(match.groups.month, 10),
|
|
Number.parseInt(match.groups.patch, 10),
|
|
Number.parseInt(match.groups.correction ?? "0", 10),
|
|
];
|
|
}
|
|
|
|
function isStableMainVersionAtLeast(mainVersion, shippedVersion) {
|
|
const main = parseStablePackageVersion(mainVersion);
|
|
const shipped = parseStablePackageVersion(shippedVersion);
|
|
if (!main || !shipped) {
|
|
return false;
|
|
}
|
|
for (let index = 0; index < main.length; index += 1) {
|
|
if (main[index] !== shipped[index]) {
|
|
return main[index] > shipped[index];
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
export function extractStableChangelogSection(changelog, version) {
|
|
const heading = new RegExp(`^## ${escapeRegExp(version)}\\n`, "mu").exec(changelog);
|
|
if (!heading || heading.index === undefined) {
|
|
return null;
|
|
}
|
|
|
|
const section = changelog.slice(heading.index);
|
|
const nextHeading = section.slice(heading[0].length).search(/^## /mu);
|
|
return (
|
|
nextHeading === -1 ? section : section.slice(0, heading[0].length + nextHeading)
|
|
).trimEnd();
|
|
}
|
|
|
|
function readVersion(packageJson, label, errors) {
|
|
const value = packageJson?.version;
|
|
if (typeof value !== "string" || value.length === 0) {
|
|
errors.push(`${label} package.json is missing a version.`);
|
|
return "";
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function readReleaseAssets(release) {
|
|
return Array.isArray(release?.assets)
|
|
? release.assets.filter((asset) => asset && typeof asset.name === "string")
|
|
: [];
|
|
}
|
|
|
|
function isCloseoutEvidenceAsset(assetName, tag) {
|
|
const releaseVersion = tag.slice(1);
|
|
return (
|
|
assetName === `openclaw-${releaseVersion}-stable-main-closeout.json` ||
|
|
assetName === `openclaw-${releaseVersion}-stable-main-closeout.json.sha256`
|
|
);
|
|
}
|
|
|
|
function parseRollbackDrillDate(value) {
|
|
if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/u.test(value)) {
|
|
return null;
|
|
}
|
|
|
|
const parsed = new Date(`${value}T00:00:00.000Z`);
|
|
return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value
|
|
? parsed.getTime()
|
|
: null;
|
|
}
|
|
|
|
function verifyRollbackDrill(params, errors) {
|
|
if (!params.rollbackDrillId?.trim()) {
|
|
errors.push("rollback drill id is required.");
|
|
}
|
|
|
|
const drillDateMs = parseRollbackDrillDate(params.rollbackDrillDate);
|
|
if (drillDateMs === null) {
|
|
errors.push(`rollback drill date is invalid: ${params.rollbackDrillDate ?? "<missing>"}.`);
|
|
return;
|
|
}
|
|
|
|
const ageMs = params.nowMs - drillDateMs;
|
|
if (ageMs < 0) {
|
|
errors.push(`rollback drill date is in the future: ${params.rollbackDrillDate}.`);
|
|
} else if (!params.allowStaleRollbackDrill && ageMs > MAX_ROLLBACK_DRILL_AGE_MS) {
|
|
errors.push(
|
|
`rollback drill is older than 90 days: ${params.rollbackDrillDate}. Run the private rollback drill before stable closeout.`,
|
|
);
|
|
}
|
|
}
|
|
|
|
export function verifyStableMainCloseout(params) {
|
|
const { baseVersion, tagVersion } = parseStableReleaseTagDetails(params.tag);
|
|
const errors = [];
|
|
const mainVersion = readVersion(params.mainPackageJson, "main", errors);
|
|
const tagPackageVersion = readVersion(params.tagPackageJson, "release tag", errors);
|
|
const fallbackCorrection = tagVersion !== baseVersion && tagPackageVersion === baseVersion;
|
|
const version = fallbackCorrection ? baseVersion : tagVersion;
|
|
|
|
const fullReleaseValidationRunAttempt = params.fullReleaseValidationRunAttempt ?? "";
|
|
if (!/^[1-9]\d*$/u.test(fullReleaseValidationRunAttempt)) {
|
|
errors.push(
|
|
`full release validation run attempt is invalid: ${fullReleaseValidationRunAttempt || "<missing>"}.`,
|
|
);
|
|
}
|
|
|
|
if (mainVersion && !isStableMainVersionAtLeast(mainVersion, version)) {
|
|
errors.push(
|
|
`main package.json version is ${mainVersion}, expected shipped version ${version} or a later stable OpenClaw CalVer.`,
|
|
);
|
|
}
|
|
if (tagPackageVersion && tagPackageVersion !== version) {
|
|
errors.push(
|
|
`release tag package.json version is ${tagPackageVersion}, expected shipped version ${version}.`,
|
|
);
|
|
}
|
|
|
|
const mainChangelog = extractStableChangelogSection(params.mainChangelog, version);
|
|
const tagChangelog = extractStableChangelogSection(params.tagChangelog, version);
|
|
if (!mainChangelog) {
|
|
errors.push(`main CHANGELOG.md is missing the ## ${version} section.`);
|
|
}
|
|
if (!tagChangelog) {
|
|
errors.push(`release tag CHANGELOG.md is missing the ## ${version} section.`);
|
|
}
|
|
if (mainChangelog && tagChangelog && mainChangelog !== tagChangelog) {
|
|
errors.push(
|
|
`main CHANGELOG.md ## ${version} does not exactly match the shipped release section.`,
|
|
);
|
|
}
|
|
|
|
if (params.release?.tagName !== params.tag) {
|
|
errors.push(
|
|
`GitHub release tag is ${String(params.release?.tagName ?? "<missing>")}, expected ${params.tag}.`,
|
|
);
|
|
}
|
|
if (params.release?.isDraft === true) {
|
|
errors.push(`GitHub release ${params.tag} is still a draft.`);
|
|
}
|
|
if (params.release?.isPrerelease === true) {
|
|
errors.push(`GitHub release ${params.tag} is marked as a prerelease.`);
|
|
}
|
|
|
|
const macAssetVersion = version;
|
|
const expectedMacAssets = [
|
|
`OpenClaw-${macAssetVersion}.zip`,
|
|
`OpenClaw-${macAssetVersion}.dmg`,
|
|
`OpenClaw-${macAssetVersion}.dSYM.zip`,
|
|
];
|
|
const releaseAssets = readReleaseAssets(params.release);
|
|
const assetNames = new Set(releaseAssets.map((asset) => asset.name));
|
|
let releasePublishRecovery = null;
|
|
const missingMacAssets = expectedMacAssets.filter((asset) => !assetNames.has(asset));
|
|
if (missingMacAssets.length > 0) {
|
|
errors.push(
|
|
`GitHub release ${params.tag} is missing required macOS asset(s): ${missingMacAssets.join(", ")}.`,
|
|
);
|
|
} else {
|
|
const macZip = expectedMacAssets[0];
|
|
if (!params.mainAppcast.includes(`/releases/download/${params.tag}/${macZip}`)) {
|
|
errors.push(`main appcast.xml does not point at ${macZip} from ${params.tag}.`);
|
|
}
|
|
}
|
|
|
|
if (params.requireCompletePlatformAssets) {
|
|
const requiredPlatformFamilies = [
|
|
{
|
|
label: "Android",
|
|
prefix: "OpenClaw-Android",
|
|
expected: ["OpenClaw-Android-SHA256SUMS.txt", "OpenClaw-Android.apk"],
|
|
},
|
|
{
|
|
label: "Windows",
|
|
prefix: "OpenClawCompanion-",
|
|
expected: [
|
|
"OpenClawCompanion-SHA256SUMS.txt",
|
|
"OpenClawCompanion-Setup-arm64.exe",
|
|
"OpenClawCompanion-Setup-x64.exe",
|
|
],
|
|
},
|
|
];
|
|
for (const family of requiredPlatformFamilies) {
|
|
const compareNames = (left, right) => left.localeCompare(right);
|
|
const actual = [...assetNames]
|
|
.filter((name) => name.startsWith(family.prefix))
|
|
.toSorted(compareNames);
|
|
const expected = family.expected.toSorted(compareNames);
|
|
if (JSON.stringify(actual) !== JSON.stringify(expected)) {
|
|
errors.push(
|
|
`GitHub release ${params.tag} ${family.label} asset names do not match the recovery contract: expected ${family.expected.join(", ")}; got ${actual.join(", ") || "<none>"}.`,
|
|
);
|
|
}
|
|
const invalidDigests = family.expected.filter((name) => {
|
|
const asset = releaseAssets.find((candidate) => candidate.name === name);
|
|
return !/^sha256:[0-9a-f]{64}$/u.test(asset?.digest ?? "");
|
|
});
|
|
if (invalidDigests.length > 0) {
|
|
errors.push(
|
|
`GitHub release ${params.tag} ${family.label} recovery asset(s) lack GitHub SHA-256 digests: ${invalidDigests.join(", ")}.`,
|
|
);
|
|
}
|
|
}
|
|
|
|
const windowsInstallerNames = [
|
|
"OpenClawCompanion-Setup-arm64.exe",
|
|
"OpenClawCompanion-Setup-x64.exe",
|
|
];
|
|
let trustedWindowsDigests = params.windowsNodeInstallerDigests;
|
|
if (typeof trustedWindowsDigests === "string") {
|
|
try {
|
|
trustedWindowsDigests = JSON.parse(trustedWindowsDigests);
|
|
} catch {
|
|
trustedWindowsDigests = null;
|
|
}
|
|
}
|
|
const trustedDigestNames =
|
|
trustedWindowsDigests &&
|
|
typeof trustedWindowsDigests === "object" &&
|
|
!Array.isArray(trustedWindowsDigests)
|
|
? Object.keys(trustedWindowsDigests).toSorted((left, right) => left.localeCompare(right))
|
|
: [];
|
|
const expectedDigestNames = windowsInstallerNames.toSorted((left, right) =>
|
|
left.localeCompare(right),
|
|
);
|
|
const trustedDigestContractValid =
|
|
JSON.stringify(trustedDigestNames) === JSON.stringify(expectedDigestNames) &&
|
|
windowsInstallerNames.every((name) =>
|
|
/^sha256:[0-9a-f]{64}$/u.test(trustedWindowsDigests?.[name] ?? ""),
|
|
);
|
|
if (!trustedDigestContractValid) {
|
|
errors.push(
|
|
"failed-publish recovery is missing the exact candidate-approved Windows installer digests.",
|
|
);
|
|
} else {
|
|
const mismatchedWindowsAssets = windowsInstallerNames.filter((name) => {
|
|
const asset = releaseAssets.find((candidate) => candidate.name === name);
|
|
return asset?.digest !== trustedWindowsDigests[name];
|
|
});
|
|
if (mismatchedWindowsAssets.length > 0) {
|
|
errors.push(
|
|
`GitHub release ${params.tag} Windows recovery asset(s) do not match candidate-approved digests: ${mismatchedWindowsAssets.join(", ")}.`,
|
|
);
|
|
}
|
|
}
|
|
if (!/^[1-9]\d*$/u.test(params.windowsNodeReleaseRunId ?? "")) {
|
|
errors.push("failed-publish recovery is missing a trusted Windows Node Release run id.");
|
|
}
|
|
if (trustedDigestContractValid && /^[1-9]\d*$/u.test(params.windowsNodeReleaseRunId ?? "")) {
|
|
releasePublishRecovery = {
|
|
completePlatformAssetsRequired: true,
|
|
windowsNodeReleaseRunId: params.windowsNodeReleaseRunId,
|
|
windowsNodeInstallerDigests: Object.fromEntries(
|
|
windowsInstallerNames.map((name) => [name, trustedWindowsDigests[name]]),
|
|
),
|
|
};
|
|
}
|
|
}
|
|
|
|
verifyRollbackDrill(params, errors);
|
|
|
|
if (errors.length > 0) {
|
|
return { errors, manifest: null };
|
|
}
|
|
|
|
return {
|
|
errors,
|
|
manifest: {
|
|
version: 2,
|
|
releaseTag: params.tag,
|
|
releaseVersion: version,
|
|
releaseTagSha: params.releaseTagSha,
|
|
mainSha: params.mainSha,
|
|
mainPackageVersion: mainVersion,
|
|
releaseTagPackageVersion: tagPackageVersion,
|
|
changelogSha256: sha256(mainChangelog),
|
|
appcastSha256: sha256(params.mainAppcast),
|
|
fullReleaseValidationRunId: params.fullReleaseValidationRunId,
|
|
fullReleaseValidationRunAttempt,
|
|
releasePublishRunId: params.releasePublishRunId,
|
|
...(releasePublishRecovery ? { releasePublishRecovery } : {}),
|
|
rollbackDrill: {
|
|
id: params.rollbackDrillId,
|
|
date: params.rollbackDrillDate,
|
|
},
|
|
githubReleaseAssets: releaseAssets
|
|
.filter((asset) => !isCloseoutEvidenceAsset(asset.name, params.tag))
|
|
.map((asset) => ({
|
|
name: asset.name,
|
|
digest: typeof asset.digest === "string" ? asset.digest : null,
|
|
})),
|
|
},
|
|
};
|
|
}
|