feat(updater): custom Gitea releases provider with fail-closed verification
Wails ships no Gitea provider, so add updater/gitea (~250 lines): latest non-draft release newer than current wins, pre-releases skipped unless AllowPrerelease, exact AniTrack-linux-amd64 asset match, .sha512/.sig sidecars parsed into updater.Verification (sha512+ed25519ph, mirroring wails3 updater sign). Anything missing or malformed is an error, never an unsigned install. Includes semver compare, streaming download with progress, and unit tests (picking rules, fail-closed sidecars, server errors, progress) plus an opt-in live probe (ANITRACK_LIVE_TEST=1) proven against the real instance. Also: embed updater.pub (public half; private key lives in password manager + UPDATER_SIGNING_KEY CI secret, updater.key gitignored) and ignore CI-side updater-dist/ staging.
This commit is contained in:
John O'Keefe
@@ -0,0 +1,291 @@
|
||||
package gitea
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/sha512"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/wailsapp/wails/v3/pkg/updater"
|
||||
)
|
||||
|
||||
func TestCompareSemver(t *testing.T) {
|
||||
cases := []struct {
|
||||
a, b string
|
||||
want int
|
||||
}{
|
||||
{"1.99.0", "1.6.8", 1},
|
||||
{"1.6.8", "1.99.0", -1},
|
||||
{"1.99.0", "1.99.0", 0},
|
||||
{"v1.99.0", "1.99.0", 0},
|
||||
{"2.0.0", "1.99.9", 1},
|
||||
{"1.99.0-rc1", "1.99.0", -1},
|
||||
{"1.99.0", "1.99.0-rc1", 1},
|
||||
{"1.99.0-rc1", "1.99.0-rc2", -1},
|
||||
{"1.10.0", "1.9.0", 1}, // numeric, not lexicographic
|
||||
{"garbage", "1.0.0", -1},
|
||||
{"1.0.0", "garbage", 1},
|
||||
{"", "", 0},
|
||||
}
|
||||
for _, c := range cases {
|
||||
if got := compareSemver(c.a, c.b); got != c.want {
|
||||
t.Errorf("compareSemver(%q, %q) = %d, want %d", c.a, c.b, got, c.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const testAsset = "AniTrack-linux-amd64"
|
||||
const testData = "artifact-bytes"
|
||||
|
||||
type releaseSpec struct {
|
||||
tag string
|
||||
draft bool
|
||||
prerelease bool
|
||||
withAsset bool
|
||||
withSidecar bool
|
||||
}
|
||||
|
||||
// buildServer serves a canned releases index. Every spec with withAsset gets
|
||||
// the test artifact; sidecars (.sha512/.sig, correctly formed) are served
|
||||
// only if at least one spec sets withSidecar.
|
||||
func buildServer(t *testing.T, specs []releaseSpec) *httptest.Server {
|
||||
t.Helper()
|
||||
_, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
data := []byte(testData)
|
||||
sum := sha512.Sum512(data)
|
||||
sha := hex.EncodeToString(sum[:]) + " " + testAsset + "\n"
|
||||
sig := base64.StdEncoding.EncodeToString(ed25519.Sign(priv, sum[:])) + "\n"
|
||||
serveSidecars := false
|
||||
for _, s := range specs {
|
||||
if s.withSidecar {
|
||||
serveSidecars = true
|
||||
}
|
||||
}
|
||||
var srv *httptest.Server
|
||||
srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch {
|
||||
case strings.HasSuffix(r.URL.Path, "/releases"):
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
var b strings.Builder
|
||||
b.WriteString("[")
|
||||
for i, s := range specs {
|
||||
assets := ""
|
||||
if s.withAsset {
|
||||
assets = fmt.Sprintf(`{"name":%q,"size":%d,"browser_download_url":%q}`,
|
||||
testAsset, len(data), srv.URL+"/dl/"+testAsset)
|
||||
}
|
||||
if i > 0 {
|
||||
b.WriteString(",")
|
||||
}
|
||||
fmt.Fprintf(&b, `{"tag_name":%q,"name":%q,"body":"notes","draft":%v,"prerelease":%v,"published_at":"2026-09-16T00:00:00Z","assets":[%s]}`,
|
||||
s.tag, s.tag, s.draft, s.prerelease, assets)
|
||||
}
|
||||
b.WriteString("]")
|
||||
fmt.Fprint(w, b.String())
|
||||
case serveSidecars && r.URL.Path == "/dl/"+testAsset+".sha512":
|
||||
fmt.Fprint(w, sha)
|
||||
case serveSidecars && r.URL.Path == "/dl/"+testAsset+".sig":
|
||||
fmt.Fprint(w, sig)
|
||||
case serveSidecars && r.URL.Path == "/dl/"+testAsset:
|
||||
w.Write(data)
|
||||
default:
|
||||
http.NotFound(w, r)
|
||||
}
|
||||
}))
|
||||
return srv
|
||||
}
|
||||
|
||||
func testProvider(srv *httptest.Server, allowPre bool) *Provider {
|
||||
p, err := New(Config{
|
||||
BaseURL: srv.URL,
|
||||
Owner: "o",
|
||||
Repo: "r",
|
||||
AssetName: testAsset,
|
||||
AllowPrerelease: allowPre,
|
||||
})
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
func TestCheckFindsNewest(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{
|
||||
{tag: "1.6.8", withAsset: true, withSidecar: true},
|
||||
{tag: "1.99.0", withAsset: true, withSidecar: true},
|
||||
})
|
||||
defer srv.Close()
|
||||
rel, err := testProvider(srv, false).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.6.8"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if rel == nil {
|
||||
t.Fatal("expected a release, got up-to-date")
|
||||
}
|
||||
if rel.Version != "1.99.0" {
|
||||
t.Errorf("version = %q, want 1.99.0", rel.Version)
|
||||
}
|
||||
if rel.Verification == nil || rel.Verification.DigestAlgo != "sha512" || rel.Verification.SignatureAlgo != "ed25519ph" {
|
||||
t.Errorf("verification not populated: %+v", rel.Verification)
|
||||
}
|
||||
if len(rel.Verification.Digest) != 64 || len(rel.Verification.Signature) == 0 {
|
||||
t.Errorf("verification malformed: %+v", rel.Verification)
|
||||
}
|
||||
if rel.Notes != "notes" {
|
||||
t.Errorf("notes = %q", rel.Notes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckUpToDate(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{{tag: "1.99.0", withAsset: true, withSidecar: true}})
|
||||
defer srv.Close()
|
||||
rel, err := testProvider(srv, false).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.99.0"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if rel != nil {
|
||||
t.Errorf("expected up-to-date, got %s", rel.Version)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckSkipsDraftPrereleaseAndMissingAsset(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{
|
||||
{tag: "1.99.2", draft: true, withAsset: true, withSidecar: true},
|
||||
{tag: "1.99.1", prerelease: true, withAsset: true, withSidecar: true},
|
||||
{tag: "1.99.0", withAsset: false},
|
||||
{tag: "1.6.9", withAsset: true, withSidecar: true},
|
||||
})
|
||||
defer srv.Close()
|
||||
rel, err := testProvider(srv, false).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.6.8"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if rel == nil || rel.Version != "1.6.9" {
|
||||
t.Fatalf("version = %v, want 1.6.9 (draft/prerelease/asset-less skipped)", rel)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckAllowPrerelease(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{
|
||||
{tag: "1.99.1-rc1", prerelease: true, withAsset: true, withSidecar: true},
|
||||
})
|
||||
defer srv.Close()
|
||||
rel, err := testProvider(srv, true).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.99.0"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if rel == nil || rel.Version != "1.99.1-rc1" {
|
||||
t.Fatalf("version = %v, want 1.99.1-rc1", rel)
|
||||
}
|
||||
if rel.Channel != "beta" {
|
||||
t.Errorf("channel = %q, want beta", rel.Channel)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckFailsClosedWithoutSidecars(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{{tag: "1.99.0", withAsset: true, withSidecar: false}})
|
||||
defer srv.Close()
|
||||
_, err := testProvider(srv, false).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.6.8"})
|
||||
if err == nil {
|
||||
t.Fatal("expected error for missing sidecars, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckServerError(t *testing.T) {
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, "boom", http.StatusInternalServerError)
|
||||
}))
|
||||
defer srv.Close()
|
||||
_, err := testProvider(srv, false).Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.6.8"})
|
||||
if err == nil {
|
||||
t.Fatal("expected error for 500, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDownloadStreamsWithProgress(t *testing.T) {
|
||||
srv := buildServer(t, []releaseSpec{{tag: "1.99.0", withAsset: true, withSidecar: true}})
|
||||
defer srv.Close()
|
||||
p := testProvider(srv, false)
|
||||
rel, err := p.Check(context.Background(), updater.CheckRequest{CurrentVersion: "1.6.8"})
|
||||
if err != nil || rel == nil {
|
||||
t.Fatalf("check: %v %v", rel, err)
|
||||
}
|
||||
f, err := os.CreateTemp("", "dl")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer os.Remove(f.Name())
|
||||
var calls int
|
||||
var last int64
|
||||
err = p.Download(context.Background(), rel, f, func(written, total int64) {
|
||||
calls++
|
||||
last = written
|
||||
if total != int64(len(testData)) {
|
||||
t.Errorf("total = %d", total)
|
||||
}
|
||||
})
|
||||
f.Close()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if calls == 0 || last != int64(len(testData)) {
|
||||
t.Errorf("progress calls=%d last=%d", calls, last)
|
||||
}
|
||||
got, _ := os.ReadFile(f.Name())
|
||||
if string(got) != testData {
|
||||
t.Errorf("body = %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewValidatesConfig(t *testing.T) {
|
||||
if _, err := New(Config{}); err == nil {
|
||||
t.Error("expected error for empty config")
|
||||
}
|
||||
}
|
||||
|
||||
// TestLiveGiteaCheck hits the real instance. Opt-in only:
|
||||
// ANITRACK_LIVE_TEST=1 go test ./updater/gitea/ -run TestLiveGiteaCheck -v
|
||||
func TestLiveGiteaCheck(t *testing.T) {
|
||||
if os.Getenv("ANITRACK_LIVE_TEST") == "" {
|
||||
t.Skip("set ANITRACK_LIVE_TEST=1 to run")
|
||||
}
|
||||
p, err := New(Config{
|
||||
BaseURL: "https://git.linuxhg.com",
|
||||
Owner: "john-okeefe",
|
||||
Repo: "Anitrack",
|
||||
AssetName: "AniTrack-linux-amd64",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
rel, err := p.Check(context.Background(), updater.CheckRequest{CurrentVersion: "0.0.0"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if rel == nil {
|
||||
// Correct until CI publishes the bare-binary asset: no release
|
||||
// carries AniTrack-linux-amd64 yet, so there is nothing to offer.
|
||||
// This still proves API reachability + response parsing live.
|
||||
t.Log("no matching asset published yet (expected until CI ships AniTrack-linux-amd64)")
|
||||
return
|
||||
}
|
||||
t.Logf("latest=%s notes=%d bytes", rel.Version, len(rel.Notes))
|
||||
var n int64
|
||||
err = p.Download(context.Background(), rel, io.Discard, func(w, _ int64) { n = w })
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Logf("downloaded %d bytes", n)
|
||||
}
|
||||
Reference in New Issue
Block a user