From 04f8cc80c798fe3f3eb9690721da7cd476d4890f Mon Sep 17 00:00:00 2001 From: Christian Kolset Date: Tue, 11 Aug 2026 11:34:26 -0600 Subject: Restructure release infra for multiple platforms; migrate real win keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PyInstaller doesn't cross-compile and TUF metadata filenames aren't platform-prefixed, so a shared updates/ release and repo tree can't safely hold more than one OS's build — a second platform's publish would silently overwrite the first's trust root and metadata. - scripts/release/repo_init.py, repo_release.py: auto-detect platform (win/mac/linux) and operate inside scripts/release// instead of a flat scripts/release/ tree. - labui.spec: bundles root.json from this platform's own tree. - core/updater.py: points at releases/download/updates-/ instead of a single shared updates/ tag. - Moved the existing real keystore/repository/config (already used for a live Windows release) from the old flat path into scripts/release/win/ — same keys, same signed metadata, just relocated. No new keys generated, existing installs still trust it. - .gitignore updated for the per-platform paths, plus temporary rules covering the old flat path during migration. - docs/building.md, scripts/release/README.md: rewritten for the per-platform flow, including a note that Linux builds should happen on Linux/WSL2 (no cross-compiling) and that a bare .exe doesn't belong on the updates- release — only the TUF metadata + signed target archive do. Co-Authored-By: Claude Sonnet 5 --- scripts/release/.tufup-repo-config | 34 ----------- scripts/release/repository/metadata/1.root.json | 71 ---------------------- scripts/release/repository/metadata/root.json | 71 ---------------------- scripts/release/repository/metadata/snapshot.json | 19 ------ scripts/release/repository/metadata/targets.json | 15 ----- scripts/release/repository/metadata/timestamp.json | 19 ------ .../release/win/repository/metadata/1.root.json | 71 ++++++++++++++++++++++ scripts/release/win/repository/metadata/root.json | 71 ++++++++++++++++++++++ .../release/win/repository/metadata/snapshot.json | 19 ++++++ .../release/win/repository/metadata/targets.json | 15 +++++ .../release/win/repository/metadata/timestamp.json | 19 ++++++ 11 files changed, 195 insertions(+), 229 deletions(-) delete mode 100644 scripts/release/.tufup-repo-config delete mode 100755 scripts/release/repository/metadata/1.root.json delete mode 100755 scripts/release/repository/metadata/root.json delete mode 100755 scripts/release/repository/metadata/snapshot.json delete mode 100755 scripts/release/repository/metadata/targets.json delete mode 100755 scripts/release/repository/metadata/timestamp.json create mode 100755 scripts/release/win/repository/metadata/1.root.json create mode 100755 scripts/release/win/repository/metadata/root.json create mode 100755 scripts/release/win/repository/metadata/snapshot.json create mode 100755 scripts/release/win/repository/metadata/targets.json create mode 100755 scripts/release/win/repository/metadata/timestamp.json (limited to 'scripts') diff --git a/scripts/release/.tufup-repo-config b/scripts/release/.tufup-repo-config deleted file mode 100644 index e072c2a..0000000 --- a/scripts/release/.tufup-repo-config +++ /dev/null @@ -1,34 +0,0 @@ -{ - "app_name": "labui", - "app_version_attr": null, - "binary_diff": null, - "encrypted_keys": [], - "expiration_days": { - "root": 365, - "snapshot": 90, - "targets": 90, - "timestamp": 90 - }, - "key_map": { - "root": [ - "root" - ], - "snapshot": [ - "snapshot" - ], - "targets": [ - "targets" - ], - "timestamp": [ - "timestamp" - ] - }, - "keys_dir": "keystore", - "repo_dir": "repository", - "thresholds": { - "root": 1, - "snapshot": 1, - "targets": 1, - "timestamp": 1 - } -} \ No newline at end of file diff --git a/scripts/release/repository/metadata/1.root.json b/scripts/release/repository/metadata/1.root.json deleted file mode 100755 index 343b2e2..0000000 --- a/scripts/release/repository/metadata/1.root.json +++ /dev/null @@ -1,71 +0,0 @@ -{ - "signatures": [ - { - "keyid": "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed", - "sig": "cb0c1b0078781b4b87a181deaa03122a7e1f08dd39fab4eac842acd43397e0c5b268009825fa942e86b368b4edd651e69967182981e8be746a60566b42d36109" - } - ], - "signed": { - "_type": "root", - "consistent_snapshot": false, - "expires": "2027-08-01T23:55:23Z", - "keys": { - "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed": { - "keytype": "ed25519", - "keyval": { - "public": "be8f719618189eb74b524ee92e85eea99a5228fafc7257356b5d8acad2829b24" - }, - "scheme": "ed25519" - }, - "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc": { - "keytype": "ed25519", - "keyval": { - "public": "cbde8cdde12b19b39a786da7128214d01e0f4415e590df34768530fad2bf4702" - }, - "scheme": "ed25519" - }, - "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42": { - "keytype": "ed25519", - "keyval": { - "public": "1559cdea5a3295593d4c08e6ee625561f7cd96a1dcc0d553b9961734491b801a" - }, - "scheme": "ed25519" - }, - "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6": { - "keytype": "ed25519", - "keyval": { - "public": "6ac7a3b9d83f0d1835ea6fdc0307fe340ea422bc15763fdc0bc197383a61d79b" - }, - "scheme": "ed25519" - } - }, - "roles": { - "root": { - "keyids": [ - "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed" - ], - "threshold": 1 - }, - "snapshot": { - "keyids": [ - "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc" - ], - "threshold": 1 - }, - "targets": { - "keyids": [ - "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6" - ], - "threshold": 1 - }, - "timestamp": { - "keyids": [ - "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42" - ], - "threshold": 1 - } - }, - "spec_version": "1.0.31", - "version": 1 - } -} \ No newline at end of file diff --git a/scripts/release/repository/metadata/root.json b/scripts/release/repository/metadata/root.json deleted file mode 100755 index 343b2e2..0000000 --- a/scripts/release/repository/metadata/root.json +++ /dev/null @@ -1,71 +0,0 @@ -{ - "signatures": [ - { - "keyid": "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed", - "sig": "cb0c1b0078781b4b87a181deaa03122a7e1f08dd39fab4eac842acd43397e0c5b268009825fa942e86b368b4edd651e69967182981e8be746a60566b42d36109" - } - ], - "signed": { - "_type": "root", - "consistent_snapshot": false, - "expires": "2027-08-01T23:55:23Z", - "keys": { - "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed": { - "keytype": "ed25519", - "keyval": { - "public": "be8f719618189eb74b524ee92e85eea99a5228fafc7257356b5d8acad2829b24" - }, - "scheme": "ed25519" - }, - "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc": { - "keytype": "ed25519", - "keyval": { - "public": "cbde8cdde12b19b39a786da7128214d01e0f4415e590df34768530fad2bf4702" - }, - "scheme": "ed25519" - }, - "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42": { - "keytype": "ed25519", - "keyval": { - "public": "1559cdea5a3295593d4c08e6ee625561f7cd96a1dcc0d553b9961734491b801a" - }, - "scheme": "ed25519" - }, - "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6": { - "keytype": "ed25519", - "keyval": { - "public": "6ac7a3b9d83f0d1835ea6fdc0307fe340ea422bc15763fdc0bc197383a61d79b" - }, - "scheme": "ed25519" - } - }, - "roles": { - "root": { - "keyids": [ - "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed" - ], - "threshold": 1 - }, - "snapshot": { - "keyids": [ - "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc" - ], - "threshold": 1 - }, - "targets": { - "keyids": [ - "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6" - ], - "threshold": 1 - }, - "timestamp": { - "keyids": [ - "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42" - ], - "threshold": 1 - } - }, - "spec_version": "1.0.31", - "version": 1 - } -} \ No newline at end of file diff --git a/scripts/release/repository/metadata/snapshot.json b/scripts/release/repository/metadata/snapshot.json deleted file mode 100755 index 03821d1..0000000 --- a/scripts/release/repository/metadata/snapshot.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "signatures": [ - { - "keyid": "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc", - "sig": "bd89d38c63ddee6537276a13657a2716a1a88346421a8d51db9fa8c12b9dc6b0db57a48bbab616930b6aaaa91c4a12a54909cd9722e07b23632638d68bd08307" - } - ], - "signed": { - "_type": "snapshot", - "expires": "2026-10-30T23:55:23Z", - "meta": { - "targets.json": { - "version": 1 - } - }, - "spec_version": "1.0.31", - "version": 1 - } -} \ No newline at end of file diff --git a/scripts/release/repository/metadata/targets.json b/scripts/release/repository/metadata/targets.json deleted file mode 100755 index 6296ebe..0000000 --- a/scripts/release/repository/metadata/targets.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "signatures": [ - { - "keyid": "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6", - "sig": "88ebf0eac3bea958b3d5d99e713a2af1a8e6d230c414bca1b22f1bf64ce2a8734b3db5eaa80dcc9fdd31c1954864af2828c122bf6d4354b1a06136e478e6d00d" - } - ], - "signed": { - "_type": "targets", - "expires": "2026-10-30T23:55:23Z", - "spec_version": "1.0.31", - "targets": {}, - "version": 1 - } -} \ No newline at end of file diff --git a/scripts/release/repository/metadata/timestamp.json b/scripts/release/repository/metadata/timestamp.json deleted file mode 100755 index 12227b6..0000000 --- a/scripts/release/repository/metadata/timestamp.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "signatures": [ - { - "keyid": "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42", - "sig": "b11ee59ed85d21b52d25e676a98232c9d63813ac5236493c11d47264065647933f1c28bc9748f8c880174a3ab3bcb27f6786c1c4a596ef80b70fc11b40f9f002" - } - ], - "signed": { - "_type": "timestamp", - "expires": "2026-10-30T23:55:23Z", - "meta": { - "snapshot.json": { - "version": 1 - } - }, - "spec_version": "1.0.31", - "version": 1 - } -} \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/1.root.json b/scripts/release/win/repository/metadata/1.root.json new file mode 100755 index 0000000..343b2e2 --- /dev/null +++ b/scripts/release/win/repository/metadata/1.root.json @@ -0,0 +1,71 @@ +{ + "signatures": [ + { + "keyid": "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed", + "sig": "cb0c1b0078781b4b87a181deaa03122a7e1f08dd39fab4eac842acd43397e0c5b268009825fa942e86b368b4edd651e69967182981e8be746a60566b42d36109" + } + ], + "signed": { + "_type": "root", + "consistent_snapshot": false, + "expires": "2027-08-01T23:55:23Z", + "keys": { + "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed": { + "keytype": "ed25519", + "keyval": { + "public": "be8f719618189eb74b524ee92e85eea99a5228fafc7257356b5d8acad2829b24" + }, + "scheme": "ed25519" + }, + "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc": { + "keytype": "ed25519", + "keyval": { + "public": "cbde8cdde12b19b39a786da7128214d01e0f4415e590df34768530fad2bf4702" + }, + "scheme": "ed25519" + }, + "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42": { + "keytype": "ed25519", + "keyval": { + "public": "1559cdea5a3295593d4c08e6ee625561f7cd96a1dcc0d553b9961734491b801a" + }, + "scheme": "ed25519" + }, + "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6": { + "keytype": "ed25519", + "keyval": { + "public": "6ac7a3b9d83f0d1835ea6fdc0307fe340ea422bc15763fdc0bc197383a61d79b" + }, + "scheme": "ed25519" + } + }, + "roles": { + "root": { + "keyids": [ + "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed" + ], + "threshold": 1 + }, + "snapshot": { + "keyids": [ + "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc" + ], + "threshold": 1 + }, + "targets": { + "keyids": [ + "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6" + ], + "threshold": 1 + }, + "timestamp": { + "keyids": [ + "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42" + ], + "threshold": 1 + } + }, + "spec_version": "1.0.31", + "version": 1 + } +} \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/root.json b/scripts/release/win/repository/metadata/root.json new file mode 100755 index 0000000..343b2e2 --- /dev/null +++ b/scripts/release/win/repository/metadata/root.json @@ -0,0 +1,71 @@ +{ + "signatures": [ + { + "keyid": "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed", + "sig": "cb0c1b0078781b4b87a181deaa03122a7e1f08dd39fab4eac842acd43397e0c5b268009825fa942e86b368b4edd651e69967182981e8be746a60566b42d36109" + } + ], + "signed": { + "_type": "root", + "consistent_snapshot": false, + "expires": "2027-08-01T23:55:23Z", + "keys": { + "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed": { + "keytype": "ed25519", + "keyval": { + "public": "be8f719618189eb74b524ee92e85eea99a5228fafc7257356b5d8acad2829b24" + }, + "scheme": "ed25519" + }, + "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc": { + "keytype": "ed25519", + "keyval": { + "public": "cbde8cdde12b19b39a786da7128214d01e0f4415e590df34768530fad2bf4702" + }, + "scheme": "ed25519" + }, + "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42": { + "keytype": "ed25519", + "keyval": { + "public": "1559cdea5a3295593d4c08e6ee625561f7cd96a1dcc0d553b9961734491b801a" + }, + "scheme": "ed25519" + }, + "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6": { + "keytype": "ed25519", + "keyval": { + "public": "6ac7a3b9d83f0d1835ea6fdc0307fe340ea422bc15763fdc0bc197383a61d79b" + }, + "scheme": "ed25519" + } + }, + "roles": { + "root": { + "keyids": [ + "25e91fe88ce247418835d22b18c63a8166038a16b2b9f26f319bc65a8b2687ed" + ], + "threshold": 1 + }, + "snapshot": { + "keyids": [ + "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc" + ], + "threshold": 1 + }, + "targets": { + "keyids": [ + "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6" + ], + "threshold": 1 + }, + "timestamp": { + "keyids": [ + "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42" + ], + "threshold": 1 + } + }, + "spec_version": "1.0.31", + "version": 1 + } +} \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/snapshot.json b/scripts/release/win/repository/metadata/snapshot.json new file mode 100755 index 0000000..03821d1 --- /dev/null +++ b/scripts/release/win/repository/metadata/snapshot.json @@ -0,0 +1,19 @@ +{ + "signatures": [ + { + "keyid": "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc", + "sig": "bd89d38c63ddee6537276a13657a2716a1a88346421a8d51db9fa8c12b9dc6b0db57a48bbab616930b6aaaa91c4a12a54909cd9722e07b23632638d68bd08307" + } + ], + "signed": { + "_type": "snapshot", + "expires": "2026-10-30T23:55:23Z", + "meta": { + "targets.json": { + "version": 1 + } + }, + "spec_version": "1.0.31", + "version": 1 + } +} \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/targets.json b/scripts/release/win/repository/metadata/targets.json new file mode 100755 index 0000000..6296ebe --- /dev/null +++ b/scripts/release/win/repository/metadata/targets.json @@ -0,0 +1,15 @@ +{ + "signatures": [ + { + "keyid": "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6", + "sig": "88ebf0eac3bea958b3d5d99e713a2af1a8e6d230c414bca1b22f1bf64ce2a8734b3db5eaa80dcc9fdd31c1954864af2828c122bf6d4354b1a06136e478e6d00d" + } + ], + "signed": { + "_type": "targets", + "expires": "2026-10-30T23:55:23Z", + "spec_version": "1.0.31", + "targets": {}, + "version": 1 + } +} \ No newline at end of file diff --git a/scripts/release/win/repository/metadata/timestamp.json b/scripts/release/win/repository/metadata/timestamp.json new file mode 100755 index 0000000..12227b6 --- /dev/null +++ b/scripts/release/win/repository/metadata/timestamp.json @@ -0,0 +1,19 @@ +{ + "signatures": [ + { + "keyid": "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42", + "sig": "b11ee59ed85d21b52d25e676a98232c9d63813ac5236493c11d47264065647933f1c28bc9748f8c880174a3ab3bcb27f6786c1c4a596ef80b70fc11b40f9f002" + } + ], + "signed": { + "_type": "timestamp", + "expires": "2026-10-30T23:55:23Z", + "meta": { + "snapshot.json": { + "version": 1 + } + }, + "spec_version": "1.0.31", + "version": 1 + } +} \ No newline at end of file -- cgit v1.2.3