diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml new file mode 100644 index 0000000..0417220 --- /dev/null +++ b/.github/workflows/package.yml @@ -0,0 +1,104 @@ +name: Build native Edit MPKG +on: + push: + branches: [main, master] + pull_request: + branches: [main, master] + workflow_dispatch: +permissions: + contents: read +concurrency: + group: edit-package-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} +jobs: + build: + runs-on: ubuntu-24.04 + timeout-minutes: 60 + env: + CARGO_BUILD_JOBS: '4' + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + with: + python-version: '3.12' + - name: Install host dependencies + run: | + sudo apt-get update + sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake + - name: Prepare the pinned standalone Rust SDK + id: sdk + uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb + with: + output: ${{ runner.temp }}/mochios-rust-sdk + - name: Test, compile and stage Edit + env: + SDK: ${{ steps.sdk.outputs.sdk }} + HELPER: ${{ steps.sdk.outputs.helper }} + run: python3 "$HELPER" --source "$GITHUB_WORKSPACE" --sdk "$SDK" --output "$RUNNER_TEMP/app-build" --test + - name: Build unsigned MPKG using the public Action + id: package + uses: mochiOS/devkit/actions/build-mpkg@20d3fb71b952ae7a4ff583dafe8cc3d00e24d3a3 + with: + manifest: ${{ runner.temp }}/app-build/stage/manifest.toml + payload: ${{ runner.temp }}/app-build/stage/payload + output: dist/Edit.mpkg + - name: Retain package and reviewable dependency resolution + shell: bash + run: | + cp "$RUNNER_TEMP/app-build/build-info.json" dist/build-info.json + cp "$RUNNER_TEMP/app-build/resolved.Cargo.lock" dist/resolved.Cargo.lock + - name: Upload distributable files only + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + with: + name: edit-unsigned-mpkg + path: dist/ + if-no-files-found: error + retention-days: 14 + publish: + if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && vars.APP_RELEASE_ENABLED == 'true' + needs: build + runs-on: ubuntu-24.04 + timeout-minutes: 30 + environment: app-release + permissions: + actions: read + contents: write + steps: + - name: Download this run's verified build artifact + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + name: edit-unsigned-mpkg + path: unsigned-package + - name: Prepare trusted tooling without checking out application code + id: sdk + uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb + with: + output: ${{ runner.temp }}/mochios-rust-sdk + - name: Build the pinned signing tool + env: + SDK: ${{ steps.sdk.outputs.sdk }} + HELPER: ${{ steps.sdk.outputs.helper }} + run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/host-tools" + - name: Sign, verify and publish the approved package + env: + GH_TOKEN: ${{ github.token }} + MSIGN_CERTIFICATE_B64: ${{ secrets.MSIGN_CERTIFICATE_B64 }} + MSIGN_PRIVATE_KEY_B64: ${{ secrets.MSIGN_PRIVATE_KEY_B64 }} + MSIGN_ROOT_PUBLIC_KEY_B64: ${{ vars.MSIGN_ROOT_PUBLIC_KEY_B64 }} + HELPER: ${{ steps.sdk.outputs.helper }} + SOURCE_COMMIT: ${{ github.sha }} + RELEASE_REPOSITORY: ${{ github.repository }} + RELEASE_BRANCH: ${{ github.event.repository.default_branch }} + run: | + python3 "$(dirname "$HELPER")/release.py" \ + --artifacts "$GITHUB_WORKSPACE/unsigned-package" \ + --msign "$RUNNER_TEMP/host-tools/release/msign" \ + --package-id org.mochios.edit \ + --commit "$SOURCE_COMMIT" \ + --sdk-ref 1ae906d7417e9882b11541e338552c3039c981fb \ + --repository "$RELEASE_REPOSITORY" \ + --environment app-release \ + --reviewer-team 17892808 \ + --branch "$RELEASE_BRANCH" diff --git a/BUILDING.md b/BUILDING.md new file mode 100644 index 0000000..3c8be4c --- /dev/null +++ b/BUILDING.md @@ -0,0 +1,36 @@ +# Native package builds + +The PR workflow builds Edit independently of the OS workspace using the pinned +DevKit setup Action and published shared.8 SDK. It runs host unit tests, builds +the native mochiOS executable, and uses the public `build-mpkg` Action to create +an unsigned package. Native programs are inspected, not executed on Linux. + +Download `edit-unsigned-mpkg` from the successful Actions run. It contains +`Edit.mpkg`, `SHA256SUMS`, `build-info.json`, and `resolved.Cargo.lock`. Review and +commit an updated dependency resolution when changing SDK/source pins. Runner +paths and the local SDK description are not distributed. The normal source +manifest still supports built-in/preview staging; the package build derives +digest-bound ordinary `/applications/Edit.app` installation metadata without +built-in provenance, preserving declared resources, document roles and capabilities. + +Changes go to `staging` and a PR targeting `main`. PRs never sign or release. +After merging, the default-branch workflow builds again and, once releases have +been enabled, waits for approval in the `app-release` Environment. That +environment is restricted to the default branch and reviewed by +`mochiOS/application-maintainers`. + +Publication is initially disabled. Before setting the repository variable +`APP_RELEASE_ENABLED=true`, configure these Environment values: + +* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued app Developer Certificate file. +* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file. +* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file. + +Do not commit key files or use development fixture identities. The approval job +does not check out or run application code. It checks the build's source commit, +SDK Action revision, actual package ID, and unsigned checksum, signs with msign, +checks that the configured Team approval and branch restrictions are still present, +then verifies the signature/certificate/payload before publishing. It creates a +prerelease named `v-r` and never replaces existing tags or assets. +Increase `package.revision` before another release of the same version. An +approval cannot override a missing, invalid, expired or insufficient signing identity. diff --git a/Cargo.lock b/Cargo.lock index 70267d4..33e24cf 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1054,6 +1054,7 @@ dependencies = [ "mochios-capability-protocol", "mochios-package-manifest", "mochios-workspace-protocol", + "zeroize", ] [[package]] @@ -1091,6 +1092,7 @@ version = "0.1.0" [[package]] name = "mochios-fonts" version = "0.1.0" +source = "git+https://github.com/mochiOS/fonts?rev=233cb947ed6b10e175b0c6570611eb5605f112e1#233cb947ed6b10e175b0c6570611eb5605f112e1" dependencies = [ "sha2", "ttf-parser", @@ -2430,9 +2432,9 @@ checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "ui_layout" -version = "0.9.8" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe00a83f195b147e7ea8a2b9abc08b9b3ca043e7fcca996bd7a980174438fb1b" +checksum = "afbdfab90b0052416a13fa78be0f151f5bb6480242601b97e76207f58e8761b0" [[package]] name = "unicode-bidi" @@ -3292,17 +3294,45 @@ name = "mboot-protocol" version = "0.1.0" [[patch.unused]] -name = "mnu" -version = "0.1.0" +name = "rustc-std-workspace-alloc" +version = "1.99.0" + +[[patch.unused]] +name = "rustc-std-workspace-core" +version = "1.99.0" [[patch.unused]] -name = "mochios-mdriver-protocol" +name = "rustc-std-workspace-std" +version = "1.99.0" + +[[patch.unused]] +name = "mochi-user-newlib-runtime" version = "0.1.0" [[patch.unused]] name = "mochi-user-runtime" version = "0.1.0" +[[patch.unused]] +name = "mochios-certificate" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-certificate-database" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-driver-control-protocol" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-elf-signature" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-http-client" +version = "0.1.0" + [[patch.unused]] name = "mochios-linux-gui-protocol" version = "0.1.0" @@ -3311,14 +3341,34 @@ version = "0.1.0" name = "mochios-linux-portal-protocol" version = "0.1.0" +[[patch.unused]] +name = "mochios-network-stack" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-package-client" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-package-protocol" +version = "0.1.0" + [[patch.unused]] name = "mochios-signature-protocol" version = "0.1.0" +[[patch.unused]] +name = "mochios-test-support" +version = "0.1.0" + [[patch.unused]] name = "mochios-tls-client" version = "0.1.0" +[[patch.unused]] +name = "mochios-tls-stream-ffi" +version = "0.1.0" + [[patch.unused]] name = "mochios-user-database" version = "0.1.0"