mirror of
https://github.com/storytold/wordcraft.git
synced 2026-10-29 04:47:10 -06:00
Jeremy
72b8818ea6
The package is dual-scope, so the separate -windows-user MSI was the same package under a second name. Build and policy-check the single plain-named MSI before signing, which is the name every sibling app, the launcher and the shared windows-arm64 workflow use. Replace the loop test with one that checks the MSI is policy-checked once, before it is signed.
30 lines
1.8 KiB
PowerShell
30 lines
1.8 KiB
PowerShell
<# Check the real packaging script without compiling, signing or installing: one MSI, policy-checked before it is signed. #>
|
|
$ErrorActionPreference = 'Stop'
|
|
$tokens = $null; $errors = $null
|
|
$script = Join-Path $PSScriptRoot 'package.ps1'
|
|
$ast = [Management.Automation.Language.Parser]::ParseFile($script, [ref]$tokens, [ref]$errors)
|
|
if ($errors.Count) { throw 'The packaging script does not parse.' }
|
|
if ($ast.Extent.Text -match 'windows-user|UserMsi') {
|
|
throw 'WordCraft ships one dual-scope MSI; there is no separate per-user installer to package.'
|
|
}
|
|
$commands = @($ast.FindAll({ param($node) $node -is [Management.Automation.Language.CommandAst] }, $true))
|
|
$checks = @($commands | Where-Object {
|
|
$_.InvocationOperator.ToString() -eq 'Ampersand' -and
|
|
@($_.CommandElements | Where-Object { $_.Extent.Text -match 'check-install-policy.ps1' }).Count -gt 0
|
|
})
|
|
if ($checks.Count -ne 1) { throw 'Expected exactly one policy check in the packaging script.' }
|
|
$elements = $checks[0].CommandElements
|
|
$index = 0
|
|
while ($index -lt $elements.Count -and $elements[$index].Extent.Text -ne '-MsiPath') { $index++ }
|
|
if ($index + 1 -ge $elements.Count -or $elements[$index + 1].Extent.Text -ne '$Msi') {
|
|
throw 'The policy check must inspect the MSI being packaged ($Msi).'
|
|
}
|
|
$signs = @($commands | Where-Object {
|
|
$_.InvocationOperator.ToString() -eq 'Ampersand' -and
|
|
@($_.CommandElements | Where-Object { $_.Extent.Text -match 'sign.ps1' }).Count -gt 0 -and
|
|
$_.CommandElements[-1].Extent.Text -eq '$Msi'
|
|
})
|
|
if ($signs.Count -ne 1) { throw 'Expected the MSI to be signed exactly once.' }
|
|
if ($checks[0].Extent.StartOffset -ge $signs[0].Extent.StartOffset) { throw 'The MSI must pass the policy check before it is signed.' }
|
|
Write-Output 'PASS the WordCraft MSI is policy-checked before it is signed.'
|