35 lines
1.7 KiB
JavaScript
35 lines
1.7 KiB
JavaScript
#!/usr/bin/env node
|
|
// prepack: fills sql/ from the signed pgmorbac release whose version matches
|
|
// package.json. The release comes from the crudylabs/pgmorbac GitHub releases, or
|
|
// from a local directory of release files (PGMORBAC_DIST_DIR, the dist/ that
|
|
// the extension's build-dist.mjs writes). Either way it must verify against the
|
|
// pinned release-key.pub.pem before anything is written.
|
|
import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
|
|
import { dirname, join } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { extractSql, releaseFiles, verifyRelease } from './release.mjs';
|
|
|
|
const root = join(dirname(fileURLToPath(import.meta.url)), '..');
|
|
const RELEASES = 'https://github.com/crudylabs/pgmorbac/releases/download';
|
|
|
|
const { version } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
|
|
const files = releaseFiles(version);
|
|
|
|
async function load(name) {
|
|
const dir = process.env.PGMORBAC_DIST_DIR;
|
|
if (dir) return readFileSync(join(dir, name));
|
|
const res = await fetch(`${RELEASES}/v${version}/${name}`);
|
|
if (!res.ok) throw new Error(`${name}: release v${version} answered ${res.status}`);
|
|
return Buffer.from(await res.arrayBuffer());
|
|
}
|
|
|
|
const zip = await load(files.zip);
|
|
const manifestJwt = (await load(files.manifest)).toString('utf8');
|
|
await verifyRelease({ zip, manifestJwt, publicKeyPem: readFileSync(join(root, 'release-key.pub.pem'), 'utf8'), version });
|
|
|
|
const sqlDir = join(root, 'sql');
|
|
rmSync(sqlDir, { recursive: true, force: true });
|
|
mkdirSync(sqlDir);
|
|
for (const [name, bytes] of Object.entries(extractSql(zip, version))) writeFileSync(join(sqlDir, name), bytes);
|
|
console.log(`[pgmorbac] sql/ filled from the verified v${version} release`);
|