mirror of
https://github.com/jetkvm/cloud-api.git
synced 2026-05-21 05:20:36 +00:00
Adam Shiervani
988a07d418
* feat(sync-releases): show artifact details, verify GPG, allow custom rollout (#58) * feat(sync-releases): show artifact details, verify GPG, allow custom rollout The previous production prompt was a single y/N with no artifact context, no way to override the hardcoded 10% rollout, and no signature verification. An operator confirming a release this way had to trust that the right files were in S3 and that the .sig was issued by the OTA root key — neither was visible. Changes: * Print full artifact summary before the prompt: URL, sha256, compatibleSkus, and signature status for each artifact. * Verify each .sig file with gpg --status-fd=1 and check the primary key fingerprint against OTA_ROOT_KEY_FPR (mirrored from rv1106-system's release_r2.sh). Reports valid / wrong-root / invalid / missing-pubkey / gpg-unavailable / absent, with a loud WARNING line for wrong-root and invalid signatures so the operator cannot miss them. * Print the latest already-synced release of the same type before the prompt so the operator can confirm this is the next expected version. * Add an interactive rollout-percentage prompt with 10% default, validated to 0-100, replacing the hardcoded 10. * Add an `a`/`abort` answer alongside y/N so operators can stop a multi- release sync mid-run when they spot something wrong, instead of having to N through every remaining version. * Print the DB target and bucket as the first line of main() so a wrong .env.production selection is obvious before any prompts fire. * Print a final run summary with counters: created / skipped-by-user / already-synced / no-artifacts, plus an "aborted at <type> <version>" line when the run was cut short. * Add `npm run sync-releases:production` script and ignore .env.production. Verification path runs only when NODE_ENV=production, so non-prod runs and the test suite never spawn gpg or download artifacts. All 52 existing tests still pass; tsc build is clean. * refactor: hoist objectKeyFromArtifactUrl into helpers Both src/releases.ts and scripts/sync-releases.ts had their own copy of the same URL-to-S3-key conversion. Moved into src/helpers.ts and imported from both call sites so a future change (e.g. CDN path prefix handling) only needs to land once. * fix(sync-releases): only treat ERRSIG rc=9 as missing pubkey GnuPG's ERRSIG line carries an `rc` reason code. rc=9 is the only one that means "we don't have the signer's key" — rc=4 (unsupported algorithm) and other codes are real verification failures. The previous implementation collapsed every ERRSIG into noPubkey, which would have falsely told the operator the OTA root key was missing when the actual problem was e.g. an unsupported pubkey algorithm. Now parses the rc field and surfaces non-9 ERRSIG codes as `invalid` with a human reason (rc=4 → "unsupported algorithm", others → "gpg error code N"). * feat(releases): map recovery artifact filename per SKU (#59) The system recovery endpoint hard-coded `update.img`, which is the eMMC/RKDevTool image. The SDMMC variant ships as `update_sd.img.zip` (a balenaEtcher-flashable archive), so requesting recovery for the `jetkvm-v2-sdmmc` SKU returned the wrong artifact (or 404'd once SKU folders were enforced). Drive the filename from a small per-SKU map and reject unmapped SKUs with 400 so a typo can't silently fall back to the wrong image.
64 lines
2.2 KiB
JSON
64 lines
2.2 KiB
JSON
{
|
|
"name": "jetkvm-cloud-api",
|
|
"version": "1.0.0",
|
|
"description": "JetKVM Cloud API and Websocket Server",
|
|
"main": "dist/src/index.js",
|
|
"scripts": {
|
|
"start": "NODE_ENV=production node -r ts-node/register ./src/index.ts",
|
|
"dev": "NODE_ENV=development node --watch --watch-path=./src --env-file=.env.development -r ts-node/register ./src/index.ts",
|
|
"dev:debug": "NODE_ENV=development node --watch --watch-path=./src --env-file=.env.development -r ts-node/register ./src/index.ts --inspect-brk",
|
|
"prisma-dev": "prisma generate --watch",
|
|
"prisma-dev-migrate": "prisma migrate dev",
|
|
"prisma-migrate": "prisma migrate deploy",
|
|
"seed": "NODE_ENV=development node -r ts-node/register --env-file=.env.development ./scripts/seed.ts",
|
|
"sync-releases": "NODE_ENV=development node -r ts-node/register --env-file=.env.development ./scripts/sync-releases.ts",
|
|
"sync-releases:production": "NODE_ENV=production node -r ts-node/register --env-file=.env.production ./scripts/sync-releases.ts",
|
|
"build": "tsc",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:coverage": "vitest run --coverage"
|
|
},
|
|
"engines": {
|
|
"node": "22.x"
|
|
},
|
|
"keywords": [],
|
|
"author": "JetKVM",
|
|
"license": "GPL-2.0",
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.654.0",
|
|
"@prisma/client": "^5.13.0",
|
|
"@tsconfig/node22": "^22.0.0",
|
|
"@types/cookie-session": "^2.0.49",
|
|
"@types/cors": "^2.8.17",
|
|
"@types/node": "^20.12.10",
|
|
"@types/ws": "^8.5.10",
|
|
"cookie-session": "^2.1.0",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.4.7",
|
|
"express": "^5",
|
|
"helmet": "^7.1.0",
|
|
"http-proxy-middleware": "^3.0.3",
|
|
"jose": "^5.2.4",
|
|
"lru-cache": "^11.2.2",
|
|
"openid-client": "^5.6.5",
|
|
"prisma": "^5.13.0",
|
|
"semver": "^7.6.3",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^5.4.5",
|
|
"ws": "^8.17.1",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"optionalDependencies": {
|
|
"bufferutil": "^4.0.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/express": "^5.0.6",
|
|
"@types/lru-cache": "^7.10.9",
|
|
"@types/semver": "^7.5.8",
|
|
"@vitest/coverage-v8": "^4.0.18",
|
|
"aws-sdk-client-mock": "^4.1.0",
|
|
"prettier": "3.2.5",
|
|
"vitest": "^4.0.18"
|
|
}
|
|
}
|