iboard/scripts/build-ota.mjs

#!/usr/bin/env node
// OTA 升级包生成脚本 (兼容 tauri-plugin-hotswap)
// 用法: node scripts/build-ota.mjs [--out <dir>] [--sequence <n>] [--min-binary <x>] [--notes <s>] [--no-sign]
// 流程:
//   1) 校验 dist/ 已构建
//   2) 生成 bundle.tar.gz (dist/ 内容)
//   3) minisign 签名 (除非 --no-sign)
//   4) 写 latest.json (manifest, 含 sequence/version/signature/bundle_size/notes/...)
//   5) 全部产物输出到 out 目录 (默认 ota-package/)
//
// minisign 安装: 见 readme "OTA 升级" 章节
import fs from 'node:fs'
import path from 'node:path'
import crypto from 'node:crypto'
import { fileURLToPath } from 'node:url'
import { spawnSync } from 'node:child_process'

const __filename = fileURLToPath(import.meta.url)
const __dirname = path.dirname(__filename)
const ROOT = path.resolve(__dirname, '..')

const args = process.argv.slice(2)
function getArg(name, def) {
  const i = args.indexOf(name)
  return i >= 0 && args[i + 1] ? args[i + 1] : def
}
const OUT_DIR = path.resolve(getArg('--out', 'ota-package'))
const SEQUENCE = Number(getArg('--sequence', String(Date.now()))) // 默认用时间戳做单调计数
const MIN_BINARY = getArg('--min-binary', '')
const NOTES = getArg('--notes', '')
const NO_SIGN = args.includes('--no-sign')
// minisign 私钥路径 (默认读 ./ota-package/hotswap.key; 也可显式 --key)
const KEY_PATH = path.resolve(getArg('--key', path.join(OUT_DIR, 'hotswap.key')))
// 旧版 tauri.conf.json 里的 pubkey (自动同步过去, 方便用户复制)
const TAURI_CONF = path.join(ROOT, 'src-tauri', 'tauri.conf.json')

const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'))
const APP_VERSION = pkg.version || '0.0.0'

const DIST = path.join(ROOT, 'dist')
if (!fs.existsSync(path.join(DIST, 'index.html'))) {
  console.error('[build-ota] 错误: dist/index.html 不存在, 请先执行 npm run build')
  process.exit(1)
}

// 准备输出目录
fs.mkdirSync(OUT_DIR, { recursive: true })

// 1) 生成 bundle.tar.gz
const BUNDLE_NAME = 'iboard-ota.tar.gz'
const BUNDLE_PATH = path.join(OUT_DIR, BUNDLE_NAME)
const r = spawnSync('tar', ['-czf', BUNDLE_PATH, '-C', DIST, '.'], { stdio: 'inherit' })
if (r.status !== 0) {
  console.error('[build-ota] tar 打包失败')
  process.exit(1)
}
const bundleStat = fs.statSync(BUNDLE_PATH)
const bundleSha256 = crypto.createHash('sha256').update(fs.readFileSync(BUNDLE_PATH)).digest('hex')

// 2) 签名 (minisign)
let signature = ''
let pubkey = ''
if (!NO_SIGN) {
  if (!fs.existsSync(KEY_PATH)) {
    console.error('[build-ota] 私钥不存在:', KEY_PATH)
    console.error('  生成方法: minisign -G -W -p ota-package/hotswap.pub -s ota-package/hotswap.key')
    process.exit(1)
  }
  // minisign -Sm <file> -s <key> [-W] 生成 detached signature
  const sigArgs = ['-Sm', BUNDLE_PATH, '-s', KEY_PATH]
  // 私钥无密码时不需要 -W
  const sigR = spawnSync('minisign', sigArgs, { stdio: 'inherit' })
  if (sigR.status !== 0) {
    console.error('[build-ota] minisign 签名失败')
    process.exit(1)
  }
  const sigPath = BUNDLE_PATH + '.minisig'
  signature = fs.readFileSync(sigPath, 'utf8').trim()

  // 尝试同步 pubkey 到 tauri.conf.json (如果存在)
  const PUB_PATH = path.join(path.dirname(KEY_PATH), 'hotswap.pub')
  if (fs.existsSync(PUB_PATH)) {
    pubkey = fs.readFileSync(PUB_PATH, 'utf8').trim()
    // 提取 base64 部分 (第二行)
    const lines = pubkey.split(/\r?\n/)
    pubkey = (lines.find((l) => l.startsWith('RWR') || l.startsWith('RWT') || l.startsWith('RWQ')) || '').trim()
  }
}

// 3) 写 latest.json
const minBinary = MIN_BINARY || (() => {
  // 默认从 src-tauri/tauri.conf.json 读 version
  try { return JSON.parse(fs.readFileSync(TAURI_CONF, 'utf8')).version || APP_VERSION }
  catch { return APP_VERSION }
})()
const manifest = {
  version: APP_VERSION + '-ota',
  sequence: SEQUENCE,
  min_binary_version: minBinary,
  bundle: BUNDLE_NAME,
  bundle_size: bundleStat.size,
  bundle_sha256: bundleSha256,
  signature,
  notes: NOTES,
  pub_date: new Date().toISOString(),
  mandatory: false,
  // 内部用: 前端 web 模式比对 build_id
  build_id: 'seq-' + SEQUENCE,
}
fs.writeFileSync(path.join(OUT_DIR, 'latest.json'), JSON.stringify(manifest, null, 2))

// 4) 提示
console.log('\n=== OTA 包生成完成 ===')
console.log('输出目录:    ', OUT_DIR)
console.log('版本:        ', manifest.version)
console.log('sequence:    ', manifest.sequence)
console.log('bundle 大小: ', (bundleStat.size / 1024).toFixed(1) + ' KB')
console.log('bundle sha256:', bundleSha256)
console.log('签名:        ', signature ? '(已生成, 写入 latest.json)' : '(未签名, --no-sign)')
if (pubkey) {
  console.log('\n请将下面这一行 pubkey 写到 src-tauri/tauri.conf.json -> plugins.hotswap.pubkey:')
  console.log('  ' + pubkey)
  // 自动同步 (可选, 注释掉默认行为; 用户自己粘更安全)
  // syncTauriConf(pubkey)
}

console.log('\n下一步: 把这两个文件发布到 OTA 存储:')
console.log('  ' + BUNDLE_NAME)
console.log('  latest.json')
console.log('并确保 server 进程环境变量 OTA_PACKAGE_DIR 指向该目录。')

// 同步 tauri.conf.json pubkey 字段 (用户首次签名后手动确认)
// 注释: 启用此函数可自动写入, 但为安全默认关闭
function syncTauriConf(pub) {
  if (!fs.existsSync(TAURI_CONF)) return
  try {
    const txt = fs.readFileSync(TAURI_CONF, 'utf8')
    const newTxt = txt.replace(
      /"pubkey":\s*"[^"]*"/,
      '"pubkey": "' + pub + '"'
    )
    if (newTxt !== txt) {
      fs.writeFileSync(TAURI_CONF, newTxt)
      console.log('\n[build-ota] 已同步 pubkey 到 tauri.conf.json')
    }
  } catch (e) {
    console.warn('[build-ota] 同步 pubkey 失败:', e.message)
  }
}