feat:升级功能、密码卡框架、主密钥接口

2026-03-26 17:30:48 +08:00
parent c1e91e76b0
commit 11ed0b5edf
208 changed files with 16742 additions and 1156 deletions
@@ -0,0 +1,49 @@
+# 标准收发器离线升级包最小样例
+
+本目录提供 `STANDARD_APP` 离线升级包的最小示例骨架，用于对齐打包方、后端和联调流程。
+
+目录结构：
+
+```text
+standard-app/
+├── manifest.json
+└── payload/
+    └── scripts/
+        └── orchestrator.sh
+```
+
+说明：
+
+- 本目录中的 `manifest.json` 使用了占位符 `__PAYLOAD_SHA256__`
+- 真正打包前，需要先对 `payload.zip` 计算 `SHA-256`，再替换该字段
+- `signature.sig` 不放在仓库示例里，必须由打包方使用“固件完整性密钥”私钥在打包阶段生成
+
+推荐打包步骤：
+
+1. 进入当前示例目录
+2. 将 `payload/` 压缩为 `payload.zip`
+3. 计算 `payload.zip` 的 `SHA-256`
+4. 用实际摘要替换 `manifest.json` 中的 `__PAYLOAD_SHA256__`
+5. 对 `manifest.json` 原始字节生成 `signature.sig`
+6. 将 `manifest.json`、`signature.sig`、`payload.zip` 压缩成最终 `upgrade-package.zip`
+
+参考命令：
+
+```bash
+cd docs/examples/upgrade-package/standard-app
+
+zip -rq payload.zip payload
+PAYLOAD_SHA256="$(shasum -a 256 payload.zip | awk '{print $1}')"
+sed "s/__PAYLOAD_SHA256__/${PAYLOAD_SHA256}/g" manifest.json > manifest.generated.json
+
+# 这里改为公司正式签名工具，生成 manifest.generated.json 对应的 signature.sig
+# sign-manifest manifest.generated.json > signature.sig
+
+zip -j upgrade-package.zip manifest.generated.json signature.sig payload.zip
+```
+
+联调时建议：
+
+- 先用这个目录骨架做一个 `STANDARD_APP` 预检样包
+- `orchestrator.sh` 可以先只输出日志并返回 `0`
+- 等预检、建任务、执行链路跑通后，再替换成真实升级脚本
@@ -0,0 +1,13 @@
+{
+  "packageFormatVersion": 1,
+  "packageId": "PKG-20260319-STANDARD-001",
+  "targetComponent": "STANDARD_APP",
+  "targetVersion": "V1.3.2",
+  "minCompatibleVersion": "V1.3.0",
+  "description": "标准收发器企业版离线升级包最小样例",
+  "createdAt": "2026-03-19T16:30:00+08:00",
+  "orchestrator": "scripts/orchestrator.sh",
+  "fileChecksums": {
+    "payloadZip": "__PAYLOAD_SHA256__"
+  }
+}
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+TASK_ID="${1:-UNKNOWN}"
+
+echo "[upgrade] task=${TASK_ID} phase=backup message=start backup placeholder"
+echo "[upgrade] task=${TASK_ID} phase=stop-service message=stop service placeholder"
+echo "[upgrade] task=${TASK_ID} phase=deploy message=deploy placeholder"
+echo "[upgrade] task=${TASK_ID} phase=health-check message=health check placeholder"
+echo "[upgrade] task=${TASK_ID} phase=done message=upgrade completed"