Starting with v0.4.26, download Frame Control and SHA256SUMS from the same GitHub release. Earlier releases do not have this file. A matching SHA-256 means your file matches that release asset. It does not prove the app is free of malware. Compare all 64 characters with the line for your filename.
+Windows PowerShell: Get-FileHash .\Frame-Control-Setup-x64.exe -Algorithm SHA256
macOS Terminal: shasum -a 256 Frame-Control-mac-arm64.dmg
Linux terminal: sha256sum Frame-Control-linux-x86_64.AppImage
The source and build workflow are public. The Windows installer is not code-signed, so SmartScreen may warn. The macOS app has only an ad hoc signature, not an Apple Developer ID signature; the DMG is unsigned and not notarized, so Gatekeeper may warn or block it. Only follow the opening steps below if you trust the download.
+日本語: v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。
The app isn't notarized, because there's no paid Apple developer account behind it. Only for a download you trust from the releases linked above: drag it to Applications, then clear the download quarantine once in Terminal:
diff --git a/tests/test_publish_release.py b/tests/test_publish_release.py index 07baece..3b75b79 100644 --- a/tests/test_publish_release.py +++ b/tests/test_publish_release.py @@ -7,6 +7,7 @@ Run: python3 -m unittest discover -s tests """ import sandbox # noqa: F401 (first: keeps tests off real data and services) import json +import hashlib import os import subprocess import tempfile @@ -26,6 +27,9 @@ def draft(tag_name="untagged-c6ddfed7f75d67db2e99", name="Frame Control 9.8.7", if assets is None: assets = [{"id": 100 + i, "name": n, "size": 1000 + i, "digest": "sha256:" + "%064x" % i} for i, n in enumerate(INSTALLERS)] + body = "".join(f"{i:064x} {n}\n" for i, n in enumerate(INSTALLERS)).encode() + assets.append({"id": 200, "name": "SHA256SUMS", "size": len(body), + "digest": "sha256:" + hashlib.sha256(body).hexdigest()}) return {"id": rid, "tag_name": tag_name, "name": name, "draft": True, "prerelease": False, "body": "notes", "html_url": "https://github.com/saphid/frame-control/releases/tag/" + tag_name, "assets": assets} @@ -79,6 +83,16 @@ class PublishRelease(unittest.TestCase): self.assertIsNone(upload) self.assertFalse(any(c[1:3] == ["-X", "PATCH"] for c in log)) + def test_refuses_missing_or_stale_checksums(self): + for assets in (draft()["assets"][:-1], + draft()["assets"][:-1] + [{"id": 200, "name": "SHA256SUMS", + "digest": "sha256:" + "0" * 64}]): + p, log, upload = self.run_script([draft(assets=assets)], "v9.8.7") + self.assertNotEqual(p.returncode, 0) + self.assertIn("SHA256SUMS is absent or does not match", p.stderr) + self.assertIsNone(upload) + self.assertFalse(any("PATCH" in c for c in log)) + def test_refuses_ambiguous_or_absent_drafts_and_missing_tags(self): p, _, _ = self.run_script([draft(rid=1), draft(rid=2)], "v9.8.7") self.assertNotEqual(p.returncode, 0) diff --git a/tests/test_release_checksums.py b/tests/test_release_checksums.py new file mode 100644 index 0000000..74f56b8 --- /dev/null +++ b/tests/test_release_checksums.py @@ -0,0 +1,38 @@ +"""Checksum generator uses only complete, unambiguous GitHub asset metadata.""" +import sandbox # noqa: F401 +import hashlib +import importlib.util +import unittest +from pathlib import Path + +SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "release-checksums.py" +spec = importlib.util.spec_from_file_location("release_checksums", SCRIPT) +module = importlib.util.module_from_spec(spec) +spec.loader.exec_module(module) + + +class Checksums(unittest.TestCase): + def test_complete_list_matches_bytes(self): + assets = [] + for i, name in enumerate(module.INSTALLERS): + assets.append({"name": name, "digest": "sha256:" + hashlib.sha256(str(i).encode()).hexdigest()}) + actual = module.checksums({"assets": assets}) + self.assertEqual(len(actual.splitlines()), 8) + self.assertEqual(actual.splitlines()[0], hashlib.sha256(b"0").hexdigest() + " " + module.INSTALLERS[0]) + + def test_missing_duplicate_and_bad_digest_fail(self): + assets = [{"name": name, "digest": "sha256:" + "0" * 64} for name in module.INSTALLERS] + for changed in (assets[:-1], assets + [assets[0]], + [dict(assets[0], digest="sha256:bad"), *assets[1:]]): + with self.assertRaises(ValueError): + module.checksums({"assets": changed}) + + def test_tag_or_exact_untagged_draft(self): + lines = ['{"id": 1, "tag_name": "untagged-a", "draft": true, "name": "Frame Control 9.8.7"}', + '{"id": 2, "tag_name": "v9.8.8", "draft": false, "name": "Frame Control 9.8.8"}'] + self.assertEqual(module.find_release(lines, "v9.8.7")["id"], 1) + self.assertEqual(module.find_release(lines, "v9.8.8")["id"], 2) + + +if __name__ == "__main__": + unittest.main()