Release 3.8.0.2: app.zip updates, lock hygiene, secret-safe getState.

scripts/build-macos-arm64.sh

@@ -3,6 +3,11 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+# Prefer local toolchain if present.
+export PATH="$(pwd)/.tools/go/bin:/tmp/go-sdk/go/bin:/usr/local/go/bin:$PATH"
+
+python3 scripts/sync-version.py
+
 VERSION="$(python3 - <<'PY'
 import re
 from pathlib import Path
@@ -26,7 +31,6 @@ OUT="dist/navis-release/darwin-arm64"
 mkdir -p "$OUT"
 LDFLAGS="-s -w"
 
-export PATH="/tmp/go-sdk/go/bin:/usr/local/go/bin:$PATH"
 CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
   go build -ldflags="$LDFLAGS" -trimpath -o "$OUT/Navis" ./cmd/vpnapp
 CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
@@ -35,18 +39,14 @@ CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 \
 printf '%s\n' "$FULL" > "$OUT/VERSION"
 printf '%s\n' "${VERSION}+${BUILD}" > "$OUT/Navis.version"
 
+# Ad-hoc sign CLI/bin; packmac also signs the .app (honors NAVIS_CODESIGN_IDENTITY).
 if command -v codesign >/dev/null 2>&1; then
-  codesign -s - --force "$OUT/Navis"
-  codesign -s - --force "$OUT/Navis-cli"
+  ID="${NAVIS_CODESIGN_IDENTITY:--}"
+  codesign -s "$ID" --force "$OUT/Navis" || codesign -s - --force "$OUT/Navis"
+  codesign -s "$ID" --force "$OUT/Navis-cli" || codesign -s - --force "$OUT/Navis-cli"
 fi
 
-go build -o tools/packmac/packmac ./tools/packmac
-tools/packmac/packmac \
-  -bin "$OUT/Navis" \
-  -out "$OUT" \
-  -version "$VERSION" \
-  -build "$FULL" \
-  -arch arm64
+go run ./tools/packmac -bin "$OUT/Navis" -out "$OUT" -version "$VERSION" -build "$FULL" -arch arm64
 
 cp -f "$OUT/Navis.dmg" "$OUT/Navis-${FULL}-arm64.dmg"
 cp -f "$OUT/Navis.app.zip" "$OUT/Navis-${FULL}-arm64.app.zip"
@@ -57,10 +57,23 @@ from pathlib import Path
 ver = "${VERSION}"
 build = "${BUILD}"
 full = "${FULL}"
-binp = Path('dist/navis-release/darwin-arm64/Navis')
+out = Path('dist/navis-release/darwin-arm64')
+binp = out / 'Navis'
+zipp = out / 'Navis.app.zip'
+dmgp = out / 'Navis.dmg'
 h = hashlib.sha256(binp.read_bytes()).hexdigest()
-notes = f"Navis {ver}+{build}: единый apphost (Win/macOS); lifecycle Connect/Disconnect; SHA cores; Config snapshot."
-for p in [Path('dist/update.json'), Path('dist/navis-release/update.json')]:
+zh = hashlib.sha256(zipp.read_bytes()).hexdigest() if zipp.exists() else ""
+dh = hashlib.sha256(dmgp.read_bytes()).hexdigest() if dmgp.exists() else ""
+notes = (
+    f"Navis {ver}+{build}: Mac .app zip update; EnsureCore lock; "
+    f"getState без секретов; подпись/notarize pipeline; UI split."
+)
+paths = [
+    Path('dist/update.json'),
+    Path('dist/navis-release/update.json'),
+    Path('server/update.json'),
+]
+for p in paths:
     if not p.exists():
         continue
     d = json.loads(p.read_text())
@@ -69,8 +82,20 @@ for p in [Path('dist/update.json'), Path('dist/navis-release/update.json')]:
     plats = d.setdefault('platforms', {})
     if 'darwin-arm64' in plats:
         plats['darwin-arm64']['sha256'] = h
+        if zh:
+            plats['darwin-arm64']['zip_sha256'] = zh
+        if dh:
+            plats['darwin-arm64']['dmg_sha256'] = dh
+        plats['darwin-arm64'].setdefault(
+            'zip_url',
+            'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release/darwin-arm64/Navis.app.zip',
+        )
+        plats['darwin-arm64'].setdefault(
+            'dmg_url',
+            'https://git.evilfox.cc/test2/navi/raw/branch/main/dist/navis-release/darwin-arm64/Navis.dmg',
+        )
     p.write_text(json.dumps(d, ensure_ascii=False, indent=2) + '\n')
-    print('updated', p, '->', ver, 'sha', h[:12])
+    print('updated', p, '->', ver, 'bin', h[:12], 'zip', zh[:12] if zh else '-')
 PY
 
 echo ""