feat(node): package Ubuntu desktop setup and trusted access

2026-09-05 17:27:59 +03:00
parent 57f2537af3
commit d696842f5d
52 changed files with 4457 additions and 0 deletions
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Engineering-only, sequential build. Never run by an Ubuntu operator."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+from build_deb import build, VERSION, BRAND_SHA256
+
+ROOT = Path(__file__).resolve().parents[1]
+DG_COMMIT = "8a79dfe84d895c9f1d42b8d285bc6670114f939f"
+
+
+def guideline_sources():
+    dg = ROOT.parents[2] / "NODEDC_DESIGN_GUIDELINE"
+    paths = list((dg / "packages/ui-react/src").glob("*"))
+    paths += list((dg / "packages/ui-react/dist").glob("*"))
+    paths += [dg / "packages/ui-core/styles.css", dg / "packages/tokens/tokens.css", dg / "packages/tokens/themes.css"]
+    return {str(p.relative_to(dg)): hashlib.sha256(p.read_bytes()).hexdigest()
+            for p in sorted(paths) if p.is_file()}
+
+
+def provenance():
+    files = {str(p.relative_to(ROOT)): hashlib.sha256(p.read_bytes()).hexdigest()
+             for p in sorted(ROOT.rglob("*")) if p.is_file()
+             and not any(x in p.relative_to(ROOT).parts for x in ("node_modules", "build", "__pycache__"))}
+    return {"package": "mission-core-node", "version": VERSION,
+            "brand_mark_sha256": BRAND_SHA256,
+            "base_commit": subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=ROOT, text=True).strip(),
+            "design_guideline_commit": DG_COMMIT,
+            "design_guideline_files": guideline_sources(),
+            "toolchain": json.loads((ROOT / "toolchain.json").read_text()), "files": files}
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--go", type=Path, required=True)
+    args = parser.parse_args()
+    go = args.go.resolve()
+    expected = json.loads((ROOT / "toolchain.json").read_text())["version"]
+    if subprocess.check_output([str(go), "version"], text=True).split()[2] != expected:
+        sys.exit("Go version does not match toolchain.json")
+    dg = ROOT.parents[2] / "NODEDC_DESIGN_GUIDELINE"
+    if subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=dg, text=True).strip() != DG_COMMIT:
+        sys.exit("Design Guideline revision does not match the admitted build")
+    subprocess.run(["npm", "run", "build"], cwd=ROOT / "ui", check=True)
+    assets = ROOT / "web/dist"
+    if assets.exists():
+        shutil.rmtree(assets)
+    shutil.copytree(ROOT / "ui/dist", assets)
+    output = ROOT / "build"
+    output.mkdir(exist_ok=True)
+    env = dict(os.environ, GOMAXPROCS="2", CGO_ENABLED="0", GOOS="linux", GOARCH="amd64")
+    subprocess.run([str(go), "build", "-trimpath", f"-ldflags=-s -w -X main.version={VERSION}", "-o",
+                    str(output / "node-agent-linux-amd64"), "./cmd/node-agent"], cwd=ROOT, env=env, check=True)
+    (output / "provenance.json").write_text(json.dumps(provenance(), indent=2) + "\n")
+    build(output / "node-agent-linux-amd64", output / f"mission-core-node_{VERSION}_amd64.deb")