#!/usr/bin/env node
import { readFileSync } from "node:fs";
import { join, resolve } from "node:path";
import { pathToFileURL } from "node:url";
import { readReleaseBinary } from "./release-artifact-integrity.mjs";
import { darwinReleasePlatforms } from "./release-platforms.mjs";
export function verifyMacosValidationReceipts(artifactsDir, receiptsDir, channel) {
if (!["production", "beta"].includes(channel)) throw new Error("Expected production or beta channel");
for (const platform of darwinReleasePlatforms) {
const release = readReleaseBinary(artifactsDir, platform);
const receipt = JSON.parse(readFileSync(join(receiptsDir, `${channel}-${platform}.json`), "utf8"));
if (receipt.schemaVersion !== 1) throw new Error("Unsupported validation receipt");
for (const key of ["platform", "version", "file", "sha256", "executableSha256", "manifestFile", "manifestSha256", "inventorySha256"]) {
if (receipt[key] !== release[key]) throw new Error(`macOS validation receipt mismatch: ${platform} ${key}`);
}
console.log(`Matched native validation receipt: ${channel} ${platform} ${release.sha256}`);
}
}
if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
const [artifactsDir, receiptsDir, channel, ...extra] = process.argv.slice(2);
if (!artifactsDir || !receiptsDir || !channel || extra.length)
throw new Error("Usage: node verify-macos-validation-receipts.mjs <artifacts-dir> <receipts-dir> <production|beta>");
verifyMacosValidationReceipts(resolve(artifactsDir), resolve(receiptsDir), channel);
}