chore: 保存 Agent 安全优化前基线

scripts/build-script.test.mjs

@@ -17,6 +17,7 @@ test('build.sh is valid Bash and documents supported native targets', () => {
   assert.equal(help.status, 0, help.stderr)
   assert.match(help.stdout, /mac-arm64/)
   assert.match(help.stdout, /win-x64/)
+  assert.match(help.stdout, /linux-x64/)
   assert.match(help.stdout, /不会创建或推送 Git tag/)
 })
 

scripts/build.sh

@@ -25,6 +25,8 @@ OpsXShell 原生安装包构建脚本
   mac-arm64    macOS Apple Silicon，生成 .app 和 .dmg
   mac-x64      macOS Intel，生成 .app 和 .dmg
   win-x64      Windows x86_64，生成 NSIS/MSI 安装包
+  linux-x64    Linux x86_64，生成 deb/rpm/AppImage
+  linux-arm64  Linux aarch64，生成 deb/rpm/AppImage
 
 选项：
   --quick      构建前只运行快速门禁
@@ -39,7 +41,7 @@ OpsXShell 原生安装包构建脚本
 说明：
   - 显式传入新版本时，会同步 package.json、package-lock.json、
     Cargo.toml、Cargo.lock 和 tauri.conf.json，但不会创建或推送 Git tag。
-  - Windows 包必须在 Windows 上构建；macOS 包必须在 macOS 上构建。
+  - Windows 包必须在 Windows 上构建；macOS 包必须在 macOS 上构建；Linux 包必须在 Linux 上构建。
   - 正式签名构建请先设置 REQUIRE_SIGNING=true 及对应签名环境变量。
 EOF
 }
@@ -65,7 +67,7 @@ while [ "$#" -gt 0 ]; do
     --skip-checks)
       CHECK_MODE="none"
       ;;
-    auto|mac-arm64|mac-x64|win-x64)
+    auto|mac-arm64|mac-x64|win-x64|linux-x64|linux-arm64)
       TARGET="$1"
       ;;
     v[0-9]*|[0-9]*)
@@ -97,6 +99,8 @@ if [ "$TARGET" = "auto" ]; then
     Darwin/arm64|Darwin/aarch64) TARGET="mac-arm64" ;;
     Darwin/x86_64) TARGET="mac-x64" ;;
     MINGW*/*|MSYS*/*|CYGWIN*/*) TARGET="win-x64" ;;
+    Linux/x86_64) TARGET="linux-x64" ;;
+    Linux/aarch64|Linux/arm64) TARGET="linux-arm64" ;;
     *) fail "当前平台 $HOST_OS/$HOST_ARCH 不支持自动打包，请显式指定目标" ;;
   esac
 fi
@@ -123,6 +127,18 @@ case "$TARGET" in
     RELEASE_PLATFORM="windows"
     OUTPUT_PLATFORM="windows-x64"
     ;;
+  linux-x64)
+    [ "$HOST_OS" = "Linux" ] || fail "linux-x64 必须在 Linux 上构建"
+    RUST_TARGET="x86_64-unknown-linux-gnu"
+    RELEASE_PLATFORM="linux"
+    OUTPUT_PLATFORM="linux-x64"
+    ;;
+  linux-arm64)
+    [ "$HOST_OS" = "Linux" ] || fail "linux-arm64 必须在 Linux 上构建"
+    RUST_TARGET="aarch64-unknown-linux-gnu"
+    RELEASE_PLATFORM="linux"
+    OUTPUT_PLATFORM="linux-arm64"
+    ;;
 esac
 
 if command -v rustup >/dev/null 2>&1 && ! rustup target list --installed | grep -Fxq "$RUST_TARGET"; then
@@ -177,6 +193,8 @@ shopt -s nullglob
 COPIED_ARTIFACTS=()
 if [ "$RELEASE_PLATFORM" = "macos" ]; then
   SOURCE_ARTIFACTS=("$BUNDLE_ROOT"/dmg/*.dmg)
+elif [ "$RELEASE_PLATFORM" = "linux" ]; then
+  SOURCE_ARTIFACTS=("$BUNDLE_ROOT"/deb/*.deb "$BUNDLE_ROOT"/rpm/*.rpm "$BUNDLE_ROOT"/appimage/*.AppImage)
 else
   SOURCE_ARTIFACTS=("$BUNDLE_ROOT"/nsis/*.exe "$BUNDLE_ROOT"/msi/*.msi "$BUNDLE_ROOT"/wix/*.msi)
 fi

scripts/release-preflight.mjs

@@ -1,8 +1,8 @@
 import { missingSigningVariables } from './release-tools.mjs'
 
-const platform = process.argv[2] ?? (process.platform === 'darwin' ? 'macos' : process.platform === 'win32' ? 'windows' : '')
+const platform = process.argv[2] ?? (process.platform === 'darwin' ? 'macos' : process.platform === 'win32' ? 'windows' : process.platform === 'linux' ? 'linux' : '')
 if (!platform) {
-  console.error('[release] Only macOS and Windows release targets are supported')
+  console.error('[release] Only macOS, Windows, and Linux release targets are supported')
   process.exit(2)
 }
 

scripts/release-tools.mjs

@@ -10,6 +10,7 @@ export const REQUIRED_SIGNING_ENV = {
     'APPLE_TEAM_ID',
   ],
   windows: ['WINDOWS_CERTIFICATE_BASE64', 'WINDOWS_CERTIFICATE_PASSWORD'],
+  linux: [],
 }
 
 export function missingSigningVariables(platform, env = process.env) {

scripts/release.py

@@ -21,7 +21,7 @@ import requests
 
 API_BASE = "https://gitee.com/api/v5"
 DEFAULT_REPO = "opsx-tools/opsxshell"
-ALLOWED_SUFFIXES = {".dmg", ".exe", ".msi"}
+ALLOWED_SUFFIXES = {".dmg", ".exe", ".msi", ".deb", ".rpm", ".appimage"}
 CHECKSUM_NAMES = {"SHA256SUMS.txt"}
 MAX_ASSET_BYTES = 100 * 1024 * 1024
 

scripts/verify-release.mjs

@@ -3,7 +3,7 @@ import { existsSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { assertWithinSize, readPeMachine } from './release-tools.mjs'
 
-const platform = process.argv[2] ?? (process.platform === 'darwin' ? 'macos' : process.platform === 'win32' ? 'windows' : '')
+const platform = process.argv[2] ?? (process.platform === 'darwin' ? 'macos' : process.platform === 'win32' ? 'windows' : process.platform === 'linux' ? 'linux' : '')
 const root = process.argv[3] ?? (platform === 'macos'
   ? 'src-tauri/target/aarch64-apple-darwin/release/bundle'
   : 'src-tauri/target/release/bundle')
@@ -57,6 +57,11 @@ if (platform === 'macos') {
   }
   for (const installer of installers) assertWithinSize(installer, maxInstallerBytes)
   console.log(`[release] Windows x64 artifacts verified: ${root}`)
+} else if (platform === 'linux') {
+  const installers = files.filter((path) => /\.(?:deb|rpm|appimage)$/i.test(path))
+  if (installers.length === 0) fail('Linux release must contain a .deb, .rpm, or .AppImage')
+  for (const installer of installers) assertWithinSize(installer, maxInstallerBytes)
+  console.log(`[release] Linux artifacts verified: ${root}`)
 } else {
   fail(`Unsupported platform: ${platform}`)
 }