Enforce monotonic household releases and staged APK integrity

docker/tv_publish.py

@@ -30,6 +30,14 @@ REQUIRED = {
 }
 
 
+class ForgeHttpError(RuntimeError):
+    """Retain HTTP status without exposing response bodies or authorization."""
+
+    def __init__(self, method: str, status: int) -> None:
+        super().__init__(f"Forgejo {method} failed: HTTP {status}")
+        self.status = status
+
+
 class NoRedirect(urllib.request.HTTPRedirectHandler):
     """Validate every redirect before forwarding distribution-tool credentials."""
 
@@ -98,9 +106,9 @@ class Forge:
                 return self.opener.open(request, timeout=60)
             except urllib.error.HTTPError as error:
                 if method != "GET" or error.code not in (301, 302, 303, 307, 308):
-                    raise RuntimeError(
-                        f"Forgejo {method} failed: HTTP {error.code}"
-                    ) from None
+                    status = error.code
+                    error.close()
+                    raise ForgeHttpError(method, status) from None
                 location = error.headers.get("Location")
                 error.close()
                 if not location:
@@ -159,6 +167,41 @@ class Forge:
         if actual != expected:
             raise ValueError("Uploaded artifact checksum mismatch")
 
+    def require_newer_code(self, code: int) -> None:
+        """Read the public channel anonymously and fail closed on an uncertain floor."""
+        try:
+            release = self.json("GET", "/releases/latest", authenticated=False)
+        except ForgeHttpError as error:
+            if error.status != 404:
+                raise
+            releases = self.json("GET", "/releases?limit=1", authenticated=False)
+            if releases == []:
+                return
+            raise ValueError("Latest is missing but the channel is not empty") from None
+        assets = [
+            asset
+            for asset in release["assets"]
+            if asset["name"] == "wolfskin-update.json"
+        ]
+        if len(assets) != 1:
+            raise ValueError("Latest release must have exactly one update manifest")
+        with self.request(
+            "GET", assets[0]["browser_download_url"], authenticated=False
+        ) as response:
+            manifest = json.load(response)
+        latest_code = manifest["versionCode"]
+        if (
+            manifest["schemaVersion"] != 1
+            or manifest["packageId"] != "org.justinvisser.wolfskin.tv.opt"
+            or type(latest_code) is not int
+            or not 1 <= latest_code <= 2100000000
+        ):
+            raise ValueError("Invalid live household version identity")
+        if code <= latest_code:
+            raise ValueError(
+                f"Bundle versionCode must exceed live channel code {latest_code}"
+            )
+
 
 def credential(server: str) -> str:
     """Read git's existing credential helper without secrets in argv, stdout or disk."""
@@ -280,6 +323,7 @@ def publish(
             f"Dry run: draft {REPOSITORY} {tag}; upload and verify {len(hashes)} assets; promote={promote}; no requests or credentials"
         )
         return
+    Forge(server, "", test_server).require_newer_code(manifest["versionCode"])
     forge = Forge(server, credential(server), test_server)
     if draft_id is None:
         release = forge.json(
@@ -313,6 +357,7 @@ def publish(
             "Draft upload verified. Publication requires owner approval and explicit --promote."
         )
         return
+    forge.require_newer_code(manifest["versionCode"])
     try:
         forge.json("PATCH", f"/releases/{release_id}", {"draft": False})
         latest = forge.json("GET", "/releases/latest", authenticated=False)