From 7479c5c8c4d9859e7f1f215f4cd2ca03a9e366df Mon Sep 17 00:00:00 2001 From: Naruto TAKAHASHI Date: Mon, 13 Jul 2026 14:13:52 +0900 Subject: [PATCH] chore: bump plugin to 7.0.0-beta.1, unify SDK version format + verify download checksums - ss_player/VERSION.txt: 0.0.0 -> 7.0.0-beta.1 (plugin's own first release version; baked into SSPLAYER_VERSION at build time). CHANGELOG heading updated to match. - SDK_VERSION.txt: v7.0.0-alpha01 -> v7.0.0-alpha.1 (dotted semver), and moved into scripts/ next to download-sdk (path refs updated in AGENTS.md and docs/{ja,en}/setup/build.md). - download-sdk.sh / .ps1: fetch the release's SHA256SUMS manifest and verify the downloaded zip against it before extracting (sha256sum or shasum -a 256 on POSIX; Get-FileHash on Windows). - Bump the SpriteStudio-SDK submodule to the dot-semver SDK commit. --- AGENTS.md | 2 +- CHANGELOG.md | 2 +- docs/en/setup/build.md | 2 +- docs/ja/setup/build.md | 2 +- scripts/SDK_VERSION.txt | 1 + scripts/download-sdk.ps1 | 39 ++++++++++++++++++++++++---- scripts/download-sdk.sh | 53 +++++++++++++++++++++++++++++--------- ss_player/SDK_VERSION.txt | 1 - ss_player/SpriteStudio-SDK | 2 +- ss_player/VERSION.txt | 2 +- 10 files changed, 82 insertions(+), 24 deletions(-) create mode 100644 scripts/SDK_VERSION.txt delete mode 100644 ss_player/SDK_VERSION.txt diff --git a/AGENTS.md b/AGENTS.md index 7b4d851..90028e1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -27,7 +27,7 @@ A Godot Engine integration for SpriteStudio 7, providing a C++ `SpriteStudioPlay * **FFI Safety:** C++ interacts with Rust via a C-API. Ensure `SsState` and other Rust-allocated handles are properly released via their respective `*_release` functions to avoid leaks. * **Performance:** Avoid per-frame allocations in the playback hot path. Use the `DrawBatch` plans emitted by the runtime directly for rendering. -* **SDK Versioning:** `ss_player/SDK_VERSION.txt` pins the required SDK release. Binaries in `ss_player/runtime/` must match this version. +* **SDK Versioning:** `scripts/SDK_VERSION.txt` pins the required SDK release. Binaries in `ss_player/runtime/` must match this version. * **Build System:** `SConstruct` and `SCsub` files must be updated if new C++ source files are added. ## Verification diff --git a/CHANGELOG.md b/CHANGELOG.md index cf29ab0..e2e02bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [7.0.0-alpha01] - 2026-0X-XX +## [7.0.0-beta.1] - 2026-0X-XX ### Added - **Initial Public Release**: SpriteStudio 7 SDK (`ssconverter-cli` + `Godot Plugin`). diff --git a/docs/en/setup/build.md b/docs/en/setup/build.md index d3f2520..de31b4a 100644 --- a/docs/en/setup/build.md +++ b/docs/en/setup/build.md @@ -42,7 +42,7 @@ The `molten-vk` package distributed via Homebrew only provides binaries for the ## 1. Prepare libssruntime -Fetches and extracts the SDK package version pinned in `ss_player/SDK_VERSION.txt`. +Fetches and extracts the SDK package version pinned in `scripts/SDK_VERSION.txt`. **macOS / Linux** diff --git a/docs/ja/setup/build.md b/docs/ja/setup/build.md index c26342a..952e45b 100644 --- a/docs/ja/setup/build.md +++ b/docs/ja/setup/build.md @@ -42,7 +42,7 @@ Homebrew で配布されている `molten-vk` はホストアーキ向けのバ ## 1. libssruntime の用意 -`ss_player/SDK_VERSION.txt` で指定されたバージョンの SDK パッケージを取得・展開します。 +`scripts/SDK_VERSION.txt` で指定されたバージョンの SDK パッケージを取得・展開します。 **macOS / Linux** diff --git a/scripts/SDK_VERSION.txt b/scripts/SDK_VERSION.txt new file mode 100644 index 0000000..bc57c2a --- /dev/null +++ b/scripts/SDK_VERSION.txt @@ -0,0 +1 @@ +v7.0.0-alpha.1 diff --git a/scripts/download-sdk.ps1 b/scripts/download-sdk.ps1 index 54e5dc1..ee543b9 100644 --- a/scripts/download-sdk.ps1 +++ b/scripts/download-sdk.ps1 @@ -3,7 +3,7 @@ $ErrorActionPreference = "Stop" $baseDirectory = Split-Path -Parent $PSCommandPath $rootDirectory = Split-Path -Parent $baseDirectory $targetDir = "$rootDirectory/ss_player" -$versionFile = "$targetDir/SDK_VERSION.txt" +$versionFile = "$baseDirectory/SDK_VERSION.txt" $currentVersionFile = "$targetDir/runtime/VERSION" $targetVersion = (Get-Content $versionFile).Trim() @@ -16,13 +16,41 @@ if (Test-Path $currentVersionFile) { } } -$url = "https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/$targetVersion/spritestudio-sdk-static-libs.zip" +$baseUrl = "https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/$targetVersion" +$asset = "spritestudio-sdk-static-libs.zip" $zipFile = "$targetDir/sdk.zip" +$sumsFile = "$targetDir/SHA256SUMS" Write-Host "Target SDK Version: $targetVersion" -Write-Host "Download URL: $url" -Write-Host "Downloading SDK..." -Invoke-WebRequest -Uri $url -OutFile $zipFile + +# Fetch the release's SHA256SUMS manifest and verify the downloaded zip against +# it before extracting, so a corrupted or tampered download fails loudly. +Write-Host "Downloading checksum manifest: $baseUrl/SHA256SUMS" +Invoke-WebRequest -Uri "$baseUrl/SHA256SUMS" -OutFile $sumsFile + +Write-Host "Downloading SDK: $baseUrl/$asset" +Invoke-WebRequest -Uri "$baseUrl/$asset" -OutFile $zipFile + +# Verify against the manifest entry for . Get-FileHash returns +# an upper-case hash; sha256sum writes lower-case, so compare case-insensitively. +function Assert-Sha256($file, $name) { + $expected = $null + foreach ($line in Get-Content $sumsFile) { + $parts = $line -split '\s+', 2 + if ($parts.Count -eq 2 -and $parts[1].Trim() -eq $name) { $expected = $parts[0].ToLower(); break } + } + if (-not $expected) { + Write-Error "No checksum entry for $name in SHA256SUMS" + exit 1 + } + $actual = (Get-FileHash -Algorithm SHA256 -Path $file).Hash.ToLower() + if ($expected -ne $actual) { + Write-Error "Checksum mismatch for $name`n expected: $expected`n actual: $actual" + exit 1 + } + Write-Host "Checksum OK: $name" +} +Assert-Sha256 $zipFile $asset Write-Host "Extracting SDK..." if (Test-Path "$targetDir/runtime") { @@ -30,6 +58,7 @@ if (Test-Path "$targetDir/runtime") { } Expand-Archive -Path $zipFile -DestinationPath $targetDir -Force Remove-Item $zipFile +Remove-Item $sumsFile # Godot Custom Module compatibility (Windows x86_64) $winLibDir = "$targetDir/runtime/libs/windows/x86_64" diff --git a/scripts/download-sdk.sh b/scripts/download-sdk.sh index 774bf67..6a62030 100755 --- a/scripts/download-sdk.sh +++ b/scripts/download-sdk.sh @@ -1,37 +1,66 @@ #!/bin/bash set -e -BASEDIR=$(dirname $0) +BASEDIR=$(dirname "$0") +SCRIPTDIR=$(cd "$BASEDIR" && pwd -P) ROOTDIR=$(cd "$BASEDIR/.." && pwd -P) TARGET_DIR="${ROOTDIR}/ss_player" -VERSION_FILE="${TARGET_DIR}/SDK_VERSION.txt" +VERSION_FILE="${SCRIPTDIR}/SDK_VERSION.txt" CURRENT_VERSION_FILE="${TARGET_DIR}/runtime/VERSION" -TARGET_VERSION=$(cat "$VERSION_FILE" | tr -d ' -') +TARGET_VERSION=$(tr -d ' \r\n' < "$VERSION_FILE") if [ -f "$CURRENT_VERSION_FILE" ]; then - CURRENT_VERSION=$(cat "$CURRENT_VERSION_FILE" | tr -d ' -') + CURRENT_VERSION=$(tr -d ' \r\n' < "$CURRENT_VERSION_FILE") if [ "$CURRENT_VERSION" = "$TARGET_VERSION" ]; then echo "SDK $TARGET_VERSION is already up to date. Skipping download." exit 0 fi fi -URL="https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/${TARGET_VERSION}/spritestudio-sdk-static-libs.zip" +BASE_URL="https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/${TARGET_VERSION}" +ASSET="spritestudio-sdk-static-libs.zip" ZIP_FILE="${TARGET_DIR}/sdk.zip" +SUMS_FILE="${TARGET_DIR}/SHA256SUMS" echo "Target SDK Version: ${TARGET_VERSION}" -echo "Download URL: ${URL}" -echo "Downloading SDK..." -curl -fL -o "$ZIP_FILE" "$URL" + +# Fetch the release's SHA256SUMS manifest and verify the downloaded zip against +# it before extracting, so a corrupted or tampered download fails loudly. +echo "Downloading checksum manifest: ${BASE_URL}/SHA256SUMS" +curl -fL -o "$SUMS_FILE" "${BASE_URL}/SHA256SUMS" + +echo "Downloading SDK: ${BASE_URL}/${ASSET}" +curl -fL -o "$ZIP_FILE" "${BASE_URL}/${ASSET}" + +# Verify against the manifest entry for . Uses sha256sum +# (Linux) or shasum -a 256 (macOS), matching the manifest line by asset name. +verify_sha256() { + local file="$1" name="$2" expected actual + expected=$(awk -v n="$name" '$2 == n {print $1}' "$SUMS_FILE") + if [ -z "$expected" ]; then + echo "ERROR: no checksum entry for ${name} in SHA256SUMS" >&2 + exit 1 + fi + if command -v sha256sum >/dev/null 2>&1; then + actual=$(sha256sum "$file" | awk '{print $1}') + else + actual=$(shasum -a 256 "$file" | awk '{print $1}') + fi + if [ "$expected" != "$actual" ]; then + echo "ERROR: checksum mismatch for ${name}" >&2 + echo " expected: ${expected}" >&2 + echo " actual: ${actual}" >&2 + exit 1 + fi + echo "Checksum OK: ${name}" +} +verify_sha256 "$ZIP_FILE" "$ASSET" echo "Extracting SDK..." rm -rf "${TARGET_DIR}/runtime" unzip -q -o "$ZIP_FILE" -d "${TARGET_DIR}/" -rm "$ZIP_FILE" +rm "$ZIP_FILE" "$SUMS_FILE" echo "$TARGET_VERSION" > "$CURRENT_VERSION_FILE" echo "Done." - diff --git a/ss_player/SDK_VERSION.txt b/ss_player/SDK_VERSION.txt deleted file mode 100644 index f631034..0000000 --- a/ss_player/SDK_VERSION.txt +++ /dev/null @@ -1 +0,0 @@ -v7.0.0-alpha01 diff --git a/ss_player/SpriteStudio-SDK b/ss_player/SpriteStudio-SDK index 30b207a..81d53be 160000 --- a/ss_player/SpriteStudio-SDK +++ b/ss_player/SpriteStudio-SDK @@ -1 +1 @@ -Subproject commit 30b207a3839ec71a8e82f221aae4ae4ddf8bdfe0 +Subproject commit 81d53be389e403ab774b2be27bbf70ba5de75c91 diff --git a/ss_player/VERSION.txt b/ss_player/VERSION.txt index 77d6f4c..97f8009 100644 --- a/ss_player/VERSION.txt +++ b/ss_player/VERSION.txt @@ -1 +1 @@ -0.0.0 +7.0.0-beta.1