chore: bump plugin to 7.0.0-beta.1, unify SDK version format + verify download checksums

AGENTS.md

@@ -27,7 +27,7 @@ A Godot Engine integration for SpriteStudio 7, providing a C++ `SpriteStudioPlay
 
 *   **FFI Safety:** C++ interacts with Rust via a C-API. Ensure `SsState` and other Rust-allocated handles are properly released via their respective `*_release` functions to avoid leaks.
 *   **Performance:** Avoid per-frame allocations in the playback hot path. Use the `DrawBatch` plans emitted by the runtime directly for rendering.
-*   **SDK Versioning:** `ss_player/SDK_VERSION.txt` pins the required SDK release. Binaries in `ss_player/runtime/` must match this version.
+*   **SDK Versioning:** `scripts/SDK_VERSION.txt` pins the required SDK release. Binaries in `ss_player/runtime/` must match this version.
 *   **Build System:** `SConstruct` and `SCsub` files must be updated if new C++ source files are added.
 
 ## Verification

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [7.0.0-alpha01] - 2026-0X-XX
+## [7.0.0-beta.1] - 2026-0X-XX
 
 ### Added
 - **Initial Public Release**: SpriteStudio 7 SDK (`ssconverter-cli` + `Godot Plugin`).

docs/en/setup/build.md

@@ -42,7 +42,7 @@ The `molten-vk` package distributed via Homebrew only provides binaries for the
 
 ## 1. Prepare libssruntime
 
-Fetches and extracts the SDK package version pinned in `ss_player/SDK_VERSION.txt`.
+Fetches and extracts the SDK package version pinned in `scripts/SDK_VERSION.txt`.
 
 **macOS / Linux**
 

docs/ja/setup/build.md

@@ -42,7 +42,7 @@ Homebrew で配布されている `molten-vk` はホストアーキ向けのバ
 
 ## 1. libssruntime の用意
 
-`ss_player/SDK_VERSION.txt` で指定されたバージョンの SDK パッケージを取得・展開します。
+`scripts/SDK_VERSION.txt` で指定されたバージョンの SDK パッケージを取得・展開します。
 
 **macOS / Linux**
 

scripts/SDK_VERSION.txt

@@ -0,0 +1 @@
+v7.0.0-alpha.1

scripts/download-sdk.ps1

@@ -3,7 +3,7 @@ $ErrorActionPreference = "Stop"
 $baseDirectory = Split-Path -Parent $PSCommandPath
 $rootDirectory = Split-Path -Parent $baseDirectory
 $targetDir = "$rootDirectory/ss_player"
-$versionFile = "$targetDir/SDK_VERSION.txt"
+$versionFile = "$baseDirectory/SDK_VERSION.txt"
 $currentVersionFile = "$targetDir/runtime/VERSION"
 
 $targetVersion = (Get-Content $versionFile).Trim()
@@ -16,20 +16,49 @@ if (Test-Path $currentVersionFile) {
     }
 }
 
-$url = "https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/$targetVersion/spritestudio-sdk-static-libs.zip"
+$baseUrl = "https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/$targetVersion"
+$asset = "spritestudio-sdk-static-libs.zip"
 $zipFile = "$targetDir/sdk.zip"
+$sumsFile = "$targetDir/SHA256SUMS"
 
 Write-Host "Target SDK Version: $targetVersion"
-Write-Host "Download URL: $url"
-Write-Host "Downloading SDK..."
-Invoke-WebRequest -Uri $url -OutFile $zipFile
+
+# Fetch the release's SHA256SUMS manifest and verify the downloaded zip against
+# it before extracting, so a corrupted or tampered download fails loudly.
+Write-Host "Downloading checksum manifest: $baseUrl/SHA256SUMS"
+Invoke-WebRequest -Uri "$baseUrl/SHA256SUMS" -OutFile $sumsFile
+
+Write-Host "Downloading SDK: $baseUrl/$asset"
+Invoke-WebRequest -Uri "$baseUrl/$asset" -OutFile $zipFile
+
+# Verify <file> against the manifest entry for <asset-name>. Get-FileHash returns
+# an upper-case hash; sha256sum writes lower-case, so compare case-insensitively.
+function Assert-Sha256($file, $name) {
+    $expected = $null
+    foreach ($line in Get-Content $sumsFile) {
+        $parts = $line -split '\s+', 2
+        if ($parts.Count -eq 2 -and $parts[1].Trim() -eq $name) { $expected = $parts[0].ToLower(); break }
+    }
+    if (-not $expected) {
+        Write-Error "No checksum entry for $name in SHA256SUMS"
+        exit 1
+    }
+    $actual = (Get-FileHash -Algorithm SHA256 -Path $file).Hash.ToLower()
+    if ($expected -ne $actual) {
+        Write-Error "Checksum mismatch for $name`n  expected: $expected`n  actual:   $actual"
+        exit 1
+    }
+    Write-Host "Checksum OK: $name"
+}
+Assert-Sha256 $zipFile $asset
 
 Write-Host "Extracting SDK..."
 if (Test-Path "$targetDir/runtime") {
     Remove-Item -Recurse -Force "$targetDir/runtime"
 }
 Expand-Archive -Path $zipFile -DestinationPath $targetDir -Force
 Remove-Item $zipFile
+Remove-Item $sumsFile
 
 # Godot Custom Module compatibility (Windows x86_64)
 $winLibDir = "$targetDir/runtime/libs/windows/x86_64"

scripts/download-sdk.sh

@@ -1,37 +1,66 @@
 #!/bin/bash
 set -e
-BASEDIR=$(dirname $0)
+BASEDIR=$(dirname "$0")
+SCRIPTDIR=$(cd "$BASEDIR" && pwd -P)
 ROOTDIR=$(cd "$BASEDIR/.." && pwd -P)
 TARGET_DIR="${ROOTDIR}/ss_player"
-VERSION_FILE="${TARGET_DIR}/SDK_VERSION.txt"
+VERSION_FILE="${SCRIPTDIR}/SDK_VERSION.txt"
 CURRENT_VERSION_FILE="${TARGET_DIR}/runtime/VERSION"
 
-TARGET_VERSION=$(cat "$VERSION_FILE" | tr -d '
-')
+TARGET_VERSION=$(tr -d ' \r\n' < "$VERSION_FILE")
 
 if [ -f "$CURRENT_VERSION_FILE" ]; then
-    CURRENT_VERSION=$(cat "$CURRENT_VERSION_FILE" | tr -d '
-')
+    CURRENT_VERSION=$(tr -d ' \r\n' < "$CURRENT_VERSION_FILE")
     if [ "$CURRENT_VERSION" = "$TARGET_VERSION" ]; then
         echo "SDK $TARGET_VERSION is already up to date. Skipping download."
         exit 0
     fi
 fi
 
-URL="https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/${TARGET_VERSION}/spritestudio-sdk-static-libs.zip"
+BASE_URL="https://github.com/cri-middleware/SpriteStudio-SDK/releases/download/${TARGET_VERSION}"
+ASSET="spritestudio-sdk-static-libs.zip"
 ZIP_FILE="${TARGET_DIR}/sdk.zip"
+SUMS_FILE="${TARGET_DIR}/SHA256SUMS"
 
 echo "Target SDK Version: ${TARGET_VERSION}"
-echo "Download URL: ${URL}"
-echo "Downloading SDK..."
-curl -fL -o "$ZIP_FILE" "$URL"
+
+# Fetch the release's SHA256SUMS manifest and verify the downloaded zip against
+# it before extracting, so a corrupted or tampered download fails loudly.
+echo "Downloading checksum manifest: ${BASE_URL}/SHA256SUMS"
+curl -fL -o "$SUMS_FILE" "${BASE_URL}/SHA256SUMS"
+
+echo "Downloading SDK: ${BASE_URL}/${ASSET}"
+curl -fL -o "$ZIP_FILE" "${BASE_URL}/${ASSET}"
+
+# Verify <file> against the manifest entry for <asset-name>. Uses sha256sum
+# (Linux) or shasum -a 256 (macOS), matching the manifest line by asset name.
+verify_sha256() {
+    local file="$1" name="$2" expected actual
+    expected=$(awk -v n="$name" '$2 == n {print $1}' "$SUMS_FILE")
+    if [ -z "$expected" ]; then
+        echo "ERROR: no checksum entry for ${name} in SHA256SUMS" >&2
+        exit 1
+    fi
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual=$(sha256sum "$file" | awk '{print $1}')
+    else
+        actual=$(shasum -a 256 "$file" | awk '{print $1}')
+    fi
+    if [ "$expected" != "$actual" ]; then
+        echo "ERROR: checksum mismatch for ${name}" >&2
+        echo "  expected: ${expected}" >&2
+        echo "  actual:   ${actual}" >&2
+        exit 1
+    fi
+    echo "Checksum OK: ${name}"
+}
+verify_sha256 "$ZIP_FILE" "$ASSET"
 
 echo "Extracting SDK..."
 rm -rf "${TARGET_DIR}/runtime"
 unzip -q -o "$ZIP_FILE" -d "${TARGET_DIR}/"
-rm "$ZIP_FILE"
+rm "$ZIP_FILE" "$SUMS_FILE"
 
 echo "$TARGET_VERSION" > "$CURRENT_VERSION_FILE"
 
 echo "Done."
-

ss_player/VERSION.txt

@@ -1 +1 @@
-0.0.0
+7.0.0-beta.1