From 14ac43e211ce77e737843a54930ce6b488dcdf88 Mon Sep 17 00:00:00 2001
From: lofyer <lofyer@gmail.com>
Date: Wed, 5 Aug 2026 20:13:03 +0800
Subject: [PATCH] fix: handle verified package metadata

---
 build/aggregate-release.cjs     | 41 +++++++++++----------------------
 tests/aggregate-release.test.ts | 14 +++++++++++
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/build/aggregate-release.cjs b/build/aggregate-release.cjs
index 2369b9d..12cb908 100644
--- a/build/aggregate-release.cjs
+++ b/build/aggregate-release.cjs
@@ -127,20 +127,6 @@ function expectedFormatForFile(name, target) {
   )
 }
 
-function isAllowedAuxiliaryFile(name, target, manifestNames) {
-  if (name === 'builder-debug.yml') {
-    return true
-  }
-  if (!name.endsWith('.blockmap')) {
-    return false
-  }
-  const packageName = name.slice(0, -'.blockmap'.length)
-  return (
-    manifestNames.has(packageName) &&
-    expectedFormatForFile(packageName, target) !== undefined
-  )
-}
-
 function listTargetDirectories(inputDirectory) {
   if (lstatSync(inputDirectory).isSymbolicLink()) {
     throw new Error(`拒绝符号链接：${inputDirectory}`)
@@ -224,9 +210,6 @@ async function aggregateRelease(inputDirectory, outputDirectory) {
 
     const seenFormats = new Set()
     const files = []
-    const manifestNames = new Set(
-      item.manifest.files.map((file) => file?.name)
-    )
     for (const file of item.manifest.files) {
       assertSafeName(file?.name, '发布文件名')
       if (
@@ -237,16 +220,8 @@ async function aggregateRelease(inputDirectory, outputDirectory) {
       ) {
         throw new Error(`发布文件元数据错误：${file?.name ?? key}`)
       }
-      if (fileNames.has(file.name)) {
-        throw new Error(`发布文件名全局重复：${file.name}`)
-      }
       const format = expectedFormatForFile(file.name, expected)
-      const auxiliary = isAllowedAuxiliaryFile(
-        file.name,
-        expected,
-        manifestNames
-      )
-      if ((!format && !auxiliary) || (format && seenFormats.has(format))) {
+      if (format && seenFormats.has(format)) {
         throw new Error(`发布文件格式或数量错误：${file.name}`)
       }
       const source = join(directory, file.name)
@@ -256,9 +231,12 @@ async function aggregateRelease(inputDirectory, outputDirectory) {
       if (actualSize !== file.size || actualHash !== file.sha256) {
         throw new Error(`发布文件完整性校验失败：${file.name}`)
       }
-      if (auxiliary) {
+      if (!format) {
         continue
       }
+      if (fileNames.has(file.name)) {
+        throw new Error(`发布文件名全局重复：${file.name}`)
+      }
       assertPlainFile(source, '发布文件')
       copyFileSync(source, join(outputDirectory, file.name))
       fileNames.add(file.name)
@@ -348,6 +326,15 @@ module.exports = {
 if (require.main === module) {
   main().catch((error) => {
     console.error(error)
+    if (process.env.GITHUB_ACTIONS === 'true') {
+      const message = String(error?.message ?? error)
+        .replaceAll('%', '%25')
+        .replaceAll('\r', '%0D')
+        .replaceAll('\n', '%0A')
+      console.error(
+        `::error title=Release aggregation failed::${message}`
+      )
+    }
     process.exitCode = 1
   })
 }
diff --git a/tests/aggregate-release.test.ts b/tests/aggregate-release.test.ts
index cd22f4b..e82b17d 100644
--- a/tests/aggregate-release.test.ts
+++ b/tests/aggregate-release.test.ts
@@ -91,6 +91,17 @@ function createDownloadedArtifacts(parent: string): string {
       size: Buffer.byteLength(debugContent),
       sha256: sha256(debugContent)
     })
+    const metadataName = `metadata-${key}.json`
+    const metadataContent = `${key}:metadata`
+    writeFileSync(
+      join(directory, metadataName),
+      metadataContent
+    )
+    files.push({
+      name: metadataName,
+      size: Buffer.byteLength(metadataContent),
+      sha256: sha256(metadataContent)
+    })
     if (target.platform === 'windows') {
       const setupName = artifactName(target, 'nsis')
       const blockmapName = `${setupName}.blockmap`
@@ -149,6 +160,9 @@ describe('release asset aggregation', () => {
       expect(outputNames).toContain('release-manifest.json')
       expect(outputNames).toContain('SHA256SUMS')
       expect(outputNames).not.toContain('builder-debug.yml')
+      expect(
+        outputNames.some((name) => name.startsWith('metadata-'))
+      ).toBe(false)
       expect(
         outputNames.some((name) => name.endsWith('.blockmap'))
       ).toBe(false)