Repository navigation
Expand file tree
/
Copy pathfetch.natives.ps1
More file actions
79 lines (68 loc) · 3.47 KB
/
Copy pathfetch.natives.ps1
File metadata and controls
79 lines (68 loc) · 3.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
<#
.SYNOPSIS
Downloads the prebuilt LibGit2Sharp native payload (all RIDs) pinned in natives.lock.json,
verifies its SHA256, and extracts it to native/.
This replaces the old LibGit2Sharp.NativeBinaries.UiPath PackageReference: the managed build
consumes these binaries directly. Verification is mandatory - if the lockfile SHA256 is empty or
does not match the download, this fails hard.
.PARAMETER Force
Re-download and re-extract even if native/ already exists.
#>
Param(
[switch]$Force
)
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
# Expand-Archive/native calls below drive on their own results; don't let a non-zero native exit
# auto-throw first (PowerShell 7.4+ defaults this to $true). Harmless no-op on Windows PowerShell 5.1.
$PSNativeCommandUseErrorActionPreference = $false
$projectDirectory = Split-Path $MyInvocation.MyCommand.Path
$lockPath = Join-Path $projectDirectory 'natives.lock.json'
$nativeDirectory = Join-Path $projectDirectory 'native'
$cacheDirectory = Join-Path $nativeDirectory '_cache'
# Proxy-aware download, mirroring fetch.deps.ps1 in the nativebinaries repo.
function Invoke-Download($url, $outFile) {
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$params = @{ Uri = $url; OutFile = $outFile; UseBasicParsing = $true }
$proxy = [System.Net.WebRequest]::GetSystemWebProxy()
if ($proxy) {
$proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
$proxyUri = $proxy.GetProxy([uri]$url)
# GetProxy returns an empty value (or the url itself) for a direct connection; only route
# through a proxy when it names a genuinely different endpoint.
if ($proxyUri -and "$proxyUri" -ne "$url") {
$params.Proxy = "$proxyUri"
$params.ProxyUseDefaultCredentials = $true
}
}
Write-Host "-> Downloading $url"
Invoke-WebRequest @params
}
$lock = Get-Content $lockPath -Raw | ConvertFrom-Json
$expectedSha = "$($lock.sha256)".Trim().ToLower()
if (-not $expectedSha) {
throw "natives.lock.json has no sha256. Run the nativebinaries 'build' workflow (publish=true), " +
"then populate tag/url/sha256 here. Refusing to fetch without hash verification."
}
if ((Test-Path $nativeDirectory) -and -not $Force) {
$marker = Join-Path $nativeDirectory '.fetched-sha256'
if ((Test-Path $marker) -and ((Get-Content $marker -Raw).Trim().ToLower() -eq $expectedSha)) {
Write-Host "==> Native payload already present for sha256 $expectedSha (use -Force to refresh). Skipping."
return $nativeDirectory
}
}
New-Item -ItemType Directory -Path $cacheDirectory -Force | Out-Null
$archive = Join-Path $cacheDirectory $lock.filename
Invoke-Download $lock.url $archive
$actualSha = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLower()
if ($actualSha -ne $expectedSha) {
Remove-Item $archive -Force
throw "SHA256 mismatch for '$($lock.filename)'.`n expected: $expectedSha`n actual: $actualSha`nAborting."
}
Write-Host "==> SHA256 verified: $actualSha"
# Wipe the payload (but keep the download cache) so stale RIDs never linger.
Get-ChildItem $nativeDirectory -Force -Exclude '_cache' -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force
Expand-Archive -Path $archive -DestinationPath $nativeDirectory -Force
Set-Content -Path (Join-Path $nativeDirectory '.fetched-sha256') -Value $expectedSha -NoNewline
Write-Host "==> Extracted native payload to '$nativeDirectory'"
return $nativeDirectory