promote_release.sh

#!/usr/bin/env bash
set -euo pipefail

MODE="${1:-promote}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="${REPOPROMPT_RELEASE_SOURCE_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}"
CONTROL_PLANE_SCRIPTS_DIR="${REPOPROMPT_CONTROL_PLANE_SCRIPTS_DIR:-$ROOT_DIR/Scripts}"
TRUSTED_ROOT="$(cd "$CONTROL_PLANE_SCRIPTS_DIR/.." && pwd)"
cd "$ROOT_DIR"

source "$CONTROL_PLANE_SCRIPTS_DIR/load_release_metadata.sh"
load_release_metadata "$ROOT_DIR"

SOURCE_GITHUB_REPOSITORY="${SOURCE_GITHUB_REPOSITORY:-${GITHUB_REPOSITORY:-repoprompt/repoprompt-ce}}"
PUBLIC_UPDATE_REPOSITORY="${PUBLIC_UPDATE_REPOSITORY:-repoprompt/repoprompt-ce-updates}"
RELEASE_TAG="${RELEASE_TAG:-}"
SOURCE_GH_TOKEN="${SOURCE_GH_TOKEN:-${GH_TOKEN:-}}"
PUBLIC_UPDATE_GH_TOKEN="${PUBLIC_UPDATE_GH_TOKEN:-}"
REVIEWED_CHECKSUMS_SHA256="${REVIEWED_CHECKSUMS_SHA256:-}"
ARCHIVE_BASENAME="${APP_NAME}-${MARKETING_VERSION}-${BUILD_NUMBER}"
SENTRY_RELEASE_NAME="$BUNDLE_ID@$MARKETING_VERSION+$BUILD_NUMBER"
SENTRY_DEPLOY_ENVIRONMENT="${REPOPROMPT_SENTRY_DEPLOY_ENVIRONMENT:-production}"
SENTRY_API_BASE_URL="${REPOPROMPT_SENTRY_API_BASE_URL:-https://sentry.io/api/0}"
SENTRY_CONNECT_TIMEOUT_SECONDS="${REPOPROMPT_SENTRY_CONNECT_TIMEOUT_SECONDS:-10}"
SENTRY_REQUEST_TIMEOUT_SECONDS="${REPOPROMPT_SENTRY_REQUEST_TIMEOUT_SECONDS:-60}"
RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS="${REPOPROMPT_RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS:-10}"
RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS="${REPOPROMPT_RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS:-120}"
RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS="${REPOPROMPT_RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS:-600}"
RELEASE_DOWNLOAD_ATTEMPTS=9
SENTRY_OPERATION_ATTEMPTS=3
DISTRIBUTION_APP_BUNDLE_NAME="$DISPLAY_NAME.app"
UPDATE_ZIP_NAME="$ARCHIVE_BASENAME.zip"
DMG_NAME="$ARCHIVE_BASENAME.dmg"
APPCAST_NAME="appcast.xml"
CHECKSUMS_NAME="SHA256SUMS"
ARTIFACT_MANIFEST_NAME="$ARCHIVE_BASENAME-artifact-manifest.json"
PUBLIC_UPDATE_BASE_URL="https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/download/$RELEASE_TAG"
PUBLIC_FEED_URL="https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/latest/download/$APPCAST_NAME"
SOURCE_RELEASE_BASE_URL="https://github.com/$SOURCE_GITHUB_REPOSITORY/releases/download/$RELEASE_TAG"
SIGN_UPDATE="${SIGN_UPDATE:-$TRUSTED_ROOT/Vendor/Sparkle/bin/sign_update}"
TMP_DIR=""
DMG_MOUNT_POINT=""
SOURCE_RELEASE_ASSET_SNAPSHOT=""
SOURCE_RELEASE_WAS_DRAFT=""
UPDATE_RELEASE_STATE=""
UPDATE_RELEASE_ASSET_SNAPSHOT=""
SENTRY_CURL_CONFIG=""

fail() {
    printf 'ERROR: %s\n' "$*" >&2
    exit 1
}

require_command() {
    command -v "$1" >/dev/null 2>&1 || fail "Missing required command: $1"
}

require_file() {
    [[ -f "$1" ]] || fail "Missing required file: $1"
}

validate_embedded_mcp_helper_layout() {
    "$CONTROL_PLANE_SCRIPTS_DIR/validate_embedded_mcp_helper_layout.sh" "$@"
}

require_env() {
    [[ -n "${!1:-}" ]] || fail "Missing required environment variable: $1"
}

PKG_NAME="$ARCHIVE_BASENAME.pkg"
ROLLOUT_MANIFEST_NAME="$ARCHIVE_BASENAME-stable-rollout.json"
STABLE_ROLLOUT_TOOL="$CONTROL_PLANE_SCRIPTS_DIR/stable_rollout.py"
APPLE_IDENTITY_POLICY="$CONTROL_PLANE_SCRIPTS_DIR/apple_identity_policy.json"
ROLLOUT_DECLARATION="$ROOT_DIR/release-rollout.json"
RELEASE_ARTIFACT_ROLE=""
PRIMARY_ARTIFACT_NAME=""
PRIMARY_ARTIFACT=""
ROLLOUT_MANIFEST=""

# The reviewed release-rollout.json in the tagged source is the single role
# authority. PR2 promotes legacy/preparer application releases only; the
# transition and successor roles fail unconditionally until successor rollout
# enablement, with no override.
resolve_release_artifact_role() {
    require_file "$ROLLOUT_DECLARATION"
    require_file "$APPLE_IDENTITY_POLICY"
    require_file "$STABLE_ROLLOUT_TOOL"
    RELEASE_ARTIFACT_ROLE="$(python3 "$STABLE_ROLLOUT_TOOL" current-role --declaration "$ROLLOUT_DECLARATION")"
    case "$RELEASE_ARTIFACT_ROLE" in
    legacy | preparer)
        PRIMARY_ARTIFACT_NAME="$UPDATE_ZIP_NAME"
        ;;
    transition | successor)
        fail "Stable promotion for the $RELEASE_ARTIFACT_ROLE rollout role is dormant until successor rollout enablement"
        ;;
    *)
        fail "Unsupported rollout role: $RELEASE_ARTIFACT_ROLE"
        ;;
    esac
    python3 "$STABLE_ROLLOUT_TOOL" workflow-guard \
        --declaration "$ROLLOUT_DECLARATION" \
        --policy "$APPLE_IDENTITY_POLICY"
}

require_resolved_role() {
    [[ -n "$RELEASE_ARTIFACT_ROLE" ]] || fail "Rollout role has not been resolved from release-rollout.json"
}

# Application-style roles (legacy/preparer/successor) distribute a ZIP+DMG pair;
# the transition role is a package-only artifact with no DMG.
release_role_ships_dmg() {
    require_resolved_role
    case "$RELEASE_ARTIFACT_ROLE" in
    legacy | preparer | successor) return 0 ;;
    transition) return 1 ;;
    *) fail "Unsupported rollout role: $RELEASE_ARTIFACT_ROLE" ;;
    esac
}

source_asset_names() {
    require_resolved_role
    case "$RELEASE_ARTIFACT_ROLE" in
    legacy | preparer | successor)
        printf '%s\n' "$UPDATE_ZIP_NAME" "$DMG_NAME" "$APPCAST_NAME" "$CHECKSUMS_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    transition)
        printf '%s\n' "$PKG_NAME" "$APPCAST_NAME" "$CHECKSUMS_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    esac
}

update_asset_names() {
    require_resolved_role
    case "$RELEASE_ARTIFACT_ROLE" in
    legacy | preparer | successor)
        printf '%s\n' "$UPDATE_ZIP_NAME" "$APPCAST_NAME" "$CHECKSUMS_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    transition)
        printf '%s\n' "$PKG_NAME" "$APPCAST_NAME" "$CHECKSUMS_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    esac
}

checksum_asset_names() {
    require_resolved_role
    case "$RELEASE_ARTIFACT_ROLE" in
    legacy | preparer | successor)
        printf '%s\n' "$APPCAST_NAME" "$DMG_NAME" "$UPDATE_ZIP_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    transition)
        printf '%s\n' "$APPCAST_NAME" "$PKG_NAME" "$ARTIFACT_MANIFEST_NAME" "$ROLLOUT_MANIFEST_NAME"
        ;;
    esac
}

validate_bounded_positive_integer() {
    local name="$1" value="$2" maximum="$3"
    [[ "$value" =~ ^[1-9][0-9]*$ ]] || fail "$name must be a positive integer"
    (( value <= maximum )) || fail "$name must not exceed $maximum seconds"
}

validate_sentry_network_bounds() {
    validate_bounded_positive_integer REPOPROMPT_SENTRY_CONNECT_TIMEOUT_SECONDS "$SENTRY_CONNECT_TIMEOUT_SECONDS" 60
    validate_bounded_positive_integer REPOPROMPT_SENTRY_REQUEST_TIMEOUT_SECONDS "$SENTRY_REQUEST_TIMEOUT_SECONDS" 300
    (( SENTRY_CONNECT_TIMEOUT_SECONDS <= SENTRY_REQUEST_TIMEOUT_SECONDS )) ||
        fail "REPOPROMPT_SENTRY_CONNECT_TIMEOUT_SECONDS must not exceed REPOPROMPT_SENTRY_REQUEST_TIMEOUT_SECONDS"
}

validate_release_download_bounds() {
    validate_bounded_positive_integer REPOPROMPT_RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS "$RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS" 60
    validate_bounded_positive_integer REPOPROMPT_RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS "$RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS" 300
    validate_bounded_positive_integer REPOPROMPT_RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS "$RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS" 1200
    (( RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS <= RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS )) ||
        fail "REPOPROMPT_RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS must not exceed REPOPROMPT_RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS"
    (( RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS <= RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS )) ||
        fail "REPOPROMPT_RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS must not exceed REPOPROMPT_RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS"
}

require_release_tag_matches_metadata() {
    [[ "$RELEASE_TAG" == "v$MARKETING_VERSION" ]] ||
        fail "Release tag must match release metadata: expected v$MARKETING_VERSION, got ${RELEASE_TAG:-<missing>}"
}

cleanup() {
    if [[ -n "$DMG_MOUNT_POINT" ]]; then
        hdiutil detach "$DMG_MOUNT_POINT" >/dev/null 2>&1 || true
    fi
    [[ -z "$TMP_DIR" ]] || rm -rf "$TMP_DIR"
}
trap cleanup EXIT

prepare_sentry_api_access() {
    validate_sentry_network_bounds
    require_env REPOPROMPT_SENTRY_ORG
    require_env REPOPROMPT_SENTRY_PROJECT
    local token="${SENTRY_AUTH_TOKEN:-}"
    if [[ -z "$token" ]]; then
        local token_file="${REPOPROMPT_SENTRY_AUTH_TOKEN_FILE:-${SENTRY_AUTH_TOKEN_FILE:-}}"
        [[ -n "$token_file" ]] || fail "Missing Sentry auth token file for stable promotion"
        [[ -f "$token_file" ]] || fail "Sentry auth token file does not exist: $token_file"
        token="$(tr -d '\r\n' < "$token_file")"
    fi
    [[ -n "$token" ]] || fail "Sentry auth token is empty"
    [[ -n "$TMP_DIR" ]] || fail "Sentry API access requires verified promotion state"

    SENTRY_CURL_CONFIG="$TMP_DIR/sentry-curl.conf"
    (
        umask 077
        printf 'header = "Authorization: Bearer %s"\n' "$token" > "$SENTRY_CURL_CONFIG"
    )
    chmod 600 "$SENTRY_CURL_CONFIG"
    unset SENTRY_AUTH_TOKEN
}

sentry_deploy_endpoint() {
    local encoded_org encoded_release
    encoded_org="$(jq -rn --arg value "$REPOPROMPT_SENTRY_ORG" '$value | @uri')"
    encoded_release="$(jq -rn --arg value "$SENTRY_RELEASE_NAME" '$value | @uri')"
    printf '%s/organizations/%s/releases/%s/deploys/' \
        "${SENTRY_API_BASE_URL%/}" "$encoded_org" "$encoded_release"
}

sentry_api_request() {
    local method="$1"
    local output_file="$2"
    local body_file="${3:-}"
    local args=(
        --silent
        --show-error
        --connect-timeout "$SENTRY_CONNECT_TIMEOUT_SECONDS"
        --max-time "$SENTRY_REQUEST_TIMEOUT_SECONDS"
        --output "$output_file"
        --write-out '%{http_code}'
        --request "$method"
        --config "$SENTRY_CURL_CONFIG"
        --header 'Accept: application/json'
    )
    if [[ -n "$body_file" ]]; then
        args+=(--header 'Content-Type: application/json' --data-binary "@$body_file")
    fi

    local status curl_status
    if status="$(curl "${args[@]}" "$(sentry_deploy_endpoint)")"; then
        curl_status=0
    else
        curl_status=$?
    fi
    if (( curl_status != 0 )); then
        printf 'transport:%s' "$curl_status"
        return 0
    fi
    [[ "$status" =~ ^[0-9]{3}$ ]] || fail "Sentry deploy API returned an invalid HTTP status"
    printf '%s' "$status"
}

sentry_request_ambiguous() {
    [[ "$1" == transport:* || "$1" =~ ^5[0-9][0-9]$ ]]
}

list_matching_sentry_deploys() {
    local output_file="$1"
    local status
    status="$(sentry_api_request GET "$output_file")"
    if sentry_request_ambiguous "$status"; then
        printf 'ambiguous'
        return 0
    fi
    if [[ "$status" == "403" ]]; then
        fail "Sentry deploy API rejected the organization token (HTTP 403); verify org:ci access to $REPOPROMPT_SENTRY_ORG/$REPOPROMPT_SENTRY_PROJECT"
    fi
    [[ "$status" =~ ^2[0-9][0-9]$ ]] || fail "Sentry deploy API request failed with HTTP $status"
    jq -e '
        type == "array" and
        all(.[]; has("environment") and (.environment | type == "string") and
            has("name") and ((.name == null) or (.name | type == "string")))
    ' "$output_file" >/dev/null ||
        fail "Sentry deploy API returned malformed JSON"
    jq -r \
        --arg environment "$SENTRY_DEPLOY_ENVIRONMENT" \
        --arg name "$RELEASE_TAG" \
        '[.[] | select(.environment == $environment and .name == $name)] | length' \
        "$output_file"
}

preflight_sentry_deploy_access() {
    prepare_sentry_api_access
    local matches
    matches="$(list_matching_sentry_deploys "$TMP_DIR/sentry-deploy-preflight.json")"
    [[ "$matches" != "ambiguous" ]] || fail "Unable to call the Sentry deploy API within the configured deadline or server-error boundary"
    [[ "$matches" =~ ^[0-9]+$ ]] || fail "Unable to count existing Sentry deploys"
    printf 'OK: Sentry deploy access verified for %s.\n' "$SENTRY_RELEASE_NAME"
}

record_verified_sentry_deploy_if_needed() {
    local body_file="$TMP_DIR/sentry-deploy-create.json"
    jq -n \
        --arg environment "$SENTRY_DEPLOY_ENVIRONMENT" \
        --arg name "$RELEASE_TAG" \
        --arg project "$REPOPROMPT_SENTRY_PROJECT" \
        '{environment: $environment, name: $name, projects: [$project]}' > "$body_file"
    chmod 600 "$body_file"
    local matches status attempt
    for ((attempt = 1; attempt <= SENTRY_OPERATION_ATTEMPTS; attempt++)); do
        matches="$(list_matching_sentry_deploys "$TMP_DIR/sentry-deploy-record.json")"
        if [[ "$matches" == "ambiguous" ]]; then
            continue
        fi
        [[ "$matches" =~ ^[0-9]+$ ]] || fail "Unable to count existing Sentry deploys"
        if (( matches > 0 )); then
            printf 'OK: Sentry production deploy already recorded for %s.\n' "$RELEASE_TAG"
            return 0
        fi
        status="$(sentry_api_request POST "$TMP_DIR/sentry-deploy-created.json" "$body_file")"
        if sentry_request_ambiguous "$status"; then
            matches="$(list_matching_sentry_deploys "$TMP_DIR/sentry-deploy-reconcile.json")"
            if [[ "$matches" == "ambiguous" ]]; then
                continue
            fi
            [[ "$matches" =~ ^[0-9]+$ ]] || fail "Unable to count Sentry deploys during reconciliation"
            if (( matches > 0 )); then
                printf 'OK: Sentry production deploy confirmed after an ambiguous response for %s.\n' "$RELEASE_TAG"
                return 0
            fi
            continue
        fi
        [[ "$status" =~ ^2[0-9][0-9]$ ]] || fail "Sentry deploy API request failed with HTTP $status"
        jq -e \
            --arg environment "$SENTRY_DEPLOY_ENVIRONMENT" \
            --arg name "$RELEASE_TAG" \
            '.environment == $environment and .name == $name' \
            "$TMP_DIR/sentry-deploy-created.json" >/dev/null ||
            fail "Sentry deploy API returned a malformed create response"
        printf 'OK: recorded Sentry production deploy for %s.\n' "$RELEASE_TAG"
        return 0
    done
    fail "Unable to reconcile Sentry deploy state after bounded transport or HTTP 5xx responses; no further mutation was attempted"
}

source_gh() {
    GH_TOKEN="$SOURCE_GH_TOKEN" gh "$@"
}

update_gh() {
    GH_TOKEN="$PUBLIC_UPDATE_GH_TOKEN" gh "$@"
}

curl_anonymous() {
    validate_release_download_bounds
    local started now remaining attempt_timeout connect_timeout attempt curl_status=28 stdout_file
    stdout_file="$(mktemp "${TMPDIR:-/tmp}/repoprompt-release-curl.XXXXXX")"
    started="$(date +%s)"
    for ((attempt = 1; attempt <= RELEASE_DOWNLOAD_ATTEMPTS; attempt++)); do
        now="$(date +%s)"
        remaining=$((RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS - (now - started)))
        (( remaining > 0 )) || break
        attempt_timeout="$RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS"
        (( attempt_timeout <= remaining )) || attempt_timeout="$remaining"
        connect_timeout="$RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS"
        (( connect_timeout <= attempt_timeout )) || connect_timeout="$attempt_timeout"
        : > "$stdout_file"
        if env -u GH_TOKEN -u GITHUB_TOKEN curl \
            --fail \
            --location \
            --connect-timeout "$connect_timeout" \
            --max-time "$attempt_timeout" \
            "$@" > "$stdout_file"
        then
            cat "$stdout_file"
            rm -f "$stdout_file"
            return 0
        else
            curl_status=$?
        fi
        (( attempt < RELEASE_DOWNLOAD_ATTEMPTS )) || break
        now="$(date +%s)"
        remaining=$((RELEASE_DOWNLOAD_TOTAL_TIMEOUT_SECONDS - (now - started)))
        (( remaining > 3 )) || break
        sleep 3
    done
    rm -f "$stdout_file"
    return "$curl_status"
}

asset_snapshot() {
    jq -c '[.assets[] | {name, id, size, updatedAt, digest}] | sort_by(.name)'
}

assert_exact_asset_names() {
    local release_json="$1"
    local release_label="$2"
    shift 2
    local expected_json
    expected_json="$(printf '%s\n' "$@" | jq -R . | jq -s 'sort')"
    jq -e --argjson expected "$expected_json" \
        '([.assets[].name] | sort) == $expected' \
        <<< "$release_json" >/dev/null ||
        fail "$release_label must contain exactly: $*"
}

assert_exact_release_assets() {
    local release_json="$1"
    local release_label="$2"
    local names=()
    while IFS= read -r name; do names+=("$name"); done < <(source_asset_names)
    assert_exact_asset_names "$release_json" "$release_label" "${names[@]}"
}

assert_exact_update_assets() {
    local release_json="$1"
    local names=()
    while IFS= read -r name; do names+=("$name"); done < <(update_asset_names)
    assert_exact_asset_names "$release_json" "Public updater release" "${names[@]}"
}

derive_sparkle_public_key() {
    local private_key_file="$1"
    xcrun swift "$CONTROL_PLANE_SCRIPTS_DIR/derive_sparkle_public_key.swift" "$private_key_file"
}

validate_checksum_manifest() {
    (
        cd "$SOURCE_ASSETS_DIR"
        checksum_asset_names | sort > "$TMP_DIR/expected-checksum-files.txt"
        awk '{ print $2 }' "$CHECKSUMS_NAME" | sort > "$TMP_DIR/checksum-files.txt"
        diff -u "$TMP_DIR/expected-checksum-files.txt" "$TMP_DIR/checksum-files.txt" ||
            fail "$CHECKSUMS_NAME must contain exactly the reviewed release asset set for the $RELEASE_ARTIFACT_ROLE role"
        shasum -a 256 -c "$CHECKSUMS_NAME"
    )
}

verify_reviewed_checksums_digest() {
    require_env REVIEWED_CHECKSUMS_SHA256
    local actual_digest
    actual_digest="$(shasum -a 256 "$CHECKSUMS" | awk '{ print $1 }')"
    [[ "$actual_digest" == "$REVIEWED_CHECKSUMS_SHA256" ]] ||
        fail "Reviewed SHA256SUMS digest mismatch: expected $REVIEWED_CHECKSUMS_SHA256, got $actual_digest"
}

validate_app_bundle() {
    local app_bundle="$1"
    local artifact_manifest="$2"
    codesign --verify --deep --strict --verbose=2 "$app_bundle"

    local signature_details team_identifier
    signature_details="$(codesign -dv --verbose=4 "$app_bundle" 2>&1)"
    team_identifier="$(printf '%s\n' "$signature_details" |
        awk -F= '$1 == "TeamIdentifier" { print $2; exit }')"
    printf '%s\n' "$signature_details" | grep -q '^Authority=Developer ID Application:' ||
        fail "Update app is not signed with a Developer ID Application certificate"
    [[ "$team_identifier" == "$SIGNING_TEAM_ID" ]] ||
        fail "Signed app team mismatch: expected $SIGNING_TEAM_ID, got ${team_identifier:-<missing>}"
    xcrun stapler validate "$app_bundle"

    REPOPROMPT_RELEASE_SOURCE_ROOT="$ROOT_DIR" \
        "$CONTROL_PLANE_SCRIPTS_DIR/validate_packaged_legal.sh" "$app_bundle"
    python3 "$CONTROL_PLANE_SCRIPTS_DIR/codex_runtime_artifact.py" \
        --manifest "$ROOT_DIR/Vendor/Codex/manifest.json" verify-bundle \
        --arch all \
        --bundle "$app_bundle/Contents/Resources/BundledRuntimes/Codex" \
        --signed-team-identifier "$SIGNING_TEAM_ID"
    validate_embedded_mcp_helper_layout "$app_bundle" "Reviewed ZIP MCP helper layout"
    "$CONTROL_PLANE_SCRIPTS_DIR/validate_app_architectures.sh" \
        "$app_bundle" \
        "arm64,x86_64" \
        "Reviewed ZIP app"
    "$CONTROL_PLANE_SCRIPTS_DIR/write_app_artifact_manifest.py" verify \
        --app "$app_bundle" \
        --manifest "$artifact_manifest" \
        --expected-architectures "arm64,x86_64"
}

validate_dmg_matches_zip_app() {
    DMG_MOUNT_POINT="$TMP_DIR/dmg-mount"
    mkdir -p "$DMG_MOUNT_POINT"
    hdiutil attach "$DMG" -readonly -nobrowse -mountpoint "$DMG_MOUNT_POINT" >/dev/null

    local dmg_app="$DMG_MOUNT_POINT/$DISTRIBUTION_APP_BUNDLE_NAME"
    [[ -d "$dmg_app" ]] || fail "DMG does not contain $DISTRIBUTION_APP_BUNDLE_NAME at its root"
    diff -qr "$APP_BUNDLE" "$dmg_app" ||
        fail "DMG app contents do not match the verified update ZIP app"
    validate_embedded_mcp_helper_layout "$dmg_app" "Mounted DMG MCP helper layout"
    python3 "$CONTROL_PLANE_SCRIPTS_DIR/codex_runtime_artifact.py" \
        --manifest "$ROOT_DIR/Vendor/Codex/manifest.json" verify-bundle \
        --arch all \
        --bundle "$dmg_app/Contents/Resources/BundledRuntimes/Codex" \
        --signed-team-identifier "$SIGNING_TEAM_ID"
    "$CONTROL_PLANE_SCRIPTS_DIR/validate_app_architectures.sh" \
        "$dmg_app" \
        "arm64,x86_64" \
        "Mounted DMG app"
    "$CONTROL_PLANE_SCRIPTS_DIR/write_app_artifact_manifest.py" verify \
        --app "$dmg_app" \
        --manifest "$ARTIFACT_MANIFEST" \
        --expected-architectures "arm64,x86_64"

    hdiutil detach "$DMG_MOUNT_POINT" >/dev/null
    DMG_MOUNT_POINT=""
}

validate_appcast() {
    require_resolved_role
    python3 "$STABLE_ROLLOUT_TOOL" validate \
        --declaration "$ROLLOUT_DECLARATION" \
        --policy "$APPLE_IDENTITY_POLICY" \
        --version-env "$ROOT_DIR/version.env" \
        --release-tag "$RELEASE_TAG" \
        --release-commit "$RELEASE_COMMIT" \
        --migration-phase "$(python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['expectedMigrationPhase'])" "$ROLLOUT_DECLARATION")" \
        --allowed-roles legacy,preparer \
        --enclosure "$PRIMARY_ARTIFACT" \
        --app-artifact-manifest "$ARTIFACT_MANIFEST" \
        --appcast "$APPCAST" \
        --manifest "$ROLLOUT_MANIFEST"

    local enclosure_signature
    enclosure_signature="$(python3 -c "import json,sys;print(json.load(open(sys.argv[1]))['appcastItems'][0]['edSignature'])" "$ROLLOUT_MANIFEST")"
    [[ -n "$enclosure_signature" ]] || fail "Appcast enclosure is missing an EdDSA signature"

    local private_key_file="$TMP_DIR/sparkle-private-key"
    local committed_public_key_file="$TMP_DIR/sparkle-public-key"
    umask 077
    printf '%s' "$SPARKLE_PRIVATE_KEY" > "$private_key_file"
    local derived_public_key committed_public_key archive_signature
    derived_public_key="$(derive_sparkle_public_key "$private_key_file")"
    committed_public_key="$(plutil -extract SUPublicEDKey raw "$APP_BUNDLE/Contents/Info.plist")"
    [[ "$derived_public_key" == "$committed_public_key" ]] ||
        fail "Protected Sparkle private key does not match the app bundle SUPublicEDKey"
    archive_signature="$(printf '%s' "$SPARKLE_PRIVATE_KEY" |
        "$SIGN_UPDATE" --ed-key-file - -p "$PRIMARY_ARTIFACT" |
        tr -d '\r\n')"
    [[ "$archive_signature" == "$enclosure_signature" ]] ||
        fail "Protected Sparkle private key does not reproduce the reviewed appcast signature"
    printf '%s' "$committed_public_key" > "$committed_public_key_file"
    xcrun swift "$CONTROL_PLANE_SCRIPTS_DIR/verify_sparkle_signature.swift" \
        "$committed_public_key_file" "$enclosure_signature" "$PRIMARY_ARTIFACT"

    verify_sibling_enclosures "$committed_public_key_file"
}

# Every predecessor sibling stays on its own immutable per-tag updater URL.
# Each sibling's enclosure is re-downloaded and proven by exact size, SHA-256
# digest, and EdDSA signature under the unchanged committed key, and each
# predecessor rollout manifest is re-downloaded and proven against the SHA-256
# binding reviewed in release-rollout.json. Predecessor binaries are verified
# in place and never copied into the current release.
verify_sibling_enclosures() {
    local committed_public_key_file="$1"
    local sibling_values="$TMP_DIR/sibling-values.tsv"
    python3 "$STABLE_ROLLOUT_TOOL" sibling-values --manifest "$ROLLOUT_MANIFEST" > "$sibling_values"
    local sibling_dir="$TMP_DIR/sibling-enclosures"
    mkdir -p "$sibling_dir"
    local position role tag url size sha256 signature manifest_name manifest_sha256
    local sibling_asset sibling_manifest actual_digest
    while IFS=$'\t' read -r position role tag url size sha256 signature manifest_name manifest_sha256; do
        [[ "$tag" != "$RELEASE_TAG" ]] ||
            fail "Sibling appcast items must stay on their own updater tags, found current tag $tag"
        sibling_asset="$sibling_dir/$position-$(basename "$url")"
        curl_anonymous "$url" --output "$sibling_asset"
        [[ "$(stat -f %z "$sibling_asset")" == "$size" ]] ||
            fail "Sibling enclosure length mismatch for $url"
        actual_digest="$(shasum -a 256 "$sibling_asset" | awk '{ print $1 }')"
        [[ "$actual_digest" == "$sha256" ]] ||
            fail "Sibling enclosure digest mismatch for $url"
        xcrun swift "$CONTROL_PLANE_SCRIPTS_DIR/verify_sparkle_signature.swift" \
            "$committed_public_key_file" "$signature" "$sibling_asset"
        sibling_manifest="$sibling_dir/$position-$manifest_name"
        curl_anonymous \
            "https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/download/$tag/$manifest_name" \
            --output "$sibling_manifest"
        actual_digest="$(shasum -a 256 "$sibling_manifest" | awk '{ print $1 }')"
        [[ "$actual_digest" == "$manifest_sha256" ]] ||
            fail "Sibling rollout manifest digest mismatch for tag $tag"
    done < "$sibling_values"
}

verify_source_release() {
    resolve_release_artifact_role
    require_env RELEASE_TAG
    require_env RELEASE_COMMIT
    require_env SOURCE_GH_TOKEN
    require_env SPARKLE_PRIVATE_KEY
    require_release_tag_matches_metadata
    for command in cat codesign curl date diff ditto gh hdiutil jq mktemp plutil python3 shasum sleep stat xcrun; do
        require_command "$command"
    done
    require_file "$SIGN_UPDATE"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/validate_packaged_legal.sh"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/verify_remote_release_commit.sh"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/verify_sparkle_vendor.sh"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/verify_sparkle_signature.swift"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/validate_embedded_mcp_helper_layout.sh"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/validate_app_architectures.sh"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/write_app_artifact_manifest.py"
    require_file "$CONTROL_PLANE_SCRIPTS_DIR/codex_runtime_artifact.py"
    require_file "$ROOT_DIR/Vendor/Codex/manifest.json"
    "$CONTROL_PLANE_SCRIPTS_DIR/verify_remote_release_commit.sh" "$RELEASE_TAG" "$RELEASE_COMMIT"
    REPOPROMPT_RELEASE_SOURCE_ROOT="$ROOT_DIR" \
        "$CONTROL_PLANE_SCRIPTS_DIR/verify_sparkle_vendor.sh"

    TMP_DIR="$(mktemp -d)"
    SOURCE_ASSETS_DIR="$TMP_DIR/source-assets"
    EXTRACT_DIR="$TMP_DIR/extract"
    mkdir -p "$SOURCE_ASSETS_DIR" "$EXTRACT_DIR"

    local source_release_json
    source_release_json="$(source_gh release view "$RELEASE_TAG" \
        --repo "$SOURCE_GITHUB_REPOSITORY" \
        --json tagName,isDraft,isPrerelease,assets,body)"
    [[ "$(jq -r .tagName <<< "$source_release_json")" == "$RELEASE_TAG" ]] ||
        fail "Reviewed source release tag mismatch"
    [[ "$(jq -r .isPrerelease <<< "$source_release_json")" == "false" ]] ||
        fail "Source release must not be a prerelease"
    grep -Fq "Release-Commit: \`$RELEASE_COMMIT\`" <<< "$(jq -r .body <<< "$source_release_json")" ||
        fail "Source release is missing its approved release-commit attestation"
    SOURCE_RELEASE_WAS_DRAFT="$(jq -r .isDraft <<< "$source_release_json")"
    [[ "$SOURCE_RELEASE_WAS_DRAFT" == "true" || "$SOURCE_RELEASE_WAS_DRAFT" == "false" ]] ||
        fail "Unable to determine source release draft state"
    assert_exact_release_assets "$source_release_json" "Reviewed source release"
    SOURCE_RELEASE_ASSET_SNAPSHOT="$(asset_snapshot <<< "$source_release_json")"

    source_gh release download "$RELEASE_TAG" \
        --repo "$SOURCE_GITHUB_REPOSITORY" \
        --dir "$SOURCE_ASSETS_DIR" \
        --pattern "$CHECKSUMS_NAME"
    CHECKSUMS="$SOURCE_ASSETS_DIR/$CHECKSUMS_NAME"
    verify_reviewed_checksums_digest
    local download_args=()
    local expected_asset
    while IFS= read -r expected_asset; do
        [[ "$expected_asset" == "$CHECKSUMS_NAME" ]] && continue
        download_args+=(--pattern "$expected_asset")
    done < <(source_asset_names)
    source_gh release download "$RELEASE_TAG" \
        --repo "$SOURCE_GITHUB_REPOSITORY" \
        --dir "$SOURCE_ASSETS_DIR" \
        "${download_args[@]}"
    recheck_source_assets

    UPDATE_ZIP="$SOURCE_ASSETS_DIR/$UPDATE_ZIP_NAME"
    DMG="$SOURCE_ASSETS_DIR/$DMG_NAME"
    PRIMARY_ARTIFACT="$SOURCE_ASSETS_DIR/$PRIMARY_ARTIFACT_NAME"
    APPCAST="$SOURCE_ASSETS_DIR/$APPCAST_NAME"
    ARTIFACT_MANIFEST="$SOURCE_ASSETS_DIR/$ARTIFACT_MANIFEST_NAME"
    ROLLOUT_MANIFEST="$SOURCE_ASSETS_DIR/$ROLLOUT_MANIFEST_NAME"
    validate_checksum_manifest

    ditto -x -k "$UPDATE_ZIP" "$EXTRACT_DIR"
    [[ -d "$EXTRACT_DIR/$DISTRIBUTION_APP_BUNDLE_NAME" ]] ||
        fail "Update ZIP must contain $DISTRIBUTION_APP_BUNDLE_NAME at its root"
    APP_BUNDLE="$EXTRACT_DIR/$DISTRIBUTION_APP_BUNDLE_NAME"
    validate_app_bundle "$APP_BUNDLE" "$ARTIFACT_MANIFEST"
    xcrun stapler validate "$DMG"
    validate_dmg_matches_zip_app

    local info_plist="$APP_BUNDLE/Contents/Info.plist"
    local bundle_identifier marketing_version build_number feed_url
    bundle_identifier="$(plutil -extract CFBundleIdentifier raw "$info_plist")"
    marketing_version="$(plutil -extract CFBundleShortVersionString raw "$info_plist")"
    build_number="$(plutil -extract CFBundleVersion raw "$info_plist")"
    feed_url="$(plutil -extract SUFeedURL raw "$info_plist")"
    [[ "$bundle_identifier" == "$BUNDLE_ID" ]] ||
        fail "Bundle identifier mismatch: expected $BUNDLE_ID, got $bundle_identifier"
    [[ "$marketing_version" == "$MARKETING_VERSION" ]] ||
        fail "Marketing version mismatch: expected $MARKETING_VERSION, got $marketing_version"
    [[ "$build_number" == "$BUILD_NUMBER" ]] ||
        fail "Build number mismatch: expected $BUILD_NUMBER, got $build_number"
    [[ "$feed_url" == "$PUBLIC_FEED_URL" ]] ||
        fail "Sparkle feed mismatch: expected $PUBLIC_FEED_URL, got $feed_url"
    validate_appcast

    printf 'OK: reviewed source release assets verified for %s.\n' "$RELEASE_TAG"
}

recheck_source_assets() {
    local current_json current_snapshot
    current_json="$(source_gh release view "$RELEASE_TAG" \
        --repo "$SOURCE_GITHUB_REPOSITORY" \
        --json tagName,isDraft,isPrerelease,assets,body)"
    "$CONTROL_PLANE_SCRIPTS_DIR/verify_remote_release_commit.sh" "$RELEASE_TAG" "$RELEASE_COMMIT"
    grep -Fq "Release-Commit: \`$RELEASE_COMMIT\`" <<< "$(jq -r .body <<< "$current_json")" ||
        fail "Source release lost its approved release-commit attestation"
    assert_exact_release_assets "$current_json" "Reviewed source release"
    current_snapshot="$(asset_snapshot <<< "$current_json")"
    [[ "$current_snapshot" == "$SOURCE_RELEASE_ASSET_SNAPSHOT" ]] ||
        fail "Source release assets changed after verification; rerun promotion from a fresh review"
}

verify_strictly_newer_build() {
    local latest_json_file="$TMP_DIR/latest-release.json"
    local latest_status latest_json latest_tag latest_appcast latest_build
    validate_release_download_bounds
    if ! latest_status="$(env -u GH_TOKEN -u GITHUB_TOKEN curl \
        --location \
        --silent \
        --show-error \
        --connect-timeout "$RELEASE_DOWNLOAD_CONNECT_TIMEOUT_SECONDS" \
        --max-time "$RELEASE_DOWNLOAD_ATTEMPT_TIMEOUT_SECONDS" \
        --header "Authorization: Bearer $PUBLIC_UPDATE_GH_TOKEN" \
        --header "Accept: application/vnd.github+json" \
        --output "$latest_json_file" \
        --write-out '%{http_code}' \
        "https://api.github.com/repos/$PUBLIC_UPDATE_REPOSITORY/releases/latest")"; then
        fail "Unable to query the current stable updater release"
    fi
    if [[ "$latest_status" == "404" ]]; then
        return
    fi
    [[ "$latest_status" == "200" ]] ||
        fail "Unable to query the current stable updater release: HTTP $latest_status"
    latest_json="$(cat "$latest_json_file")"
    latest_tag="$(jq -r .tag_name <<< "$latest_json")"
    if [[ "$latest_tag" == "$RELEASE_TAG" ]]; then
        return 0
    fi

    latest_appcast="$TMP_DIR/latest-appcast.xml"
    curl_anonymous \
        "https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/download/$latest_tag/$APPCAST_NAME" \
        --output "$latest_appcast"
    latest_build="$(python3 "$STABLE_ROLLOUT_TOOL" max-build --appcast "$latest_appcast")"
    [[ "$BUILD_NUMBER" =~ ^[0-9]+$ && "$latest_build" =~ ^[0-9]+$ ]] ||
        fail "Stable build numbers must be numeric: current=$BUILD_NUMBER latest=$latest_build"
    (( BUILD_NUMBER > latest_build )) ||
        fail "Stable promotion requires BUILD_NUMBER > $latest_build, got $BUILD_NUMBER"
}

verify_existing_update_release() {
    local update_release_json="$1"
    local existing_assets_dir="$TMP_DIR/existing-update-assets"
    assert_exact_update_assets "$update_release_json"
    mkdir -p "$existing_assets_dir"
    local download_args=()
    local expected_asset
    while IFS= read -r expected_asset; do
        download_args+=(--pattern "$expected_asset")
    done < <(update_asset_names)
    update_gh release download "$RELEASE_TAG" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --dir "$existing_assets_dir" \
        "${download_args[@]}"
    cmp "$PRIMARY_ARTIFACT" "$existing_assets_dir/$PRIMARY_ARTIFACT_NAME"
    cmp "$APPCAST" "$existing_assets_dir/$APPCAST_NAME"
    cmp "$CHECKSUMS" "$existing_assets_dir/$CHECKSUMS_NAME"
    cmp "$ARTIFACT_MANIFEST" "$existing_assets_dir/$ARTIFACT_MANIFEST_NAME"
    cmp "$ROLLOUT_MANIFEST" "$existing_assets_dir/$ROLLOUT_MANIFEST_NAME"
}

prepare_update_release() {
    local update_release_json
    if update_release_json="$(update_gh release view "$RELEASE_TAG" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --json tagName,isDraft,isPrerelease,assets 2>/dev/null)"; then
        [[ "$(jq -r .tagName <<< "$update_release_json")" == "$RELEASE_TAG" ]] ||
            fail "Public updater release tag mismatch"
        [[ "$(jq -r .isPrerelease <<< "$update_release_json")" == "false" ]] ||
            fail "Public updater release must not be a prerelease"
        verify_existing_update_release "$update_release_json"
        UPDATE_RELEASE_ASSET_SNAPSHOT="$(asset_snapshot <<< "$update_release_json")"
        if [[ "$(jq -r .isDraft <<< "$update_release_json")" == "true" ]]; then
            UPDATE_RELEASE_STATE="draft"
        else
            UPDATE_RELEASE_STATE="published"
        fi
        return
    fi

    update_gh release create "$RELEASE_TAG" \
        "$PRIMARY_ARTIFACT" \
        "$APPCAST" \
        "$CHECKSUMS" \
        "$ARTIFACT_MANIFEST" \
        "$ROLLOUT_MANIFEST" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --target main \
        --draft \
        --latest=false \
        --title "$DISPLAY_NAME $MARKETING_VERSION" \
        --notes "Stable Sparkle update assets for $DISPLAY_NAME $MARKETING_VERSION ($BUILD_NUMBER)."
    UPDATE_RELEASE_STATE="draft"
    update_release_json="$(update_gh release view "$RELEASE_TAG" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --json tagName,isDraft,isPrerelease,assets)"
    assert_exact_update_assets "$update_release_json"
    UPDATE_RELEASE_ASSET_SNAPSHOT="$(asset_snapshot <<< "$update_release_json")"
}

recheck_update_assets() {
    local current_json current_snapshot
    current_json="$(update_gh release view "$RELEASE_TAG" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --json tagName,isDraft,isPrerelease,assets)"
    assert_exact_update_assets "$current_json"
    current_snapshot="$(asset_snapshot <<< "$current_json")"
    [[ "$current_snapshot" == "$UPDATE_RELEASE_ASSET_SNAPSHOT" ]] ||
        fail "Public updater release assets changed after verification; rerun promotion from a fresh review"
}

publish_reviewed_release() {
    require_env PUBLIC_UPDATE_GH_TOKEN
    [[ "$(source_gh repo view "$SOURCE_GITHUB_REPOSITORY" --json visibility --jq .visibility)" == "PUBLIC" ]] ||
        fail "Stable promotion requires a public source repository: $SOURCE_GITHUB_REPOSITORY"
    [[ "$(update_gh repo view "$PUBLIC_UPDATE_REPOSITORY" --json visibility --jq .visibility)" == "PUBLIC" ]] ||
        fail "Update repository must be public: $PUBLIC_UPDATE_REPOSITORY"

    verify_strictly_newer_build
    verify_reviewed_checksums_digest
    recheck_source_assets
    prepare_update_release
    recheck_source_assets
    recheck_update_assets
    verify_reviewed_checksums_digest

    update_gh release edit "$RELEASE_TAG" \
        --repo "$PUBLIC_UPDATE_REPOSITORY" \
        --draft=false \
        --latest
    recheck_source_assets
    source_gh release edit "$RELEASE_TAG" \
        --repo "$SOURCE_GITHUB_REPOSITORY" \
        --draft=false \
        --latest
}

verify_anonymous_publish() {
    local published_update_appcast="$TMP_DIR/published-update-appcast.xml"
    local published_update_primary="$TMP_DIR/published-update-$PRIMARY_ARTIFACT_NAME"
    local published_update_checksums="$TMP_DIR/published-update-$CHECKSUMS_NAME"
    local published_update_manifest="$TMP_DIR/published-update-$ARTIFACT_MANIFEST_NAME"
    local published_update_rollout="$TMP_DIR/published-update-$ROLLOUT_MANIFEST_NAME"
    local published_source_rollout="$TMP_DIR/published-source-$ROLLOUT_MANIFEST_NAME"
    local published_source_primary="$TMP_DIR/published-source-$PRIMARY_ARTIFACT_NAME"
    local published_source_dmg="$TMP_DIR/published-source-$DMG_NAME"
    local published_source_appcast="$TMP_DIR/published-source-$APPCAST_NAME"
    local published_source_checksums="$TMP_DIR/published-source-$CHECKSUMS_NAME"
    local published_source_manifest="$TMP_DIR/published-source-$ARTIFACT_MANIFEST_NAME"

    curl_anonymous "$PUBLIC_FEED_URL" --output "$published_update_appcast"
    curl_anonymous "$PUBLIC_UPDATE_BASE_URL/$PRIMARY_ARTIFACT_NAME" --output "$published_update_primary"
    curl_anonymous "$PUBLIC_UPDATE_BASE_URL/$CHECKSUMS_NAME" --output "$published_update_checksums"
    curl_anonymous "$PUBLIC_UPDATE_BASE_URL/$ARTIFACT_MANIFEST_NAME" --output "$published_update_manifest"
    curl_anonymous "$PUBLIC_UPDATE_BASE_URL/$ROLLOUT_MANIFEST_NAME" --output "$published_update_rollout"
    curl_anonymous "$SOURCE_RELEASE_BASE_URL/$PRIMARY_ARTIFACT_NAME" --output "$published_source_primary"
    if release_role_ships_dmg; then
        curl_anonymous "$SOURCE_RELEASE_BASE_URL/$DMG_NAME" --output "$published_source_dmg"
    fi
    curl_anonymous "$SOURCE_RELEASE_BASE_URL/$APPCAST_NAME" --output "$published_source_appcast"
    curl_anonymous "$SOURCE_RELEASE_BASE_URL/$CHECKSUMS_NAME" --output "$published_source_checksums"
    curl_anonymous "$SOURCE_RELEASE_BASE_URL/$ARTIFACT_MANIFEST_NAME" --output "$published_source_manifest"
    curl_anonymous "$SOURCE_RELEASE_BASE_URL/$ROLLOUT_MANIFEST_NAME" --output "$published_source_rollout"

    cmp "$APPCAST" "$published_update_appcast"
    cmp "$PRIMARY_ARTIFACT" "$published_update_primary"
    cmp "$CHECKSUMS" "$published_update_checksums"
    cmp "$ARTIFACT_MANIFEST" "$published_update_manifest"
    cmp "$PRIMARY_ARTIFACT" "$published_source_primary"
    if release_role_ships_dmg; then
        cmp "$DMG" "$published_source_dmg"
    fi
    cmp "$APPCAST" "$published_source_appcast"
    cmp "$CHECKSUMS" "$published_source_checksums"
    cmp "$ARTIFACT_MANIFEST" "$published_source_manifest"
    cmp "$ROLLOUT_MANIFEST" "$published_update_rollout"
    cmp "$ROLLOUT_MANIFEST" "$published_source_rollout"

    local update_latest_url source_latest_url
    update_latest_url="$(curl_anonymous \
        --output /dev/null \
        --write-out '%{url_effective}' \
        "https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/latest")"
    source_latest_url="$(curl_anonymous \
        --output /dev/null \
        --write-out '%{url_effective}' \
        "https://github.com/$SOURCE_GITHUB_REPOSITORY/releases/latest")"
    [[ "$update_latest_url" == "https://github.com/$PUBLIC_UPDATE_REPOSITORY/releases/tag/$RELEASE_TAG" ]] ||
        fail "Public updater latest redirect mismatch: $update_latest_url"
    [[ "$source_latest_url" == "https://github.com/$SOURCE_GITHUB_REPOSITORY/releases/tag/$RELEASE_TAG" ]] ||
        fail "Source latest redirect mismatch: $source_latest_url"

    printf 'OK: anonymous release smoke passed for %s.\n' "$RELEASE_TAG"
}

if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
    case "$MODE" in
        verify)
            verify_source_release
            ;;
        promote)
            verify_source_release
            preflight_sentry_deploy_access
            publish_reviewed_release
            verify_anonymous_publish
            record_verified_sentry_deploy_if_needed
            ;;
        *)
            fail "Usage: $0 verify|promote"
            ;;
    esac
fi