#!/bin/bash
# fetch_telegram_public_key.sh
# 定义公钥ID和下载URL（此处为示例，需替换为电报官方实际信息）
TELEGRAM_PUBLIC_KEY_ID="XXXXXXXXXXXXXXXX"
OFFICIAL_KEY_SERVER="hkps://keys.openpgp.org"
# 或者从已知的官方网站下载公钥文件
PUBLIC_KEY_URL="https://core.telegram.org/static/pubkey.gpg"

echo "正在从官方源获取电报GPG公钥..."
# 方法1：从密钥服务器拉取
gpg --keyserver ${OFFICIAL_KEY_SERVER} --recv-keys ${TELEGRAM_PUBLIC_KEY_ID}

# 方法2：直接下载公钥文件并导入
# curl -s ${PUBLIC_KEY_URL} | gpg --import

if [ $? -eq 0 ]; then
    echo "公钥导入成功。"
    # 可选：标记公钥为绝对信任
    echo -e "trust\n5\ny\n" | gpg --command-fd 0 --edit-key ${TELEGRAM_PUBLIC_KEY_ID} trust
else
    echo "错误：无法获取或导入公钥！" >&2
    exit 1
fi

#!/bin/bash
# download_artifacts.sh
BASE_URL="https://github.com/telegramdesktop/tdesktop/releases/download/v4.x.x"
VERSION="4.0.0" # 示例版本
PLATFORM="windows"
PACKAGE_NAME="tsetup.${VERSION}.exe"
SIGNATURE_NAME="${PACKAGE_NAME}.sig"

DOWNLOAD_DIR="./artifacts/${VERSION}"
mkdir -p ${DOWNLOAD_DIR}

echo "正在下载安装包及其签名文件..."
curl -L -o "${DOWNLOAD_DIR}/${PACKAGE_NAME}" "${BASE_URL}/${PACKAGE_NAME}"
curl -L -o "${DOWNLOAD_DIR}/${SIGNATURE_NAME}" "${BASE_URL}/${SIGNATURE_NAME}"

# 验证文件是否下载完整
if [[ -f "${DOWNLOAD_DIR}/${PACKAGE_NAME}" && -f "${DOWNLOAD_DIR}/${SIGNATURE_NAME}" ]]; then
    echo "下载完成。"
else
    echo "错误：文件下载不完整！" >&2
    exit 1
fi

#!/bin/bash
# verify_signature.sh
DOWNLOAD_DIR="./artifacts/${VERSION}"
PACKAGE_NAME="tsetup.${VERSION}.exe"
SIGNATURE_NAME="${PACKAGE_NAME}.sig"

echo "开始GPG签名验证..."
gpg --verify "${DOWNLOAD_DIR}/${SIGNATURE_NAME}" "${DOWNLOAD_DIR}/${PACKAGE_NAME}"

VERIFY_EXIT_CODE=$?
if [ ${VERIFY_EXIT_CODE} -eq 0 ]; then
    echo "✅ 签名验证成功！安装包完整且来源可信。"
else
    echo "❌ 签名验证失败！退出码: ${VERIFY_EXIT_CODE}" >&2
    echo "可能原因：签名无效、文件被篡改、或公钥不匹配。" >&2
    exit ${VERIFY_EXIT_CODE}
fi

#!/bin/bash
# verify_hash.sh
DOWNLOAD_DIR="./artifacts/${VERSION}"
PACKAGE_NAME="tsetup.${VERSION}.exe"
EXPECTED_SHA256="这里是官方公布的SHA256哈希值，很长一串"

echo "计算下载文件的SHA256哈希值..."
ACTUAL_SHA256=$(sha256sum "${DOWNLOAD_DIR}/${PACKAGE_NAME}" | awk '{ print $1 }')

echo "预期哈希: ${EXPECTED_SHA256}"
echo "实际哈希: ${ACTUAL_SHA256}"

if [ "${EXPECTED_SHA256}" == "${ACTUAL_SHA256}" ]; then
    echo "✅ 哈希值验证成功！"
else
    echo "❌ 哈希值不匹配！文件可能已损坏或被篡改。" >&2
    exit 1
fi

pipeline {
    agent any
    environment {
        TELEGRAM_VERSION = '4.0.0' // 可通过参数化构建动态传入
        ARTIFACT_DIR = "./artifacts/${TELEGRAM_VERSION}"
    }
    stages {
        stage('准备环境') {
            steps {
                sh 'mkdir -p ${ARTIFACT_DIR}'
                script {
                    // 从Jenkins凭据库安全获取关键信息（如果有）
                    // 例如，官方哈希值可以存储在“Secret Text”类型的凭据中
                    // EXPECTED_HASH = credentials('telegram-package-sha256')
                }
            }
        }
        stage('获取公钥') {
            steps {
                sh '''
                    # 调用导入公钥的脚本
                    ./scripts/fetch_telegram_public_key.sh
                '''
            }
        }
        stage('下载制品') {
            steps {
                sh '''
                    # 调用下载脚本，版本号通过环境变量传递
                    TELEGRAM_VERSION=${TELEGRAM_VERSION} ./scripts/download_artifacts.sh
                '''
            }
        }
        stage('验证签名与哈希') {
            steps {
                sh '''
                    # 顺序执行验证，任何一步失败都会导致阶段失败
                    ./scripts/verify_signature.sh
                    ./scripts/verify_hash.sh
                '''
            }
        }
        stage('归档与后续处理') {
            when {
                expression { currentBuild.result == null || currentBuild.result == 'SUCCESS' }
            }
            steps {
                echo "验证通过，开始归档安全制品..."
                archiveArtifacts artifacts: "${ARTIFACT_DIR}/*", fingerprint: true
                // 可以在这里触发后续任务，例如：
                // 1. 同步到内部镜像站
                // 2. 更新下载页面元数据
                // 3. 部署到测试环境进行自动化安装测试
                // 例如，参考我们的文章《电报下载镜像站点同步方案：rsync与增量更新技术实现》(https://dinbao-cn.com/news/97/)
            }
        }
    }
    post {
        failure {
            echo '流水线验证失败！请检查日志。'
            // 集成通知告警，发送到Slack或Telegram群组
            slackSend(color: 'danger', message: "电报安装包验证失败: ${env.JOB_NAME} - ${env.BUILD_NUMBER}")
        }
        success {
            echo '流水线验证成功！'
            slackSend(color: 'good', message: "电报安装包验证成功: ${env.JOB_NAME} - ${env.BUILD_NUMBER}")
        }
    }
}

stages:
  - prepare
  - fetch-key
  - download
  - verify
  - deploy

variables:
  TELEGRAM_VERSION: "4.0.0"
  ARTIFACT_DIR: "artifacts/${TELEGRAM_VERSION}"

prepare-job:
  stage: prepare
  script:
    - mkdir -p ${ARTIFACT_DIR}
  artifacts:
    paths:
      - ${ARTIFACT_DIR}/

fetch-key-job:
  stage: fetch-key
  script:
    - ./scripts/fetch_telegram_public_key.sh
  dependencies:
    - prepare-job

download-job:
  stage: download
  script:
    - TELEGRAM_VERSION=${TELEGRAM_VERSION} ./scripts/download_artifacts.sh
  artifacts:
    paths:
      - ${ARTIFACT_DIR}/
  dependencies:
    - fetch-key-job

verify-job:
  stage: verify
  script:
    - ./scripts/verify_signature.sh
    - ./scripts/verify_hash.sh
  dependencies:
    - download-job
  only:
    - main # 仅在对主分支的合并等操作时运行

deploy-job:
  stage: deploy
  script:
    - echo "将已验证的包同步到生产服务器..."
    # 例如使用rsync命令，这里需要配置服务器密钥和地址
    - rsync -avz ${ARTIFACT_DIR}/ user@production-server:/var/www/telegram-downloads/${TELEGRAM_VERSION}/
  dependencies:
    - verify-job
  only:
    - main
  when: manual # 设置为手动触发，以便最终确认后部署