精简 Release 产物并使用内置摘要

.github/workflows/release.yml

@@ -761,16 +761,13 @@ jobs:
             tar -czf "release/$ASSET" -C package .
             tar -tzf "release/$ASSET" >/dev/null
           fi
-          (cd release && sha256sum "$ASSET" > "$ASSET.sha256")
       - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: release/${{ matrix.asset }}
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: server-bundle-${{ matrix.binary }}
-          path: |
-            release/${{ matrix.asset }}
-            release/${{ matrix.asset }}.sha256
+          path: release/${{ matrix.asset }}
           if-no-files-found: error
 
   release:
@@ -804,10 +801,14 @@ jobs:
           printf '\n' >> CHANGELOG.md
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
+          pattern: agent-*
+          path: release-assets
+          merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: server-bundle-*
           path: release-assets
           merge-multiple: true
-      - name: Include installer
-        run: cp install.sh install.ps1 release-assets/
       - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.3
         with:
           body_path: CHANGELOG.md

README.md

@@ -11,19 +11,19 @@ NodeFlare 是一个自部署的服务器监控面板，支持 SQLite、PostgreSQ
 Linux 或 macOS：
 
 ```bash
-curl -fsSL https://github.com/imengying/NodeFlare/releases/latest/download/install.sh | sudo sh
+curl -fsSL https://raw.githubusercontent.com/imengying/NodeFlare/main/install.sh | sudo sh
 ```
 
 FreeBSD：
 
 ```sh
-fetch -qo - https://github.com/imengying/NodeFlare/releases/latest/download/install.sh | sudo sh
+fetch -qo - https://raw.githubusercontent.com/imengying/NodeFlare/main/install.sh | sudo sh
 ```
 
 Windows PowerShell（管理员）：
 
 ```powershell
-Invoke-WebRequest https://github.com/imengying/NodeFlare/releases/latest/download/install.ps1 -OutFile "$env:TEMP\nodeflare-install.ps1"
+Invoke-WebRequest https://raw.githubusercontent.com/imengying/NodeFlare/main/install.ps1 -OutFile "$env:TEMP\nodeflare-install.ps1"
 Unblock-File "$env:TEMP\nodeflare-install.ps1"
 & "$env:TEMP\nodeflare-install.ps1"
 ```
@@ -53,19 +53,19 @@ journalctl -u nodeflare -f
 重新执行安装命令即可更新。Linux 和 macOS 卸载时默认保留配置和数据库：
 
 ```bash
-curl -fsSL https://github.com/imengying/NodeFlare/releases/latest/download/install.sh | sudo sh -s -- --uninstall
+curl -fsSL https://raw.githubusercontent.com/imengying/NodeFlare/main/install.sh | sudo sh -s -- --uninstall
 ```
 
 同时删除配置和数据：
 
 ```bash
-curl -fsSL https://github.com/imengying/NodeFlare/releases/latest/download/install.sh | sudo sh -s -- --uninstall --purge
+curl -fsSL https://raw.githubusercontent.com/imengying/NodeFlare/main/install.sh | sudo sh -s -- --uninstall --purge
 ```
 
 FreeBSD：
 
 ```sh
-fetch -qo - https://github.com/imengying/NodeFlare/releases/latest/download/install.sh | sudo sh -s -- --uninstall
+fetch -qo - https://raw.githubusercontent.com/imengying/NodeFlare/main/install.sh | sudo sh -s -- --uninstall
 ```
 
 彻底删除时在末尾添加 `--purge`。

install.ps1

@@ -102,21 +102,24 @@ if ($NativeArchitecture -ne "AMD64") {
 }
 
 $Asset = "nodeflare-server-windows-x64.zip"
-$ReleaseBase = "https://github.com/$Repository/releases/latest/download"
+$ReleaseApi = "https://api.github.com/repos/$Repository/releases/latest"
 $TemporaryDir = Join-Path $env:TEMP "nodeflare-install-$PID"
 $Archive = Join-Path $TemporaryDir $Asset
-$Checksum = "$Archive.sha256"
 $PackageDir = Join-Path $TemporaryDir "package"
 
 try {
   New-Item -ItemType Directory -Path $TemporaryDir -Force | Out-Null
-  Write-Step "下载 latest Release（Windows x64）"
-  Invoke-WebRequest -UseBasicParsing -Uri "$ReleaseBase/$Asset" -OutFile $Archive -TimeoutSec 120
-  Invoke-WebRequest -UseBasicParsing -Uri "$ReleaseBase/$Asset.sha256" -OutFile $Checksum -TimeoutSec 30
-  $Expected = ((Get-Content -LiteralPath $Checksum -Raw).Trim() -split '\s+')[0]
-  if ($Expected -notmatch '^[0-9a-fA-F]{64}$') {
-    Stop-Install "Release 校验文件无效"
+  Write-Step "获取 latest Release（Windows x64）"
+  $Release = Invoke-RestMethod -Uri $ReleaseApi -Headers @{ Accept = "application/vnd.github+json"; "User-Agent" = "nodeflare-installer" } -TimeoutSec 30
+  $ReleaseAsset = $Release.assets | Where-Object { $_.name -eq $Asset } | Select-Object -First 1
+  if ($Release.tag_name -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+$' -or $null -eq $ReleaseAsset) {
+    Stop-Install "GitHub 最新 Release 无效，或缺少 $Asset"
   }
+  $DigestMatch = [regex]::Match([string]$ReleaseAsset.digest, '^sha256:([0-9a-fA-F]{64})$')
+  if (-not $DigestMatch.Success) { Stop-Install "Release 缺少 $Asset 的 SHA-256 摘要" }
+  $Expected = $DigestMatch.Groups[1].Value
+  Write-Step "下载 NodeFlare $($Release.tag_name)（Windows x64）"
+  Invoke-WebRequest -UseBasicParsing -Uri $ReleaseAsset.browser_download_url -OutFile $Archive -TimeoutSec 120
   $Actual = (Get-FileHash -LiteralPath $Archive -Algorithm SHA256).Hash
   if ($Actual -ne $Expected) {
     Stop-Install "Release SHA-256 校验失败"
@@ -142,6 +145,9 @@ try {
   if ($Version -notmatch '^\d+\.\d+\.\d+$') {
     Stop-Install "服务端返回了无效版本号"
   }
+  if ($Version -ne $Release.tag_name.Substring(1)) {
+    Stop-Install "Release $($Release.tag_name) 与服务端版本 $Version 不一致"
+  }
 
   $NewConfig = -not (Test-Path -LiteralPath $ConfigFile)
   if ($NewConfig) {

install.sh

@@ -237,10 +237,20 @@ download_file() {
   fi
 }
 
+download_stdout() {
+  url=$1
+  if command -v curl >/dev/null 2>&1; then
+    curl --proto '=https' --proto-redir '=https' --tlsv1.2 \
+      --fail --location --silent --show-error --max-time 30 \
+      -H 'Accept: application/vnd.github+json' \
+      -H 'User-Agent: nodeflare-installer' \
+      "$url"
+  else
+    fetch -q -T 30 -o - "$url"
+  fi
+}
+
 verify_checksum() {
-  expected=$(sed -n '1{s/[[:space:]].*//;p;q;}' "$checksum" | tr '[:upper:]' '[:lower:]')
-  [ "${#expected}" -eq 64 ] || fail "Release 校验文件无效"
-  case "$expected" in *[!0-9a-f]*) fail "Release 校验文件无效" ;; esac
   case "$platform" in
     linux) actual=$(sha256sum "$archive" | sed 's/[[:space:]].*//') ;;
     macos) actual=$(shasum -a 256 "$archive" | sed 's/[[:space:]].*//') ;;
@@ -281,11 +291,34 @@ download_release() {
 
   download_dir=$(mktemp -d "${TMPDIR:-/tmp}/nodeflare-install.XXXXXX")
   archive=$download_dir/$asset
-  checksum=$download_dir/$asset.sha256
-  release_base="https://github.com/$repository/releases/latest/download"
-  log "下载 latest Release ($release_label)"
+  release_api="https://api.github.com/repos/$repository/releases/latest"
+  log "获取 latest Release ($release_label)"
+  release_json=$(download_stdout "$release_api")
+  release_tag=$(printf '%s\n' "$release_json" | tr ',' '\n' | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sed -n '1p')
+  printf '%s\n' "$release_tag" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+    || fail "GitHub 最新 Release 标签无效"
+  expected=$(printf '%s\n' "$release_json" | tr '{' '\n' | awk -v name="$asset" '
+    {
+      compact = $0
+      gsub(/[[:space:]]/, "", compact)
+      if (index(compact, "\"name\":\"" name "\"") > 0) selected = 1
+      else if (index(compact, "\"name\":") > 0) selected = 0
+    }
+    selected {
+      marker = "\"digest\":\"sha256:"
+      position = index(compact, marker)
+      if (position == 0) next
+      digest = substr(compact, position + length(marker), 64)
+      if (length(digest) == 64 && digest !~ /[^0-9a-fA-F]/) {
+        print tolower(digest)
+        exit
+      }
+    }
+  ')
+  [ -n "$expected" ] || fail "Release 缺少 $asset 的 SHA-256 摘要"
+  release_base="https://github.com/$repository/releases/download/$release_tag"
+  log "下载 NodeFlare $release_tag ($release_label)"
   download_file "$release_base/$asset" "$archive" 120
-  download_file "$release_base/$asset.sha256" "$checksum" 30
   verify_checksum
 
   package_dir=$download_dir/package
@@ -301,6 +334,8 @@ download_release() {
   release_version=${binary_version##* }
   printf '%s\n' "$release_version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' \
     || fail "服务端返回了无效版本号"
+  [ "$release_version" = "${release_tag#v}" ] \
+    || fail "Release $release_tag 与服务端版本 $release_version 不一致"
 }
 
 write_openrc_service() {