开发者中心 dev.cardputer.cc：网页上传 deb + 本地解析 + 抢占式包名归属（独立仓库源码）#12
Closed
eggfly wants to merge 1 commit into
Closed
Conversation
…pection Complete source for a standalone public repo (CardputerZero/dev-portal), Cloudflare Worker architecture with no database: - site/debparse.js: pure-browser .deb parser (ar/tar + gzip/xz/zstd) that extracts control fields, .desktop entry, app icon, maintainer email and a file listing, and produces a preliminary safety report (setuid/device files/path escapes/foreign-arch ELF/dangerous maintainer-script patterns); includes dpkg-semantics version comparison. Verified against real packages from the live apt pool (xz and zstd) plus fixture-based node tests. - worker/: same-origin Worker serving the static portal and the API. GitHub OAuth login with user:email scope reads verified emails for identity; first-submitter-owns-the-name policy and version-monotonicity pre-checks against the published APT index; uploads go to the packages repo's buffer release via the bot token, then repository_dispatch hands off to CI. - packages-workflows/: authoritative dpkg-deb validation (integrity, control, .desktop, structure and safety scan, verified-email ownership, version bump), store metadata from app-builder.json or generated from the deb, auto-created publish PR with optional auto-merge, unpublish flow with ownership re-verification, and failure feedback via issues mentioning the submitter. - Cloudflare deploy workflow and Chinese deployment guide. Co-authored-by: eggfly <lihaohua90@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
按需求实现「面向开发者的网页上传入口」完整源码（
dev-portal/目录）。设计为独立 public 仓库（建议CardputerZero/dev-portal）的内容——我的 token 无建仓权限（administration 只有 read），仓库建好后把这个目录推过去即可（或给我权限我来做）。功能对照需求
.deb，同域 POST 到 Worker（Cloudflare Worker 架构，无 CORS 问题）site/debparse.js：ar + tar + gzip/xz/zstd 前端解包），选中文件立即展示预览卡片，不用先上传user:emailscope 读取已验证邮箱列表；deb 的 Maintainer 邮箱必须 ∈ 已验证邮箱（或 noreply 地址）ADMIN_LOGINS管理员可管理任意包。归属状态直接读线上 APT 索引，无需数据库AUTO_MERGE="true"（可关）自动合并 → 现有update-index.yml管线更新 APT 索引与 registry架构
浏览器（本地解析+预检）→ Worker
dev.cardputer.cc（登录会话、归属/版本预检、存 buffer Release、repository_dispatch）→packages仓库 Actions（dpkg-deb 权威校验 + store 元数据 + 自动 PR/合并，失败开 issue @提交者）→ 现有 apt-pool/索引管线。信任模型：客户端解析只做体验层，一切以 CI 的服务端校验为准。
已验证
2048_0.1.0（xz）、nc2000_1.0.3（zstd）均正确解出图标/字段/清单node --test：4 个用例全过（干净包、gzip/zstd 变体、恶意包 flag、dpkg 版本语义）bash -n、内嵌 Python 编译均通过部署待办（人工）
CardputerZero/dev-portal仓库并推入本目录内容wrangler deploy+ 4 个 secret（README 有完整步骤）；GitHub OAuth App callback 指https://dev.cardputer.cc/auth/callbackpackages-workflows/两个文件复制进CardputerZero/packages组织已安装 Cursor App（All repositories），但我当前运行实例的 token 仍只覆盖本仓库（对
CardputerZero/packages推送实测仍 403，建仓 API 403——installation token 是按启动时的仓库签发的）。从 CardputerZero 组织的仓库（或加了权限后的新会话）发起的 agent 应该就能直接操作了；也可以手动建好空仓库后告诉我再试。