ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]

ci/publish-gitea-release.sh

@@ -114,4 +114,40 @@ for pid in "${pids[@]}"; do
   wait "$pid"
 done
 
+# 所有压缩包的校验和汇成一份 SHA256SUMS，用发布私钥签名（base64 的 DER ECDSA，和签名的发布清单是同一把密钥、同一种格式）：
+# 不走容器的安装（直接下载压缩包）先验这份签名再核对压缩包的哈希，发布页被改也骗不到；没有配置签名密钥（例如 fork）就跳过。
+upload_local_asset() {
+  local name="$1" file="$2" upload_response="$tmp/$1.upload.json" status
+  if grep -Eq "\"name\"[[:space:]]*:[[:space:]]*\"$name\"" "$assets_json"; then
+    echo "release asset $name already exists; keeping the existing asset"
+    return 0
+  fi
+  status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --request POST --header 'Content-Type: application/octet-stream' --data-binary "@$file" \
+    --output "$upload_response" --write-out '%{http_code}' "$api/releases/$release_id/assets?name=$name")"
+  [[ "$status" == 2* ]] || { echo "Gitea Release asset upload failed for $name (HTTP $status)" >&2; cat "$upload_response" >&2; return 1; }
+  echo "attached $name"
+}
+
+if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
+  sums="$tmp/SHA256SUMS"
+  : > "$sums"
+  for archive in "${assets[@]}"; do
+    curl --fail --silent --show-error --retry 3 --netrc-file "$netrc" \
+      "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$archive.sha256" -o "$tmp/$archive.sha256"
+    cat "$tmp/$archive.sha256" >> "$sums"
+  done
+  [[ "$(wc -l < "$sums")" -eq "${#assets[@]}" ]] || { echo "SHA256SUMS does not have one line per archive" >&2; exit 1; }
+  signing_key="$(mktemp)"
+  chmod 600 "$signing_key"
+  printf '%s\n' "$RELEASE_SIGNING_KEY" > "$signing_key"
+  openssl dgst -sha256 -sign "$signing_key" -out "$tmp/SHA256SUMS.sig.bin" "$sums"
+  rm -f "$signing_key"
+  base64 -w0 "$tmp/SHA256SUMS.sig.bin" > "$tmp/SHA256SUMS.sig" 2>/dev/null || base64 "$tmp/SHA256SUMS.sig.bin" | tr -d '\n' > "$tmp/SHA256SUMS.sig"
+  upload_local_asset SHA256SUMS "$sums"
+  upload_local_asset SHA256SUMS.sig "$tmp/SHA256SUMS.sig"
+else
+  echo "release signing is not configured; SHA256SUMS is not signed"
+fi
+
 echo "published Gitea Release $tag: https://git.oeo.one/justme/MoShiro/releases/tag/$tag"