Run trusted private ROM and reference CI on docker-build (#66)

scripts/fetch-private-rom.mjs

@@ -0,0 +1,72 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const SIZE = 2 * 1024 * 1024;
+const SHA1 = "f2f52230b536214ef7c9924f483392993e226cfb";
+
+// Never print the private URL or network errors that might contain it.
+export async function downloadPrivateRom(url, destination, fetchImpl = fetch) {
+  if (!url || !destination)
+    throw new Error("Set CRYSTAL_ROM_URL and CRYSTAL_ROM_PATH.");
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("CRYSTAL_ROM_URL must be a direct HTTPS download URL.");
+  }
+  if (parsed.protocol !== "https:")
+    throw new Error("CRYSTAL_ROM_URL must use HTTPS.");
+
+  let response;
+  let bytes;
+  try {
+    response = await fetchImpl(parsed, {
+      redirect: "error",
+      signal: AbortSignal.timeout(60_000),
+    });
+    if (response.ok) {
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of response.body) {
+        size += chunk.length;
+        if (size > SIZE) throw new Error("oversized");
+        chunks.push(chunk);
+      }
+      bytes = Buffer.concat(chunks);
+    }
+  } catch {
+    throw new Error(
+      "Private ROM download failed. Check access, HTTPS, direct URL, size and runner IP restrictions.",
+    );
+  }
+  if (!response.ok)
+    throw new Error(`Private ROM server returned HTTP ${response.status}.`);
+  if (
+    bytes.length !== SIZE ||
+    createHash("sha1").update(bytes).digest("hex") !== SHA1
+  )
+    throw new Error(
+      "Private ROM must match the 2 MiB Crystal 1.1 profile (SHA-1 verification failed).",
+    );
+
+  await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
+  await writeFile(destination, bytes, { mode: 0o600, flag: "wx" });
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+  try {
+    await downloadPrivateRom(
+      process.env.CRYSTAL_ROM_URL,
+      process.env.CRYSTAL_ROM_PATH,
+    );
+    console.log("Private Crystal 1.1 ROM downloaded and verified.");
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}