Add shared desktop artifact certification and publication adapter for Rust and Flutter producers #492

Goal

Provide one Zed-owned release adapter that accepts a built Rust or Flutter desktop artifact plus reviewed build/signing evidence, verifies it against DesktopApplicationArtifactV1, and publishes immutable bytes/metadata through the Zed desktop distribution path.

This adapter is the common release boundary for *-desktop-app.rs and Flutter desktop repositories. It does not own application source code or signing private keys.

Producer inputs

Accept explicit machine-readable inputs for:

• exact artifact file;
• DesktopApplicationArtifactV1 descriptor;
• exact source repository + revision;
• build receipt digest/evidence;
• platform signing/notarization verification result;
• optional native-library closure receipt;
• requested publication target/environment.

Do not infer release authority from repository names, current branch, file extension alone, or ambient credentials.

Certification

Before any upload:

• recompute SHA-256 and byte size and compare to descriptor;
• verify file name/OS/architecture/format semantics through the shared interface contract;
• verify source/build receipt identity;
• require signed/notarized status for policies that demand it (for example stable macOS);
• verify signing identity using platform-specific verifier output supplied through a typed adapter;
• reject dirty/stale source/build evidence;
• fail closed on unknown descriptor fields/version;
• produce a deterministic certification receipt.

Publication

Publish immutable artifacts only to content-addressed destinations such as:

apps/artifacts/<sha256>/<filename>

and publish immutable artifact metadata keyed by the same digest. Publication must be idempotent:

• same digest + same bytes/metadata -> safe replay;
• same digest path + different bytes/metadata -> hard integrity failure;
• no overwrite-by-version/channel.

Use an explicit storage/client API; do not embed Cloudflare/R2 credentials in descriptors or argv.

Producer adapters

Support narrow adapters for:

• Rust desktop output (*-desktop-app.rs);
• Flutter desktop output.

The adapters normalize build evidence only. Both must result in the same canonical DesktopApplicationArtifactV1 + certification/publication receipt.

CLI / SDK shape

Expose the behavior through a reusable Rust API plus a CLI projection (exact spelling can be selected during implementation), with machine-readable output. The CLI must not contain a second implementation of validation/publication behavior.

Security

• secret values are env/secret-store only;
• no signing private key material is handled by the artifact descriptor;
• signed upload URLs/credentials are redacted from logs/receipts;
• publication authority is distinct from channel-promotion authority;
• a producer can certify locally without holding production publication credentials.

Tests

• Rust artifact certification;
• Flutter artifact certification;
• digest/size mismatch;
• platform/signing-state mismatch;
• exact replay idempotency;
• attempted immutable-object overwrite;
• certifier with no publish credential can still produce local receipt;
• publisher receives only scoped immutable-object write authority;
• CLI and direct SDK produce the same certification receipt digest.

Related

• zed-pkg/zed-interfaces#158 / PR Sync current main into Devbox/Flox export branch #159;
• zed-pkg/zed-desktop-app.rs#7/#8/#9;
• follow-up Cloudflare channel and download-manifest work belongs in zed-infra.