Verify upgrade backups before applying files

scripts/admin-upgrade-runner.mjs

@@ -157,14 +157,18 @@ async function main() {
   if (!backupFile || !fs.existsSync(backupFile)) {
     throw new Error('数据备份创建失败');
   }
-  updateState({ backupFile });
-  logStep('数据备份完成', `备份文件：${backupFile}`);
+  verifyTarArchive(backupFile, '校验数据备份');
+  const backupHash = sha256(backupFile);
+  updateState({ backupFile, backupHash });
+  logStep('数据备份完成', `备份文件：${backupFile}，SHA256：${backupHash}`);
 
   updateState({ step: 'backup_source', progress: 30, message: '正在创建源码快照' });
   logStep('创建源码快照', '开始保存升级前源码状态');
   createSourceBackup(sourceBackupFile);
-  updateState({ sourceBackupFile });
-  logStep('源码快照完成', `快照文件：${sourceBackupFile}`);
+  verifyTarArchive(sourceBackupFile, '校验源码快照');
+  const sourceBackupHash = sha256(sourceBackupFile);
+  updateState({ sourceBackupFile, sourceBackupHash });
+  logStep('源码快照完成', `快照文件：${sourceBackupFile}，SHA256：${sourceBackupHash}`);
 
   updateState({ step: 'apply', progress: 42, message: '正在应用升级包文件' });
   logStep('应用升级文件', '开始覆盖升级包中的文件');
@@ -532,6 +536,13 @@ function tarReadArgs(action, archivePath) {
   return archivePath.endsWith('.tar') ? [flag, archivePath] : [gzipFlag, archivePath];
 }
 
+function verifyTarArchive(archivePath, label) {
+  if (!fs.existsSync(archivePath)) {
+    throw new Error(`${label}失败，文件不存在: ${archivePath}`);
+  }
+  run('tar', tarReadArgs('list', archivePath), { cwd: projectRoot, label });
+}
+
 function waitForHealth() {
   const healthUrl = process.env.UPGRADE_HEALTH_URL || process.env.APP_HEALTH_URL || 'http://127.0.0.1:5100/api/health';
   const timeoutMs = Number(process.env.UPGRADE_HEALTH_TIMEOUT_MS || 90000);

src/app/api/admin/upgrade/route.ts

@@ -28,7 +28,9 @@ type UpgradeJobState = {
   packageName: string;
   packageHash?: string;
   backupFile?: string;
+  backupHash?: string;
   sourceBackupFile?: string;
+  sourceBackupHash?: string;
   restartRequired?: boolean;
   changedFiles?: string[];
   preExistingFiles?: string[];

src/components/admin/system-upgrade-tab.tsx

@@ -49,7 +49,9 @@ type UpgradeJob = {
   packageName: string;
   packageHash?: string;
   backupFile?: string;
+  backupHash?: string;
   sourceBackupFile?: string;
+  sourceBackupHash?: string;
   restartRequired?: boolean;
   changedFiles?: string[];
   preExistingFiles?: string[];
@@ -510,7 +512,9 @@ function UpgradeStatusPanel({
         <InfoRow label="文件数量" value={`${changedFiles.length} 个文件`} />
         <InfoRow label="需要重启" value={job.restartRequired ? '是' : '否'} />
         {job.backupFile && <InfoRow label="数据备份" value={job.backupFile} />}
+        {job.backupHash && <InfoRow label="备份校验" value={job.backupHash} />}
         {job.sourceBackupFile && <InfoRow label="源码快照" value={job.sourceBackupFile} />}
+        {job.sourceBackupHash && <InfoRow label="快照校验" value={job.sourceBackupHash} />}
       </div>
 
       {!compact && changedFiles.length > 0 && (