Emil_Shanaty/Hydra-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Discover signed runtime artifacts from public repository fallback

Browse Source
This commit is contained in:
Codex
2026-10-13 21:56:27 +03:00
parent d625733207
commit 261ee28f77
3 changed files with 154 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/updates.md
+24 -3
View File
@@ -3,7 +3,11 @@
The new ISO includes an independent updater and an independently pinned Ed25519
public key. Discovery uses the public Gitea repository at
`https://git.shanaty.ru/Emil_Shanaty/Hydra-OS`; discovery is not a trust source.
An empty releases list is normal and reports no update.
If Gitea has no published runtime release candidate, discovery checks the fixed
public repository path `releases/stable/` on branch `main`. If that path has no
manifest (HTTP 404), it reports no update. Both locations use the same independently
pinned signature key; Git branch contents and repository ownership do not establish
release trust.
```sh
hydra update check
@@ -82,7 +86,16 @@ python3 dev/release.py \
The three release assets are `manifest.json`, `manifest.sig`, and `runtime.zip`.
Publish them under the immutable Gitea tag `1.0.0`, exactly matching the signed
version. Each new release needs a strictly increasing integer sequence; never
version. Alternatively, when the native Gitea release list has no runtime candidates,
publish those same three passive artifacts together in `releases/stable/` on the
repository's `main` branch. The raw HTTPS prefix is fixed:
`https://git.shanaty.ru/Emil_Shanaty/Hydra-OS/raw/branch/main/releases/stable/`.
The branch serves as a discovery location; the verified manifest supplies its
version and sequence. Keep historical signed artifacts under immutable versions
outside this moving stable pointer. Native Gitea runtime releases take precedence;
a present native candidate, including one already installed, disables this fallback.
Each new release needs a strictly increasing integer sequence; never
reuse a sequence or mutate assets at an existing version. Rollback retains the
highest accepted sequence independently of the current installed version.
The builder is deterministic for identical source, version, sequence, key and
@@ -105,7 +118,15 @@ The maximum manifest is 256 KiB, archive/expanded payload 16 MiB, individual fil
per-artifact deadline; redirects remain on the fixed HTTPS origin. Discovery
checks up to the latest 20 published release records, skipping draft/prerelease
records. Publish runtime releases regularly enough that the current stable release
remains in that window.
remains in that window. Only an otherwise successful discovery with no runtime
candidates activates the repository fallback. API errors, malformed native assets,
tag mismatches and bad signatures remain visible errors and never trigger fallback.
For the repository path, only a missing `manifest.json` (404) means no release;
a missing signature, server error or invalid signature is an error. The ZIP is
fetched only for apply after manifest verification, and its signed hash/size and
all existing download bounds/redirect restrictions still apply. A branch update
between requests may cause a safe verification failure; retry after publication
finishes.
For offline/local verification and application: