Discover signed runtime artifacts from public repository fallback

hydra/update_engine.py

@@ -15,6 +15,7 @@ import stat
 import subprocess
 import sys
 import tempfile
+import urllib.error
 import urllib.parse
 import urllib.request
 import uuid
@@ -26,6 +27,7 @@ FILE_LIMIT = 4 * 1024 * 1024
 MAX_FILES = 256
 ORIGIN = 'https://git.shanaty.ru'
 RELEASES = ORIGIN + '/api/v1/repos/Emil_Shanaty/Hydra-OS/releases?limit=20'
+REPOSITORY_RELEASE = ORIGIN + '/Emil_Shanaty/Hydra-OS/raw/branch/main/releases/stable/'
 EXACT = {'usr/lib/hydra/bin/hydra', 'etc/motd', 'etc/fastfetch/config.jsonc',
          'usr/share/hydra/fastfetch.txt'}
 
@@ -516,6 +518,21 @@ def fetch(url, limit):
     return b''.join(chunks)
 
 
+def discover_repository(public_key):
+    # The mutable branch locates passive bytes; only the pinned signature grants trust.
+    try:
+        raw = fetch(REPOSITORY_RELEASE + 'manifest.json', MANIFEST_LIMIT)
+    except urllib.error.HTTPError as exc:
+        if exc.code != 404:
+            raise
+        exc.close()
+        return None
+    # A present manifest with missing/broken companions is an error, never "no release".
+    signature = fetch(REPOSITORY_RELEASE + 'manifest.sig', 64)
+    manifest = validate_manifest(raw, signature, public_key)
+    return manifest, raw, signature, REPOSITORY_RELEASE + 'runtime.zip'
+
+
 def discover(public_key):
     releases = parse_json(fetch(RELEASES, 1024 * 1024))
     if not isinstance(releases, list) or len(releases) > 20:
@@ -549,7 +566,7 @@ def discover(public_key):
             raise UpdateError('Release tag does not match signed immutable version')
         candidates.append((manifest, raw, signature, found['runtime.zip']))
     if not candidates:
-        return None
+        return discover_repository(public_key)
     sequences = [item[0]['sequence'] for item in candidates]
     if len(sequences) != len(set(sequences)):
         raise UpdateError('Duplicate release sequence')