42 lines
1.5 KiB
Markdown
42 lines
1.5 KiB
Markdown
# YCode Update Manifest Contract v1
|
|
|
|
The release tooling and updater backend use this exact document:
|
|
|
|
```json
|
|
{
|
|
"payload": {
|
|
"schemaVersion": 1,
|
|
"version": "0.0.2",
|
|
"publishedAt": "2026-10-20T10:00:00.000Z",
|
|
"notes": {
|
|
"zh": "更新说明",
|
|
"en": "Release notes"
|
|
},
|
|
"platforms": {
|
|
"windows-x64": {
|
|
"url": "http://192.168.10.6/ycode/releases/versions/0.0.2/YCode-0.0.2-Setup-x64.exe",
|
|
"size": 123456789,
|
|
"sha256": "64-lowercase-hex-characters"
|
|
}
|
|
}
|
|
},
|
|
"signature": "base64-encoded-64-byte-ed25519-signature"
|
|
}
|
|
```
|
|
|
|
Rules:
|
|
|
|
- The Ed25519 signature covers exactly `Buffer.from(JSON.stringify(payload), "utf8")`.
|
|
- Payload property insertion order is part of the contract and must be preserved.
|
|
- `publishedAt` is canonical UTC ISO-8601 with millisecond precision.
|
|
- `version` is strict SemVer. Build metadata does not establish newer precedence.
|
|
- `sha256` is lowercase hexadecimal; `size` is the exact installer byte length.
|
|
- The artifact URL is absolute HTTP(S), has no query, fragment or credentials, and is exactly
|
|
`<base>/versions/<version>/<safe-installer-name>.exe`.
|
|
- The client and release tooling require the artifact origin to match the manifest origin.
|
|
- `latest.json` is served at `<base>/latest.json`; artifacts are immutable version directories.
|
|
- `resources/updates/public-key.pem` is the SPKI PEM trust anchor. Private keys never enter the
|
|
repository, the server, build artifacts or logs.
|
|
|
|
Default base URL: `http://192.168.10.6/ycode/releases/`
|