Module update 

Fail-closed startup update decisions.

Structs

ReleaseContext

The installed app’s state, used to judge a manifest.

ReleaseManifest

The signed release manifest. Unknown fields are rejected.

UpdateArtifact

One platform’s installer.

VerifiedManifest

A manifest whose signature has been checked. Only verify_and_parse creates one.

Enums

ReleaseDecision

What a valid manifest means for this install.

ReleaseError

Why a manifest was refused. Displays as a user-facing message.

Constants

MANIFEST_SCHEMA_VERSION

Manifest schema version this build understands.

MAX_CLOCK_SKEW_SECONDS

How far in the future a manifest’s publishedAt may be, to tolerate slow clocks.

MAX_MANIFEST_LIFETIME_SECONDS

Longest allowed time between a manifest’s publishedAt and expiresAt.

Traits

HighestSeenStore

Persists the highest verified release version.

ManifestSignatureVerifier

Checks a detached manifest signature.

Functions

decide_and_record

Runs decide_release with the stored highest version and records a newer verified version, even when an update is then required.

decide_release

Judges a verified manifest: checks the schema, channel, validity window, lifetime, rollback floor, and this platform’s artifact, then compares versions.

validate_artifact 🔒

Requires an HTTPS URL, a 64-character hex SHA-256, and a non-empty signature.

verify_and_parse

Verifies the signature before parsing, so unsigned bytes are never interpreted.