2026-08-13 18:32:38 +08:00
|
|
|
# HoloLake release broadcast candidate
|
|
|
|
|
|
|
|
|
|
This is the HoloLake-owned, loopback-only origin for signed update broadcasts.
|
|
|
|
|
It has no upstream software feed and never uploads or activates a release.
|
|
|
|
|
|
|
|
|
|
Without `ACTIVE.json`, `/health` reports `EMPTY_FAIL_CLOSED` and `/latest.json`
|
|
|
|
|
returns HTTP 204, the updater protocol's explicit no-update result. An active
|
|
|
|
|
release is accepted only when the human activation record, immutable broadcast,
|
|
|
|
|
pipeline receipt, package bytes, Developer ID receipt, and Apple notarization
|
|
|
|
|
receipt form one exact evidence chain. Invalid evidence locks the whole release
|
|
|
|
|
endpoint until an operator fixes the evidence and explicitly restarts the
|
|
|
|
|
service.
|
|
|
|
|
|
|
|
|
|
The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
|
|
|
|
|
provisioning, artifact upload, activation, and desktop rollout are independent
|
|
|
|
|
deployment gates.
|
2026-08-13 18:54:04 +08:00
|
|
|
|
|
|
|
|
`operator.mjs` supplies the separate, root-operated verification and activation
|
|
|
|
|
boundary. `verify` reconstructs a private candidate tree and accepts it only when
|
|
|
|
|
the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple
|
|
|
|
|
notarization receipt, and exact human approval all agree. `activate` additionally
|
|
|
|
|
requires the operator to repeat the expected release id, version, source commit,
|
|
|
|
|
and broadcast SHA-256. It copies only referenced immutable artifacts, commits
|
|
|
|
|
`ACTIVE.json` atomically, and reports that an explicit service restart is still
|
|
|
|
|
required. It never uploads, activates, or restarts on its own.
|
|
|
|
|
|
|
|
|
|
```text
|
|
|
|
|
node operator.mjs verify \
|
|
|
|
|
--source /secure/release/out/0.2.0 \
|
|
|
|
|
--human-approval /secure/approvals/0.2.0.json
|
|
|
|
|
|
|
|
|
|
sudo node operator.mjs activate \
|
|
|
|
|
--source /secure/release/out/0.2.0 \
|
|
|
|
|
--human-approval /secure/approvals/0.2.0.json \
|
|
|
|
|
--state-root /var/lib/guanghu/hololake-release-broadcast \
|
|
|
|
|
--expect-release-id GH-HOLOLAKE-RELEASE-0.2.0 \
|
|
|
|
|
--expect-version 0.2.0 \
|
|
|
|
|
--expect-source-commit 0000000000000000000000000000000000000000 \
|
|
|
|
|
--expect-broadcast-sha256 0000000000000000000000000000000000000000000000000000000000000000
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
The zeros above are placeholders, not deployable values. A real activation must
|
|
|
|
|
use the exact facts printed by `verify` and a separately issued human approval.
|
