2026-08-13 18:32:38 +08:00
|
|
|
# HoloLake release broadcast candidate
|
|
|
|
|
|
|
|
|
|
This is the HoloLake-owned, loopback-only origin for signed update broadcasts.
|
|
|
|
|
It has no upstream software feed and never uploads or activates a release.
|
|
|
|
|
|
|
|
|
|
Without `ACTIVE.json`, `/health` reports `EMPTY_FAIL_CLOSED` and `/latest.json`
|
|
|
|
|
returns HTTP 204, the updater protocol's explicit no-update result. An active
|
|
|
|
|
release is accepted only when the human activation record, immutable broadcast,
|
|
|
|
|
pipeline receipt, package bytes, Developer ID receipt, and Apple notarization
|
|
|
|
|
receipt form one exact evidence chain. Invalid evidence locks the whole release
|
|
|
|
|
endpoint until an operator fixes the evidence and explicitly restarts the
|
|
|
|
|
service.
|
|
|
|
|
|
|
|
|
|
The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
|
|
|
|
|
provisioning, artifact upload, activation, and desktop rollout are independent
|
|
|
|
|
deployment gates.
|
2026-08-13 18:54:04 +08:00
|
|
|
|
2026-08-13 19:11:26 +08:00
|
|
|
The registered public namespace is `/hololake/releases`. The loopback origin
|
|
|
|
|
accepts the manifest at both its operator health-check path `/latest.json` and
|
|
|
|
|
the public updater path `/hololake/releases/latest.json`; release package URLs
|
|
|
|
|
must remain under that same public prefix. The front-door proxy must therefore
|
|
|
|
|
preserve the full request URI. Its loopback tunnel port remains deliberately
|
|
|
|
|
unassigned until the BS-GZ-006 route owner returns the live, non-conflicting
|
|
|
|
|
topology.
|
|
|
|
|
|
2026-08-13 19:16:15 +08:00
|
|
|
Once that port is returned and independently verified, `render-front-door.mjs
|
|
|
|
|
--loopback-port PORT` renders the bounded Nginx location. It refuses an omitted
|
|
|
|
|
port, preserves the full public request path by leaving `proxy_pass` without a
|
|
|
|
|
URI suffix, accepts only GET and HEAD, forwards no request body, and strips
|
|
|
|
|
authorization, cookies, and client forwarding headers. Rendering is not
|
|
|
|
|
deployment; Nginx validation, transactional install, public certificate/readback,
|
|
|
|
|
and a separate server receipt remain required.
|
|
|
|
|
|
2026-08-13 18:54:04 +08:00
|
|
|
`operator.mjs` supplies the separate, root-operated verification and activation
|
|
|
|
|
boundary. `verify` reconstructs a private candidate tree and accepts it only when
|
|
|
|
|
the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple
|
|
|
|
|
notarization receipt, and exact human approval all agree. `activate` additionally
|
|
|
|
|
requires the operator to repeat the expected release id, version, source commit,
|
|
|
|
|
and broadcast SHA-256. It copies only referenced immutable artifacts, commits
|
|
|
|
|
`ACTIVE.json` atomically, and reports that an explicit service restart is still
|
|
|
|
|
required. It never uploads, activates, or restarts on its own.
|
|
|
|
|
|
|
|
|
|
```text
|
|
|
|
|
node operator.mjs verify \
|
|
|
|
|
--source /secure/release/out/0.2.0 \
|
|
|
|
|
--human-approval /secure/approvals/0.2.0.json
|
|
|
|
|
|
|
|
|
|
sudo node operator.mjs activate \
|
|
|
|
|
--source /secure/release/out/0.2.0 \
|
|
|
|
|
--human-approval /secure/approvals/0.2.0.json \
|
|
|
|
|
--state-root /var/lib/guanghu/hololake-release-broadcast \
|
|
|
|
|
--expect-release-id GH-HOLOLAKE-RELEASE-0.2.0 \
|
|
|
|
|
--expect-version 0.2.0 \
|
|
|
|
|
--expect-source-commit 0000000000000000000000000000000000000000 \
|
|
|
|
|
--expect-broadcast-sha256 0000000000000000000000000000000000000000000000000000000000000000
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
The zeros above are placeholders, not deployable values. A real activation must
|
|
|
|
|
use the exact facts printed by `verify` and a separately issued human approval.
|
