bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(hololake): bind release chain to public path namespace

Browse source
This commit is contained in:
冰朔 2026-08-13 19:11:26 +08:00
commit 9006075310
13 changed files with 223 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

8
product-source/hololake-native-desktop/src-tauri/src/release_update.rs
View file

@ -20,6 +20,7 @@ const RECEIPT_SCHEMA: &str = "hololake.release-install-receipt/v1";
const RECOVERY_SCHEMA: &str = "hololake.release-recovery/v1";
const CANDIDATE_TTL_MS: u128 = 30 * 60 * 1000;
const EXPECTED_BUNDLE_IDENTIFIER: &str = "world.guanghu.hololake";
const PUBLIC_RELEASE_PACKAGE_PREFIX: &str = "/hololake/releases/";
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
@ -472,7 +473,12 @@ fn validate_update(update: &Update, allowed_host: &str) -> Result<UpdateSnapshot
return Err("HOLOLAKE_RELEASE_BROADCAST_POLICY_INVALID".into());
}
let url = &update.download_url;
if url.scheme() != "https" || url.host_str() != Some(allowed_host) {
if url.scheme() != "https"
|| url.host_str() != Some(allowed_host)
|| !url.path().starts_with(PUBLIC_RELEASE_PACKAGE_PREFIX)
|| url.query().is_some()
|| url.fragment().is_some()
{
return Err("HOLOLAKE_RELEASE_PACKAGE_HOST_NOT_TRUSTED".into());
}
let platform = envelope