bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(hololake): add fail-closed JD release broadcast origin

Browse source
This commit is contained in:
冰朔 2026-08-13 18:32:38 +08:00
commit f73e11b364
6 changed files with 423 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
product-source/hololake-native-desktop/server/release-broadcast/README.md Normal file
View file

@ -0,0 +1,16 @@
# HoloLake release broadcast candidate
This is the HoloLake-owned, loopback-only origin for signed update broadcasts.
It has no upstream software feed and never uploads or activates a release.
Without `ACTIVE.json`, `/health` reports `EMPTY_FAIL_CLOSED` and `/latest.json`
returns HTTP 204, the updater protocol's explicit no-update result. An active
release is accepted only when the human activation record, immutable broadcast,
pipeline receipt, package bytes, Developer ID receipt, and Apple notarization
receipt form one exact evidence chain. Invalid evidence locks the whole release
endpoint until an operator fixes the evidence and explicitly restarts the
service.
The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
provisioning, artifact upload, activation, and desktop rollout are independent
deployment gates.