domain/updates/feed

Classes

FeedError

Defined in: app/src/domain/updates/feed.ts:58

A feed that cannot be trusted or used. Nothing is installed after such an error.

Extends

• Error

Constructors

Constructor

new FeedError(code, message): FeedError

Defined in: app/src/domain/updates/feed.ts:67

Parameters

code

FeedErrorCode

Why the feed was rejected.

message

string

Details for logs and diagnostics.

Returns

FeedError

Overrides

Error.constructor

Properties

code

readonly code: FeedErrorCode

Defined in: app/src/domain/updates/feed.ts:61

Why the feed was rejected.

name

readonly name: "FeedError" = 'FeedError'

Defined in: app/src/domain/updates/feed.ts:59

Overrides

Error.name

---

SignedFeed

Defined in: app/src/domain/updates/feed.ts:143

The signed update feed. Every file is verified before it is parsed, and the index must be fresh and must not go back in sequence.

Constructors

Constructor

new SignedFeed(fetcher, verifier, state, now): SignedFeed

Defined in: app/src/domain/updates/feed.ts:155

Parameters

fetcher

FeedFetcher

Loads feed files.

verifier

SignatureVerifier

Checks signatures.

state

FeedStateStore

Highest sequence seen so far.

now

() => number

Current wall time in milliseconds since the epoch.

Returns

SignedFeed

Methods

findUpdate()

findUpdate(query): Promise<AvailableUpdate | undefined>

Defined in: app/src/domain/updates/feed.ts:174

Looks for an update.

Parameters

query

ReleaseQuery

What to look for.

Returns

Promise<AvailableUpdate | undefined>

The release and its file for this platform, or undefined when the browser is up to date.

Throws

When the feed cannot be trusted or has no file for this platform.

manifest()

manifest(version): Promise<{ artifacts: {[key: string]: object; }; downloadBase: string; releaseDate: string; schemaVersion: 1; version: string; }>

Defined in: app/src/domain/updates/feed.ts:200

Loads and verifies the manifest of one version, such as the running one, whose package the boot guard keeps for a rollback.

Parameters

version

string

The version.

Returns

Promise<{ artifacts: {[key: string]: object; }; downloadBase: string; releaseDate: string; schemaVersion: 1; version: string; }>

Throws

When the manifest cannot be trusted.

Interfaces

AvailableUpdate

Defined in: app/src/domain/updates/feed.ts:117

A verified release that is newer than the running version.

Properties

artifact

readonly artifact: object

Defined in: app/src/domain/updates/feed.ts:119

blockMapSize?

optional blockMapSize?: number

file

file: string = fileName

sha512

sha512: string

size

size: number

manifest

readonly manifest: object

Defined in: app/src/domain/updates/feed.ts:118

artifacts

artifacts: object

Index Signature

[key: string]: object

downloadBase

downloadBase: string

releaseDate

releaseDate: string = timestamp

schemaVersion

schemaVersion: 1

version

version: string = versionSchema

---

FeedFetcher

Defined in: app/src/domain/updates/feed.ts:84

Loads feed files from GitHub Pages or a mirror.

Methods

fetch()

fetch(path): Promise<string | undefined>

Defined in: app/src/domain/updates/feed.ts:89

Parameters

path

string

Path relative to the feed root, such as updates/v1/index.json.

Returns

Promise<string | undefined>

The file as UTF-8 text, or undefined when the file does not exist.

---

FeedStateStore

Defined in: app/src/domain/updates/feed.ts:93

Remembers the highest index sequence seen, to detect rollback attacks.

Methods

readSequence()

readSequence(): number

Defined in: app/src/domain/updates/feed.ts:95

Returns the highest sequence seen so far, or 0.

Returns

number

writeSequence()

writeSequence(sequence): void

Defined in: app/src/domain/updates/feed.ts:100

Stores a higher sequence.

Parameters

sequence

number

Sequence of a verified index.

Returns

void

---

ReleaseQuery

Defined in: app/src/domain/updates/feed.ts:104

What the browser asks the feed for.

Properties

artifactKey

readonly artifactKey: string

Defined in: app/src/domain/updates/feed.ts:111

Platform, architecture and package format, such as linux-x64-appimage.

blocked?

readonly optional blocked?: readonly string[]

Defined in: app/src/domain/updates/feed.ts:113

Versions that failed to start here and are never installed again.

channel

readonly channel: "stable" | "beta"

Defined in: app/src/domain/updates/feed.ts:105

currentVersion

readonly currentVersion: string

Defined in: app/src/domain/updates/feed.ts:109

The running version.

versionPrefix?

readonly optional versionPrefix?: string

Defined in: app/src/domain/updates/feed.ts:107

Only versions with this prefix, from the TargetVersionPrefix policy.

---

SignatureVerifier

Defined in: app/src/domain/updates/feed.ts:74

Checks detached Ed25519 signatures against the public keys built into the browser.

Methods

verify()

verify(data, signature): boolean

Defined in: app/src/domain/updates/feed.ts:80

Parameters

data

string

The signed text; its UTF-8 bytes are what was signed.

signature

string

The detached signature, Base64-encoded.

Returns

boolean

Whether any trusted key made the signature.

Type Aliases

FeedErrorCode

FeedErrorCode = "unavailable" | "signature" | "invalid" | "rollback" | "expired" | "mismatch" | "no-artifact"

Defined in: app/src/domain/updates/feed.ts:54

Why a feed was rejected.

---

FeedIndex

FeedIndex = v.InferOutput<typeof FeedIndexSchema>

Defined in: app/src/domain/updates/feed.ts:24

The signed index of the feed.

---

ReleaseArtifact

ReleaseArtifact = v.InferOutput<typeof ReleaseArtifactSchema>

Defined in: app/src/domain/updates/feed.ts:37

One downloadable file of a release.

---

ReleaseManifest

ReleaseManifest = v.InferOutput<typeof ReleaseManifestSchema>

Defined in: app/src/domain/updates/feed.ts:51

The signed manifest of one release.

Variables

FeedIndexSchema

const FeedIndexSchema: ObjectSchema<{ expiresAt: SchemaWithPipe<readonly [StringSchema<undefined>, IsoTimestampAction<string, undefined>]>; issuedAt: SchemaWithPipe<readonly [StringSchema<undefined>, IsoTimestampAction<string, undefined>]>; releases: ArraySchema<ObjectSchema<{ channel: PicklistSchema<["stable", "beta"], undefined>; version: SchemaWithPipe<readonly [StringSchema<undefined>, CheckAction<string, "Must be a semantic version">]>; }, undefined>, undefined>; schemaVersion: LiteralSchema<1, undefined>; sequence: SchemaWithPipe<readonly [NumberSchema<undefined>, IntegerAction<number, undefined>, MinValueAction<number, 0, undefined>]>; }, undefined>

Defined in: app/src/domain/updates/feed.ts:14

updates/v1/index.json: the releases per channel and the freshness fields.

---

ReleaseArtifactSchema

const ReleaseArtifactSchema: ObjectSchema<{ blockMapSize: OptionalSchema<SchemaWithPipe<readonly [NumberSchema<undefined>, IntegerAction<number, undefined>, MinValueAction<number, 0, undefined>]>, undefined>; file: SchemaWithPipe<readonly [StringSchema<undefined>, RegexAction<string, "Must be a plain file name">]>; sha512: SchemaWithPipe<readonly [StringSchema<undefined>, RegexAction<string, "Must be Base64">]>; size: SchemaWithPipe<readonly [NumberSchema<undefined>, IntegerAction<number, undefined>, MinValueAction<number, 0, undefined>]>; }, undefined>

Defined in: app/src/domain/updates/feed.ts:27

One downloadable file of a release.

---

ReleaseManifestSchema

const ReleaseManifestSchema: ObjectSchema<{ artifacts: RecordSchema<StringSchema<undefined>, ObjectSchema<{ blockMapSize: OptionalSchema<SchemaWithPipe<readonly [NumberSchema<undefined>, IntegerAction<number, undefined>, MinValueAction<number, 0, undefined>]>, undefined>; file: SchemaWithPipe<readonly [StringSchema<undefined>, RegexAction<string, "Must be a plain file name">]>; sha512: SchemaWithPipe<readonly [StringSchema<undefined>, RegexAction<string, "Must be Base64">]>; size: SchemaWithPipe<readonly [NumberSchema<undefined>, IntegerAction<number, undefined>, MinValueAction<number, 0, undefined>]>; }, undefined>, undefined>; downloadBase: StringSchema<undefined>; releaseDate: SchemaWithPipe<readonly [StringSchema<undefined>, IsoTimestampAction<string, undefined>]>; schemaVersion: LiteralSchema<1, undefined>; version: SchemaWithPipe<readonly [StringSchema<undefined>, CheckAction<string, "Must be a semantic version">]>; }, undefined>

Defined in: app/src/domain/updates/feed.ts:40

updates/v1/releases/<version>.json: the files of one release.

Functions

selectRelease()

selectRelease(index, query): string | undefined

Defined in: app/src/domain/updates/feed.ts:128

Picks the release to update to: the highest version of the channel that matches the prefix and is newer than the running one. Downgrades are never selected.

Parameters

index

The verified index.

expiresAt

string = timestamp

issuedAt

string = timestamp

releases

object[] = ...

schemaVersion

1 = ...

sequence

number = ...

query

ReleaseQuery

Channel, prefix and running version.

Returns

string | undefined

References

UpdateChannel

Re-exports UpdateChannel

---

UpdateChannelSchema

Re-exports UpdateChannelSchema