selfupdate

type Assets struct {
	Tarball string
	Sums    string
	Sig     string
}

type IndexArtifact struct {
	Name string `json:"name"`
}

type IndexRelease struct {
	Version   string          `json:"version"`
	Yanked    bool            `json:"yanked,omitempty"`
	Artifacts []IndexArtifact `json:"artifacts"`
}

type Key struct {
	// ID is the fingerprint, derived from Pub rather than recorded, so the file
	// cannot name a key it does not hold.
	ID    string
	State KeyState
	Pub   ed25519.PublicKey
}

type KeyState string

type Keyring []Key

type Manifest struct {
	Version string
	Hashes  map[string]string // asset filename -> lowercase hex sha256
}

type Options struct {
	// Keys is the ring a signature may come from, normally ReleaseKeys. After the
	// signed index has been read it is narrowed by Keyring.Without(idx.Revoked), so a
	// key the publisher revoked cannot verify anything fetched afterwards.
	Keys         Keyring
	HTTPClient   *http.Client
	DiscoveryURL string // overrides DefaultDiscoveryURL; also MAGUS_UPDATE_URL env var
}

type ReleaseIndex struct {
	SchemaVersion int `json:"schema_version"`
	// KeyID names the key that signed this file. It is a cross-check, never the thing
	// that selects a key: an attacker controls it exactly as much as the rest of the
	// payload, so it is compared against the key that actually verified.
	KeyID string `json:"key_id"`
	// Revoked lists fingerprints no signature may come from. It is only believed when
	// the index carrying it was itself signed by a key not on the list - which is what
	// a standby key buys, and what makes a revocation an attacker cannot forge.
	Revoked []string `json:"revoked,omitzero"`
	// ExpiresAt bounds the one hole revocation cannot close: an attacker holding a
	// compromised key serving an OLD index that names no revocation. Past it the client
	// refuses the file rather than trusting a stale one, turning an indefinite
	// compromise into a denial of service. RFC3339; empty means no bound.
	ExpiresAt string         `json:"expires_at,omitzero"`
	Releases  []IndexRelease `json:"releases"`
}