Documentation
¶
Overview ¶
Package catalogue loads the release-signed app-store catalogue and exposes the per-app publisher "pins" the daemon uses as its trust anchor.
The catalogue (signed by the embedded catalogue key, see internal/catalogtrust) is the root of trust: it declares, per app id, the ed25519 publisher key that app's manifest must be signed by. The app-store supervisor confirms each non-sideloaded app's manifest.Store.Publisher matches this pin before spawning (manifest.VerifyTrustAnchor). This package is what feeds those pins to the supervisor via appstore.Config.CataloguePublisher.
Index ¶
Constants ¶
const DefaultURL = "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/catalogue.json"
DefaultURL is the production catalogue location; override with $PILOT_APPSTORE_CATALOG_URL (kept identical to pilotctl's default).
Variables ¶
This section is empty.
Functions ¶
func LoadPublishers ¶
LoadPublishers fetches the catalogue at url (and its detached <url>.sig), verifies the signature against the embedded catalogue key (fail-closed), and returns appID -> publisher pin ("ed25519:<base64>") for every entry that declares a publisher. The signature check is the same gate pilotctl uses at install time — a substituted catalogue cannot change the pins.
Types ¶
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider serves catalogue publisher pins to the app-store supervisor and refreshes them from the signed catalogue. Safe for concurrent use: the supervisor reads via Publisher on every scan while a background loop writes via Refresh. A disk cache lets the daemon survive a transient catalogue outage on restart (fail-closed only when there is neither a live catalogue nor a cache).
func NewProvider ¶
NewProvider builds a Provider for the catalogue at url, caching the last verified pin set at cachePath (empty disables the cache).
func (*Provider) LoadCache ¶
LoadCache populates the pin set from the disk cache. Best-effort: used at startup when the initial Refresh fails (e.g. the daemon booted offline). Returns true if any pins were loaded.
func (*Provider) Publisher ¶
Publisher implements appstore.Config.CataloguePublisher: it returns the catalogue-pinned publisher for appID and whether appID is pinned. On a miss it kicks off a rate-limited background refresh (see refreshOnMiss), so an app that was pinned since the last periodic refresh becomes spawnable within a scan cycle instead of after the next 10-minute tick.
Source Files