appcore-update
Crate-owned guide and examples
The Runtime repository maintains the detailed guide, basic example, and intermediate example. The wiki summarizes the public boundary; API and executable details live beside the crate code.
Responsibility: opaque application artifact selection, authenticity, staging, activation, health gate and rollback.
Internal dependencies: contracts and provider.
Primary API: artifact descriptor and signing payload; authenticity verifier, feature-gated unsigned-local and Ed25519 implementations, trust policy/key status; update request/provider and file provider/factory; staged artifact, activation receipt and file store; coordinator, preparation/outcome, health check and fault injection contracts.
Use it for application binaries or opaque artifacts. The Runtime validates identity, version, protocol, checksum and trust but never understands application code or schema.
File reads preflight size before allocation, use a fixed 16 KiB scratch buffer plus one non-retained sentinel byte, and reject non-regular final components. Activation revalidates staged size and SHA-256, then hard-links the staged file to an immutable build path. An existing path is reused only when its bytes match the descriptor exactly; it is never replaced. Atomic final-component no-follow is implemented on Unix. Other platforms retain metadata checks but require their deployment filesystem boundary to prevent reparse races.
Active/previous pointers and pending activation receipts borrow their descriptors, pass a non-retaining 1 MiB sizing check, and serialize directly to the atomic temporary file through a fixed 16 KiB buffer. Their V1 JSON encoding is unchanged. Reads also deserialize directly through a fixed 16 KiB bounded reader instead of retaining a complete encoded byte vector beside the decoded pointer or receipt. Missing files, I/O failures and decode failures remain distinct so the pending-activation upgrade wall is preserved.
The file provider streams the bounded index once and retains only the best semantic version and its descriptor. Each descriptor is validated and then discarded or selected while the JSON array is decoded, so neither a descriptor vector nor a sorted candidate list is retained. Equal versions preserve the first index entry. A fixed 16 KiB reader, 1 MiB preflight and one non-retained sentinel byte reject declared oversize and concurrent growth.
Maturity: stable lifecycle; remote supply chains require signed provenance and deployment trust roots.