richiexec/amber-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Contract: Windows publishes the installer, and where its flavour gate lives

Browse source
This commit is contained in:
Claude 2026-08-01 15:58:13 +02:00
parent 4faac4c280
commit 9e6901505d
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
docs/auto-update-contract.md
View file

@ -19,7 +19,7 @@ manifest fetch), the desktop swap-installer, and the Android APK install channel
| `variant` | select | `clean` \| `adult`. |
| `version` | text | Human semver shown to the user, e.g. `1.0.1`. |
| `buildNumber` | number | Monotonic int; the comparator the updater actually uses. |
| `file` | file | The artifact: desktop = `.zip` of the release bundle, android = `.apk`. Protected (see rules). |
| `file` | file | The artifact: windows = `.exe` installer, linux = `.zip` of the release bundle, android = `.apk`. Protected (see rules). |
| `sha256` | text | Lowercase hex SHA-256 of the artifact; verified before install. |
| `size` | number | Bytes. |
| `notes` | text | Optional release notes (shown in the update prompt). |
@ -77,6 +77,17 @@ computes the SHA-256 + size and uploads via the superuser REST API. Re-publishin
the same `(platform, variant, buildNumber)` is rejected by the unique index —
bump `buildNumber` for each release.
**Windows publishes the installer**, `amber-setup-<variant>-<version>.exe`, not
the zip. One artifact serves both jobs: people download and run it, and the app's
updater runs the same file with `/SILENT`, which is why `DesktopInstaller`
dispatches on the extension. The zip `release_windows.ps1` still builds beside it
is for the flavour check and for unpacking by hand — do not publish it.
`check-flavor.py` cannot read a `.exe` (Inno compresses the payload) and refuses
rather than passing it. The Windows flavour gate is `Assert-Flavor` in
`release_windows.ps1`, which reads the staged folder before either artifact is
made from it; run it there, not here.
## Gating summary
`nsfwEnabled` (admin-set on the `users` record) is the single source of truth: