media-updates

What the amber-adult app checks at launch to find a newer build of itself.

Two files behind nginx: manifest.json, and the APK it names. No authentication, deliberately — there is no account to check against and the APK holds no secret. The credential in that app is the addon URL, which lives in the device keystore and never leaves it.

Publishing a release

./release.py ../amber-adult/build/app/outputs/flutter-apk/app-release.apk "what changed"

Add --linux ../amber-adult/build/linux/x64/release/bundle to publish the desktop build with it. Off by default: it is another ~34MB per release, and the desktop has no self-updater to feed — it exists so a source can be checked without walking to the television.

It reads the version and build number out of amber-adult/pubspec.yaml, copies the APK in under a versioned name, writes manifest.json, and commits. Push, and Coolify redeploys.

The APKs are committed. At ~34MB and a handful of releases a year that is the cheaper trade against standing up artifact storage for one app; if the repository ever gets uncomfortable, the history is disposable — only the newest artifact is ever fetched.

Downloading by hand

Android	https://media-updates.petruzalekr.cz/latest.apk
Linux x64	https://media-updates.petruzalekr.cz/latest-linux.tar.gz

Both are symlinks the release script repoints, so the addresses never change. Every past build stays reachable under its own media-<build>.apk / media-linux-<build>.tar.gz name, which is what lets a device midway through a download survive a release.

The Linux tarball unpacks to amber-adult/; run ./amber-adult/amber_adult. It needs libmpv on the system — media_kit loads it at runtime rather than bundling it, so on Arch that is the mpv package and on Debian libmpv2. Nothing warns about its absence up front; the app starts and playback fails.

Only Android updates itself. The desktop build is replaced by downloading a newer tarball.

The manifest

{
  "version": "0.1.0",
  "buildNumber": 1,
  "notes": "…",
  "sha256": "…64 hex…",
  "size": 34210000,
  "url": "https://media-updates.petruzalekr.cz/media-1.apk"
}

The client refuses anything it cannot act on: an equal or older buildNumber, a missing url, or a sha256 that is not 64 characters. The download is checked against that digest before it reaches the installer.