Release server: data model, endpoints, licensing and permissions
Data model of the central release server, the endpoints for managing installations and releases, how registration codes and update requests work, authentication of the catalog API and the permission keys.
The release server manages the register of installations (ID, domain, client, operating model, versions, licence, events, requests), the list of releases, manual upload and revocation, central update requests and the server settings. Only technical and licence data is shown. Permissions are requested through a helper that calls canAction.
Data model
Table names carry the installation's own prefix in the database.
| Table | Role | Main fields |
|---|---|---|
release_installation | installations | UUID, label, domain, client, model, channel, automatic update, status, reg_code_hash with expiry |
release | releases | version, channel, archive location, revocation with reason |
release_event | events | e.g. regcode_issued |
release_request | central update requests | version, mode (prepare, install), note |
update_config | server settings | server_* keys |
company | client name | read only |
Endpoints
| Key | Endpoint | Behaviour |
|---|---|---|
list | index, installations, releases | enabled state, public configuration, master key file, trusted keys, Google accounts; paged installation list with filter, licence state per row, staleness against the latest stable release, last 20 events and 10 requests; at most 500 releases |
installation | form, save, toggle | UUID for a new row; event; success after reading back; the toggle flips automatic update or status |
regcode | regcode | one-time code valid for 7 days, the server stores only its SHA-256 fingerprint |
request | request | request and event; a valid SemVer and an existing release are required (error_version); the code does not check that the installation exists |
publish | upload | zip + manifest + signature + key ID; the same verification and storage path as CI publishing; stored in the archive |
revoke | revoke | reason required; on the islands the check returns revoked if it is the installed version |
settings | settings, publisherkey | switch on (master key the first time), archive, cache 1–20 and at least 16 MB, licence exceptions, security override, token 60–3600 s and 1–10 uses; rotating the publisher secret (key version +1) additionally needs isSuper() |
release.selfregister: creates the central multi-tenant instance's own "central" installation row and registers it with local transport (idempotent); permission: installation and isSuper().
Catalog API
Endpoints of api/update: register and publish authenticate with their own code or secret, check, authorize, download and report with an HMAC signature. If the server role is off: 404.
Permissions
- All keys are classified SYSTEM; the
debugkey is not checked by the controller and its use cannot be determined. - Content scope: an installation's client can only be chosen from the companies allowed by the user's company group filter (
error_scope).
Known limitations
Not yet run on a live central server with a real signing key and HTTPS transport.