🥮 mooncakes.io

    moonbit-community/proton/updater does not have a README file

    ArtifactFetch

    source
    type ArtifactFetch = async (String, Int64, async (Bytes) -> Unit raise UpdateError) -> Unit raise UpdateError

    Streams an artifact into a consumer without retaining the whole body.

    The expected size is authenticated manifest data. A transport may use it to reject a mismatching response header early; UpdateChannel independently enforces it against the chunks actually delivered.

    Fetch

    source
    type Fetch = async (String) -> Bytes raise UpdateError

    Fetches the whole body at a URL.

    The network is a parameter rather than a dependency so that the sequence below — verify, decode, compare, verify again — can be exercised end to end without one. That sequence is the part worth testing exhaustively; an HTTP client is not.

    UpdateError

    source
    pub(all) suberror UpdateError {
      FetchFailed(url~ : String, detail~ : String)
      ManifestSignatureInvalid
      ManifestUndecodable(detail~ : String)
      ManifestStale(published_at~ : String, oldest_accepted~ : String)
      MalformedSignature(url~ : String)
      UntrustedKey(detail~ : String)
      ArtifactSizeMismatch(expected~ : Int64, actual~ : Int64)
      ArtifactDigestMismatch(expected~ : String, actual~ : String)
      ArtifactSignatureInvalid
      ClockUnusable(detail~ : String)
      InstallBusy
      RollbackRejected(target~ : UInt64, installed~ : UInt64)
      RevisionMismatch(detail~ : String)
      InstallInterrupted(detail~ : String)
      InstallFailed(step~ : String, detail~ : String)
    } derive(Eq, 
    Debug    )

    A reason an update was not accepted.

    Every variant is a refusal. There is no variant meaning "checked and could not tell": a check that cannot reach a conclusion is a check that failed, and the caller must treat it as such.

    UpdateError::equal

    source
    fn UpdateError::equal(UpdateError, UpdateError) -> Bool

    UpdateError::message

    source
    fn UpdateError::message(self : UpdateError) -> String

    UpdateError::not_equal

    source
    fn UpdateError::not_equal(x : UpdateError, y : UpdateError) -> Bool

    UpdateError::output

    source
    fn UpdateError::output(self : UpdateError, logger : &Logger) -> Unit

    UpdateError::to_repr

    source

    UpdateError::to_string

    source
    fn UpdateError::to_string(self : UpdateError) -> String

    AvailableUpdate

    source
    pub struct AvailableUpdate {
      version : 
    Version
      revision : UInt64
      notes_url : String?
      url : String
      size : Int64
      sha256_hex : String
      signature_hex : String
    } derive(Eq, 
    Debug    )

    A release that passed every check short of being downloaded.

    AvailableUpdate::equal

    source

    AvailableUpdate::not_equal

    source
    fn AvailableUpdate::not_equal(x : AvailableUpdate, y : AvailableUpdate) -> Bool

    AvailableUpdate::notes_url

    source
    fn AvailableUpdate::notes_url(self : AvailableUpdate) -> String?

    AvailableUpdate::revision

    source
    fn AvailableUpdate::revision(self : AvailableUpdate) -> UInt64

    AvailableUpdate::size

    source
    fn AvailableUpdate::size(self : AvailableUpdate) -> Int64

    AvailableUpdate::to_repr

    source

    AvailableUpdate::url

    source
    fn AvailableUpdate::url(self : AvailableUpdate) -> String

    AvailableUpdate::version

    source

    CheckOutcome

    source
    pub enum CheckOutcome {
      UpToDate
      Available(AvailableUpdate)
    } derive(Eq, 
    Debug    )

    What a check concluded.

    CheckOutcome::equal

    source

    CheckOutcome::not_equal

    source
    fn CheckOutcome::not_equal(x : CheckOutcome, y : CheckOutcome) -> Bool

    CheckOutcome::to_repr

    source

    InstallOutcome

    source
    pub enum InstallOutcome {
      Installed
      AlreadyInstalled
    } derive(Eq, 
    Debug    )

    InstallOutcome::equal

    source

    InstallOutcome::not_equal

    source
    fn InstallOutcome::not_equal(x : InstallOutcome, y : InstallOutcome) -> Bool

    InstallOutcome::to_repr

    source

    UpdateChannel

    source
    pub struct UpdateChannel {
      endpoint : String
      trusted_keys : Array[
    PublicKey    ]
      platform : String
      current_revision : UInt64
    }

    An update channel, resolved from configuration.

    UpdateChannel::UpdateChannel

    source
    fn UpdateChannel::UpdateChannel(endpoint : String, public_keys : Array[String], platform : String, current_revision : UInt64) -> UpdateChannel raise UpdateError

    Resolves a channel from its configured form.

    Trusted keys are parsed once, here, so that a key which cannot be used is reported when the channel is built rather than at the moment a signature needs checking.

    UpdateChannel::check

    source
    async fn UpdateChannel::check(self : UpdateChannel, fetch : async (String) -> Bytes raise UpdateError, oldest_accepted : 
    Timestamp    ) -> CheckOutcome raise UpdateError

    Checks the channel for a newer release.

    oldest_accepted is the earliest publication instant this client will believe. It is supplied rather than derived from a clock inside this function: the calendar arithmetic that turns a freshness window into an instant belongs where a date library is available, and keeping it out means the whole check can be tested by naming the instant directly.

    The order of the steps is the point. The signature is checked before the document is parsed, so no attacker-supplied structure is interpreted until it is known to come from a trusted key. Freshness and revision are checked after, because both read fields that only the signature makes trustworthy.

    UpdateChannel::download_and_install

    source
    async fn UpdateChannel::download_and_install(self : UpdateChannel, fetch : async (String, Int64, async (Bytes) -> Unit raise UpdateError) -> Unit raise UpdateError, update : AvailableUpdate, on_progress? : async (Int64) -> Unit noraise) -> InstallOutcome raise UpdateError

    Streams, authenticates and prepares or applies an available update.

    The native stage owns a private artifact from the first chunk until the platform consumes it. download_into authenticates the same chunks written there, and any transfer or authentication failure discards the stage before returning.

    macOS and Linux stage beside the running artifact so final replacement stays on one filesystem. Windows stages in the per-user temporary directory, keeps the verified installer open against modification, and elevates it only when the application requests relaunch. No staging path crosses the FFI boundary.

    The application is not restarted. When to do that is a question about the user's unsaved work, not about the update, so it belongs to the caller — see relaunch.

    cleanup_previous

    source
    fn cleanup_previous() -> Unit raise UpdateError

    Removes the retained backup from a successfully relaunched application.

    current_revision

    source
    fn current_revision() -> UInt64 raise UpdateError

    Returns the revision recorded by the running application artifact.

    http_fetch

    source
    async fn http_fetch(url : String) -> Bytes raise UpdateError

    Fetches update metadata over HTTPS.

    Plain HTTP is refused. The signature is what makes a response trustworthy, so TLS is not what protects this exchange — but there is no reason to advertise which release a user is running to anyone on the path, and no reason to accept a redirect into cleartext.

    http_fetch_artifact

    source
    async fn http_fetch_artifact(url : String, expected_size : Int64, consume : async (Bytes) -> Unit raise UpdateError) -> Unit raise UpdateError

    Streams an artifact over HTTPS without retaining its body.

    expected_size comes from the authenticated manifest. A Content-Length mismatch can therefore be refused before reading the body, but the consumer still counts actual chunks because the header may be absent after content decoding or on a chunked response.

    maximum_metadata_bytes

    source
    let maximum_metadata_bytes : Int

    The largest body this client will accept from an update endpoint.

    A manifest and a signature are both small. A server that offers something enormous in their place is either broken or hostile, and either way the client should stop rather than fill memory on the way to a signature check it was going to fail.

    oldest_accepted

    source
    fn oldest_accepted(freshness_days : Int) -> 
    Timestamp     raise UpdateError

    The earliest publication instant this client will believe, from the system clock.

    Kept out of UpdateChannel::check on purpose. That function is the one sequence where the order of the steps is the security property, and a clock read inside it would make the whole sequence depend on when the test ran. Here the clock is read once and the result is data.

    relaunch

    source
    fn relaunch() -> Unit raise UpdateError

    Starts the installed replacement.

    The caller is expected to exit once this returns. Two copies of the same application running against the same state is a worse outcome than a moment with none, and the new process is already starting by the time this returns.

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io