Skip to content

6.10.2.16 ReleaseSignedMetadata

Immutable

Records are never updated after creation.

6.10.2.16.1 Purpose

A signed document that clients trust, stating for example which build is current on a channel. Its version and expiry protect clients from being sent back to, or frozen on, old metadata.

6.10.2.16.2 Questions it answers

  • What does a client trust as the current release?
  • Which metadata version is current, and when does it expire?

6.10.2.16.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
role enum 1..1 Values: root, targets, snapshot, timestamp.
scope_ref string 1..1 E.g. app/<id>/channel/<id>.
version integer 1..1 Always increasing: a client refuses a version lower than the last one it saw (no rollback to old metadata).
(role, scope_ref, version) is unique.
expires_at datetime 1..1 A client refuses expired metadata, so it cannot be frozen on an old version.
content_hash string 1..1
object_key string 1..1
required_signatures integer 1..1 Threshold of the role when the document was signed: root 2 of at least 3 keys, targets 2, snapshot 1, timestamp 1. A client accepts the document only with that many valid signatures from distinct active keys of the role.
created_at datetime 1..1

6.10.2.16.4 Relationships

Referenced by

6.10.2.16.5 Rules & constraints

  • The signed document a client trusts, e.g. "on channel stable the current build is 42, with these manifests and hashes".
  • To see the signatures check ReleaseMetadataSignature with metadata = this.id (1..*).
  • Root rotation: the new root document is signed by the old keys and the new keys, each set meeting its threshold, so a client on any previous root can verify the step.