Publish current app and server

server/internal/appupdate/policy.go

@@ -33,9 +33,14 @@ type Policy struct {
 	// current release mandatory for everyone.
 	MinimumVersion string `json:"minimumVersion"`
 	// DownloadURL points at the APK — normally the same file the landing page serves.
-	DownloadURL string    `json:"downloadUrl"`
-	Notes       string    `json:"notes"`
-	UpdatedAt   time.Time `json:"updatedAt"`
+	DownloadURL string `json:"downloadUrl"`
+	// SHA256 and SizeBytes let the TV reject a truncated, stale or substituted download
+	// before handing it to Android's package installer. Blank/zero remain valid for
+	// older policies entered manually through the admin page.
+	SHA256    string    `json:"sha256,omitempty"`
+	SizeBytes int64     `json:"sizeBytes,omitempty"`
+	Notes     string    `json:"notes"`
+	UpdatedAt time.Time `json:"updatedAt"`
 }
 
 // Decision is what the client receives.
@@ -44,6 +49,8 @@ type Decision struct {
 	Version     string `json:"version"`
 	Notes       string `json:"notes"`
 	DownloadURL string `json:"downloadUrl"`
+	SHA256      string `json:"sha256,omitempty"`
+	SizeBytes   int64  `json:"sizeBytes,omitempty"`
 }
 
 // Decide compares the version a client reported against the policy.
@@ -67,6 +74,8 @@ func Decide(policy Policy, clientVersion string) Decision {
 		Version:     normalize(policy.LatestVersion),
 		Notes:       strings.TrimSpace(policy.Notes),
 		DownloadURL: strings.TrimSpace(policy.DownloadURL),
+		SHA256:      strings.ToLower(strings.TrimSpace(policy.SHA256)),
+		SizeBytes:   policy.SizeBytes,
 	}
 
 	if minimum := parseVersion(policy.MinimumVersion); len(minimum) > 0 && compare(client, minimum) < 0 {

server/internal/appupdate/policy_test.go

@@ -8,6 +8,8 @@ func policy() Policy {
 		LatestVersion:  "0.1.54",
 		MinimumVersion: "0.1.50",
 		DownloadURL:    "https://nas.example.com/memby/memby-0.1.54.apk",
+		SHA256:         "abcdef",
+		SizeBytes:      42,
 		Notes:          "Faster home screen",
 	}
 }
@@ -29,6 +31,9 @@ func TestBehindLatestIsOptional(t *testing.T) {
 	if decision.Version != "0.1.54" || decision.DownloadURL == "" {
 		t.Fatalf("decision is missing what the TV needs to act: %+v", decision)
 	}
+	if decision.SHA256 != "abcdef" || decision.SizeBytes != 42 {
+		t.Fatalf("decision dropped release integrity metadata: %+v", decision)
+	}
 }
 
 func TestBelowMinimumIsMandatory(t *testing.T) {
@@ -100,7 +105,6 @@ func TestVersionParsingIsForgiving(t *testing.T) {
 	if got := Decide(p, "0.1.54-beta").Status; got != StatusNone {
 		t.Fatalf("pre-release suffix should compare as 0.1.54, got %s", got)
 	}
-
 	p.LatestVersion = "0.2"
 	if got := Decide(p, "0.2.0").Status; got != StatusNone {
 		t.Fatalf("0.2.0 should equal 0.2, got %s", got)