Publish current app and server

server/internal/appupdate/policy.go

@@ -33,9 +33,14 @@ type Policy struct {
 	// current release mandatory for everyone.
 	MinimumVersion string `json:"minimumVersion"`
 	// DownloadURL points at the APK — normally the same file the landing page serves.
-	DownloadURL string    `json:"downloadUrl"`
-	Notes       string    `json:"notes"`
-	UpdatedAt   time.Time `json:"updatedAt"`
+	DownloadURL string `json:"downloadUrl"`
+	// SHA256 and SizeBytes let the TV reject a truncated, stale or substituted download
+	// before handing it to Android's package installer. Blank/zero remain valid for
+	// older policies entered manually through the admin page.
+	SHA256    string    `json:"sha256,omitempty"`
+	SizeBytes int64     `json:"sizeBytes,omitempty"`
+	Notes     string    `json:"notes"`
+	UpdatedAt time.Time `json:"updatedAt"`
 }
 
 // Decision is what the client receives.
@@ -44,6 +49,8 @@ type Decision struct {
 	Version     string `json:"version"`
 	Notes       string `json:"notes"`
 	DownloadURL string `json:"downloadUrl"`
+	SHA256      string `json:"sha256,omitempty"`
+	SizeBytes   int64  `json:"sizeBytes,omitempty"`
 }
 
 // Decide compares the version a client reported against the policy.
@@ -67,6 +74,8 @@ func Decide(policy Policy, clientVersion string) Decision {
 		Version:     normalize(policy.LatestVersion),
 		Notes:       strings.TrimSpace(policy.Notes),
 		DownloadURL: strings.TrimSpace(policy.DownloadURL),
+		SHA256:      strings.ToLower(strings.TrimSpace(policy.SHA256)),
+		SizeBytes:   policy.SizeBytes,
 	}
 
 	if minimum := parseVersion(policy.MinimumVersion); len(minimum) > 0 && compare(client, minimum) < 0 {