Channels and signing

Signed release information#

latest.json is signed with Ed25519; the public key is embedded in the core. The core rejects:

• an unsigned or invalid manifest,
• an expired manifest (30 days),
• a release older than the installed one (a downgrade attack).

When rejected, the Updates screen says "Signature could not be verified", the update button becomes inactive and nothing is downloaded.

Private update channel#

To send a release first only to a certain site (e.g. the main site), a private channel is used:

• Channel files live on the server under channels/<channel>/; the stable latest.json and the installation package are not affected.
• According to the name in the AACP → Updates → "Private update channel" field, the site sees the higher one of the stable and the channel.
• Release: KANAL=<channel> bash yayinla.sh <version> hepsi.
• The channel version must be smaller than the stable release that will come later (channel 2.2.49 → then stable 2.2.50).

Which channel version wins#

If a site has entered a channel name, the update check looks at two sources: the stable latest.json and the channel's latest.json file. The one with the higher version is suggested; both must be signed. If the channel name is empty, only the stable channel is followed. The channel name must be unpredictable (6–64 characters: lowercase letters, digits, hyphen), because anyone who knows the address can read that channel; treat it like a password and do not write it in public texts.

Why a private channel first#

Sending a release first only to your own site means trying it on a real live site. If a problem comes up, nobody following the stable channel is affected. If no problem comes up, the release is published to the stable channel.

Which file does what#

min_allowed_version sets the lowest version a site cannot go back below; it prevents falling back to old versions after a critical security fix.

Signature renewal#

The manifest is valid for 30 days. If no new release is coming: bash yayinla.sh <current version> imzala (with KANAL=… for a channel).

What happens during an update#

The lock is taken, the 503 maintenance page is shown, a database snapshot is taken, and the files are first prepared side by side and then put in place quickly. If a file, migration or update step fails, files and database are restored together; if the process dies halfway, the next request repairs itself in public/index.php.