oxmc
ae9e830f7f
Bound service BgUpd consults before downloading component assets: discovers a trusted cache server (mDNS and/or central lookup, policy- configurable), verifies its signed CacheToken against a pinned root key, and hands back a rewritten URL + TLS pin. Three-tier discovery policy (runtime MDM override -> vendor-baked default -> compiled default). Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).
25 lines
1004 B
Plaintext
25 lines
1004 B
Plaintext
/*
|
|
* SPDX-FileCopyrightText: oxmc / PawletOS
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
package pawletos.cache;
|
|
|
|
interface IPawletCacheService {
|
|
// Rewrites originUrl to a local cache URL if a trusted cache server is
|
|
// currently active and its allowlist covers this origin; otherwise
|
|
// returns originUrl unchanged. Never blocks on network — resolution
|
|
// reads state refreshed in the background (see PawletCacheService),
|
|
// so this is safe to call before every download.
|
|
String resolveAssetUrl(String originUrl);
|
|
|
|
// Base64 SHA-256 of the active cache's TLS SubjectPublicKeyInfo, for the
|
|
// caller to pin its HTTPS connection against — the cache's cert is
|
|
// self-signed, this fingerprint (verified against the signed CacheToken)
|
|
// is the actual trust anchor, not a CA chain. Null if no cache is active.
|
|
String getActiveCacheTlsSpkiSha256();
|
|
|
|
// Diagnostics for a future settings UI.
|
|
boolean isCacheActive();
|
|
String getActiveCacheHost();
|
|
}
|