Repository navigation
fix(android): discover and verify updates from GitHub and CDN - #1424
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b93b64a52b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if let Err(error) = &github { | ||
| if error.starts_with("GitHub release candidate:") { | ||
| return Err(error.clone()); |
There was a problem hiding this comment.
If GitHub identifies an older release whose signature fetch fails, this unconditional return also rejects a valid, newer CDN candidate. For example, a signature timeout for GitHub Beta.4 prevents a validated CDN Beta.6 from being offered, even though selecting Beta.6 would not constitute the downgrade this guard is intended to prevent. api_manifest categorizes signature transport failures this way regardless of release version, and check propagates the error before comparing versions. Preserve the failed candidate's version and compare it with the CDN candidate before applying the fail-closed policy.
Useful? React with 👍 / 👎.
Android previously read only the CDN manifest, so a newly published GitHub release could be missed while the mirror was stale. Check both sources concurrently, choose the newest eligible signed release, and measure same-version download candidates by latency and throughput before downloading. If the chosen source fails, retry only another candidate for the same complete version and verify its own signature before opening the installer.
GitHub discovery supports all four Android ABIs, API rate-limit fallback to the public release feed, draft/assetless tags, bounded metadata and probe reads, and origin-restricted HTTPS redirects. A known newer signed-asset pair with invalid signature metadata fails closed instead of silently selecting an older mirror. App IPC remains compatible.
Prepare 2.0.2-Beta.6 and document the full changes since the last public Beta.4. Beta.5 remains an unpublished draft and its immutable tag is unchanged. Linux assets remain behind their independent acceptance gate.
Validation: 55 focused updater tests and the complete frontend/contract suite passed locally; a live anonymous API-rate-limit/public-feed fallback obtained the official signed Beta.4 APK metadata in 19.3 seconds. Full platform CI and Android builds must pass before tagging and publishing.