Release packages
Releases are built from committed files only, by build/release.sh.
php build/release.php keygen /secure/place/release.key # once
bash build/release.sh 0.2.0 --key /secure/place/release.key --url-base https://qorekit.com/releaseskeygen prints the public key, which goes into domain/Update/ReleaseKeys.php. Keep the private key off the server and out of the repository; whoever has it can sign updates that every installation accepts.
What a build makes
dist/ then holds:
| File | For |
|---|---|
qorekit-<version>.zip | Installing and updating. One top folder, qorekit/, with a release.json that lists every file's SHA-256 |
releases.json | The release feed that installations (QOREKIT_UPDATE_FEED) and hosting panels read |
qorekit-<version>-softaculous.zip, qorekit-<version>-installatron.zip | Packages for hosting panels' app installers |
The package holds only what runs on a server: no tests, no interface sources, no tooling, and PHP dependencies without development packages. The interface is built into public/build.
--dirty includes uncommitted changes, for a test build. Every file in a zip carries the commit's time, so the same commit always gives the same zip.
Signatures
release.php signs each package with Ed25519. The feed carries each package's SHA-256 and signature; an installation checks both against the keys it ships with before it touches a file. Test builds can be signed with a key of your own and trusted with QOREKIT_UPDATE_KEYS (see configuration).