knowa_patch_format

The byte layout of a signed Knowa code-push patch, and of a key revocation record.

You do not depend on this package directly. knowa_sdk reads these formats on the device, and the Knowa CLI writes them. It is its own package so that both agree, byte for byte, on what is signed.

magic "KNOWA" | format version | metadata length | metadata (JSON) | Ed25519 signature (64) | payload

• The signature covers metadata || payload, so metadata cannot be moved to another payload or edited without invalidating it.
• Metadata is verified exactly as stored and never re-serialised: JSON key order is not canonical, and re-encoding would change the signed bytes.
• The metadata names the app, the build the patch was made for, the channel, a sequence number and, optionally, the one platform it may run on. knowa_sdk acts on those fields only after the signature has verified, so nobody without the key can choose the answer.
• A revocation record, signed by a separate offline key, tells devices to stop trusting one patch-signing key.

Parsing never trusts its input: anything malformed raises PatchFormatException, which knowa_sdk treats as "no patch".

License

BSD-3-Clause. See LICENSE.