max / makenotwork
| 1 | -- Gate OTA artifact serving on a malware scan, mirroring the item/version |
| 2 | -- channel (audit 2026-07-01). Artifacts start 'pending' and are only advertised |
| 3 | -- / downloadable once the scan pipeline flips them to 'clean'. |
| 4 | -- |
| 5 | -- Existing rows predate scanning; mark them 'clean' so a migration doesn't strand |
| 6 | -- already-published releases (the alpha OTA channel is app-owner-gated and the |
| 7 | -- clients verify the ed25519 signature independently). |
| 8 | |
| 9 | ota_artifacts |
| 10 | ADD COLUMN IF NOT EXISTS scan_status TEXT NOT NULL DEFAULT 'pending'; |
| 11 | |
| 12 | UPDATE ota_artifacts SET scan_status = 'clean' WHERE scan_status = 'pending'; |
| 13 | |
| 14 | NOT EXISTS idx_ota_artifacts_scan_status |
| 15 | ON ota_artifacts(release_id, target, arch, scan_status); |
| 16 |