Skip to main content

SourceUpdate

Explicit owner trust and source configuration; feed credentials are write-only.

expected_revisionExpected Revision (integer)required

Current source revision, zero before setup.

Possible values: >= 0

base_url object

Trusted HTTPS release directory; omission retains the configured directory.

anyOf
string

Possible values: <= 2048 characters

metadata_filename object

Signed metadata basename; omission retains the configured name.

anyOf
string

Possible values: <= 206 characters

trust object

Explicit owner publisher keys and revocation view; omission retains trust. Existing revocations cannot be removed through source configuration.

anyOf
revisionRevision (integer)required

Monotonic owner trust revision.

Possible values: >= 1

expires_atExpires At (integer)required

UTC Unix expiry of this trust view.

Possible values: > 0

publishersobjectrequired

Publisher IDs mapped to Ed25519 public keys.

revoked_publishersstring[]

Publishers no longer authorized.

Possible values: <= 16

Default value: []
revoked_artifactsstring[]

Revoked bundle, wheel or runtime digests.

Possible values: <= 128

Default value: []
token object

Write-only feed bearer; omission retains the prior reference.

anyOf
string<password>
clear_tokenClear Token (boolean)

Explicitly use an anonymous feed; old protected credential evidence is retained.

Default value: false
SourceUpdate
{
  "expected_revision": 0,
  "base_url": "string",
  "metadata_filename": "string",
  "trust": {
    "revision": 0,
    "expires_at": 0,
    "publishers": {},
    "revoked_publishers": [
      "string"
    ],
    "revoked_artifacts": [
      "string"
    ]
  },
  "clear_token": false
}