mait.sh1.132.1

Private beta: features and content may change. No warranty; use at your own risk.

AIDC Server workflows

Six things you do with the server, from publishing a first package and onboarding clients to rotating its key and reclaiming storage, each with the commands and what to check.

Beta
OverviewInstallWorkflowsOperateCustomizeInsideProblems and fixesAll components
Publish

Publish a first package

A publisher has the credentials with the publish feature and wants one tool version available to the whole organization.

You runaidc-pack build, inspect and verify for the version, then an upload to your AIDC Server's API.

Capturedaidc-pack 4.1.2 · direct mode, abridged
Build and check the pair locally
$ aidc-pack build nodejs 22.23.3
Building package for nodejs 22.23.3
Target: linux-amd64
[ok] Captured 4753 files (196362450 bytes)
[ok] Package created: ./packages/nodejs/22.23.3/nodejs-22.23.3-linux-amd64.tar.zst
[ok] Manifest created: ./packages/nodejs/22.23.3/nodejs-22.23.3-linux-amd64.manifest.json
Compressed size: 34590210 bytes
[ok] Package verified (6 commands, 0 env keys)

aidc-pack publish always sends to the MAIT Hub of your release channel, so for your own AIDC Server you upload through the API. The upload below needs your AIDC Server and a publisher credential.

Illustrative
Simple upload, up to 500 MiB
MANIFEST_HEADER=$(base64 -w0 packages/nodejs/22.23.3/nodejs-22.23.3-linux-amd64.manifest.json)
curl --fail-with-body --cacert server-trust.pem --cert publisher.pem --key publisher-key.pem \
  -H "X-Package-Manifest: $MANIFEST_HEADER" \
  -F "package=@packages/nodejs/22.23.3/nodejs-22.23.3-linux-amd64.tar.zst" \
  https://hub.example.com:8443/api/v1/packages/nodejs/22.23.3
Onboard clients

Hand your AIDC Server to people and pipelines

The server answers, and developers and pipelines should use it instead of the MAIT Hub.

You runnothing on the server; you give each client three things and test one request from its own machine.

Consume

Download and verify as a developer

A developer or pipeline needs one exact variant of a tool, and must know the bytes are the ones the server signed.

You runA catalogue lookup, a metadata request and a download, then the verification your tooling performs against the keys the server serves.

Illustrative
Metadata for one variant
$ curl --fail --cacert server-trust.pem --cert client.pem --key client-key.pem \
'https://hub.example.com/api/v1/packages/nodejs/20.11.0/metadata?platform=linux&architecture=x64'
{"tool":"nodejs","version":"20.11.0","platform":"linux","architecture":"x64", ... }
Rotate the key

Rotate the signing key

Your key-management schedule calls for a new signing key, or the data volume or a backup may have been exposed.

You runaidc-server keys status, keys rotate with a description you will recognise, then keys status and keys list again.

Illustrative
Rotate and confirm
$ aidc-server keys rotate --description docs-sample
Starting key rotation
Key rotation successful
New active key: fedcba9876543210
Previous key: 0123456789abcdef (now trusted)
Previous key moved to trusted status
Re-signing scheduled: packages will be re-signed automatically
$ aidc-server keys list
 
Keys
 
Status Fingerprint Description Packages
-------------------------------------------------------------------------
active fedcba9876543210 docs-sample 0
trusted 0123456789abcdef Initial key (auto-generated ... 0
Retention

Reclaim storage with retention

The data volume is filling up with old patch releases that nobody installs.

You runaidc-server recommended sync --file aidc.recommended, then aidc-server prune keep-recommended as a preview, then the same command with --execute.

Capturedaidc-server 3.21.6
A preview on an empty server
$ aidc-server prune keep-recommended
 
=== Prune Plan (dry-run) ===
 
TOTAL space to free: 0 B
[ok] Nothing to prune.
Integrity

Check package integrity

After a storage incident, or on a routine check, you want to know that every listed package still has its archive and manifest and still matches its recorded checksum.

You runaidc-server consistency check, optionally with --tool and --version.

Capturedaidc-server 3.21.6
A clean check
$ aidc-server consistency check
Checking consistency for all packages...
[ok] Consistency check complete
 
=== Consistency Check Summary ===
Total packages: 0
Checked packages: 0
 
[ok] All checks passed!
No issues found.
Next

Where to go next.