
Web applications, eLoader and licenses
Web applications, eLoader and licenses in eUpdate 1.7.8
Each release has its own installation target, requirements and license. Set
them when uploading a ZIP, or use Installation and license beside an
existing release. Metadata edits preserve the original ZIP and SHA-256. The
project card shows the latest release's license beside its date and its ZIP
file count beside the number of versions, including metadata and documentation.
Package targets
| package.target | Purpose |
| --- | --- |
| software | Existing programs and source code packages. |
| hosting | Hosted web application, such as PHP. |
| hosting_module | Module of the hosted application in the same project. |
| eloader_app | Application installed into eLoader. |
| eloader_module | Module of the eLoader application in the same project. |
package.type remains release or module. Select an existing project and
Module role before choosing a module target. An OS-independent PHP package
can select Source code / OS independent and declare its PHP requirement.
Targets and requirements may differ between releases.
installation.web_root is relative to the original ZIP root, such as public
or example-app/public. A dot means the root. The directory must contain
package files. archive_metadata.working_directory remains the separate
working directory for existing installation commands. Paths describe the
original ZIP; Git export wrapper removal does not affect these paths.
Requirements and licenses
{
"package": { "type": "release", "target": "eloader_app" },
"requirements": { "php": ">=8.2 <9.0", "eloader": ">=1.0 <2.0" },
"license": "MIT",
"installation": { "web_root": "public" }
}Supported operators: >=, >, <=, < and =. A version without an operator
means equality. Space- or comma-separated conditions must all match. Empty or
* means no version restriction. Short numeric versions are padded: 8.2
means 8.2.0. Composer operators ^, ~, wildcards like 8.*, and || are
not supported and are rejected on save. Describe additional requirements,
such as PHP extensions and databases, in README; the resolver does not yet
check them.
Modules also declare requirements.application:
{
"software_id": "example-app",
"version": ">=1.2 <2.0"
}The required application ID must match the module's project. eLoader packages
require the client to report an eLoader version even without a minimum.
Modules require both the installed application ID and its version. Missing
required environment values mean unknown compatibility.
License presets: MIT, Apache 2.0, BSD 2-Clause, BSD 3-Clause, GPL 2.0, GPL 3.0,
LGPL 3.0, AGPL 3.0, MPL 2.0, ISC, Unlicense, CC0 1.0 and Custom. An unspecified
license defaults to MIT. Recognized existing licenses are preserved; other
existing values become Custom. Custom requires a name or terms in
license_custom.
Manifest license is an ID such as Apache-2.0 or custom. The specification
also exposes a license object with id, name and custom_text. Licensing
terms are separate from free/paid module access and never grant download
permissions. eUpdate does not insert a LICENSE file into the immutable ZIP;
publishers include it in their package.
Installation links and compatible updates
Copy installation link copies a pinned JSON descriptor URL:
https://update.estudium.eu/package.php?software_id=example-app&version=1.2.0Module links add module=reports. The eupdate-installation-v1 response
contains package with version, license, requirements, deployment,
install_json, archive download_url, size and SHA-256. installation_url
pins a release; update_url selects a compatible release when the client
adds its environment.
/package.php?software_id=example-app&target=eloader_app&php=8.3.6&eloader=1.1.0¤t_version=1.0.0
/package.php?software_id=example-app&module=reports&target=eloader_module&php=8.3.6&eloader=1.1.0&application_id=example-app&application_version=1.5.0¤t_version=1.0.0version: optional exact release; omit to find the latest compatible one.target: desired installation target.php,eloader: actual client runtime versions.application_id,application_version: installed parent application for modules.current_version: installed version of the selected package for update comparison.
Without version, all releases are considered using PHP version_compare.
A compatible 1.10.0 may be selected instead of an incompatible 2.0.0. If none
match, the endpoint returns HTTP 409, error: no_compatible_release,
package: null, and candidates with missing or mismatched requirements.
update_available is true only for a newer compatible version, never a
downgrade. Archived projects offer no latest installation/update, but known
pinned releases remain available.
A pinned URL can return metadata before an environment is supplied. Inspect
compatibility.status: compatible, incompatible, or unknown, and
installable. The client proceeds only when compatible. missing and
mismatches explain the result.
Existing /updates.php accepts the same environment filters. Without them,
it keeps its previous latest-release behavior. Static /updates.json remains
the unfiltered public catalog. Opening the upgraded application automatically
refreshes static specifications. No new cron job is needed.
eWeb and eLoader integration
- Read the copied URL with the client's environment and expected target.
- Check
installable, package type, and required application. - Download
package.download_urlusing the same authorization as the metadata. - Verify size and SHA-256. Use descriptor metadata, since publishers may edit
requirements without changing the original install.json inside the ZIP.
- Perform the client's own safe extraction, deployment and version tracking,
with backup and rollback before upgrades.
This release implements the eUpdate side. eWeb/eLoader installation clients
must consume this descriptor; eUpdate does not execute anything on the target
hosting environment.
Public packages require no login. Private packages use X-Project-Secret;
a module secret only unlocks that module. Paid modules can also use the
existing approved server identity and active license (X-Server-ID,
X-Server-Hostname, and API key as described in the check-in manual).
Credentials are not inserted into ordinary copied links or response JSON.
Authorization applies to both metadata and archive downloads. Descriptors
are not publicly cached.
Example manifests
Program author: PB <pavel.bartos.pb@gmail.com>