Konvoa Engineering
Authorize release links without becoming a file host
Using scoped file IDs, signed URL metadata, and pinned artifact hashes while release bytes stay on infrastructure the application owner controls.
Separate authorization from hosting
A licensing service can decide whether a user may learn where a release is available without receiving, storing, or proxying the release itself. That keeps the authorization boundary focused on identity, device, license, subscription, session, and application policy.
The application owner keeps the actual bytes on infrastructure they choose. Konvoa records an unpredictable application-scoped file ID, a descriptive name, a public HTTP or HTTPS URL, and an optional SHA-256 digest. It never uploads or fetches the referenced artifact.
Resolve an application-scoped file ID
The signed client requests a file ID, not an arbitrary URL. The service first proves that the ID belongs to the authenticated application, is active, and is permitted by the user’s current subscription. IDs use a random 128-bit namespace so enumeration is not a substitute for authorization.
After those checks, the signed JSON response contains the exact file ID, direct URL, delivery mode, and any configured artifact digest. Cross-application IDs and disabled legacy-hosted records fail without revealing another workspace’s metadata.
Keep credentials away from the download host
Treat link resolution and artifact transfer as two separate HTTP operations. Verify Konvoa’s response signature first, then start a fresh unauthenticated request to the owner’s host. Never forward the Konvoa bearer token, device signature, request nonce, cookies, or signed canonical headers across that boundary.
The service returns URL data rather than following the URL or proxying the response. This removes a server-side request-forgery surface and prevents customer-controlled responses from consuming Konvoa’s bandwidth or being mistaken for Konvoa-hosted content.
Pin the bytes, not just the address
Any external URL can later serve different bytes. Owners can pin a lowercase SHA-256 to a file record; the client hashes the complete downloaded artifact and rejects it before installation when the result differs from the digest in Konvoa’s signed response. Clients should refuse unpinned HTTP artifacts for automatic update or execution because HTTP provides no transport integrity.
Publishing makes the file ID, URL, and digest immutable for that version. Ship a new file record and version when the artifact changes; do not silently replace history at an existing release URL.
Be honest about link confidentiality
Konvoa can protect discovery of the URL, but a static external URL may be copied after an authorized client receives it. Owners needing stronger delivery confidentiality should use their own short-lived object-storage URL or authenticated download service and rotate it through a new file record.
Log the file ID and authorization outcome, not query credentials or the complete URL. Disabling the record stops Konvoa from returning it again, while the external host remains responsible for removing or revoking the underlying object.
Plan takedowns at the owner-controlled host
Keeping bytes outside the authorization service also keeps content review and takedown responsibility with the infrastructure account that published them. Record who created each file ID, restrict who may change draft links, and make the external storage provider's abuse and retention controls part of the release process.
During an incident, disable the Konvoa record to stop new authorized discovery, revoke the object at its origin, end affected application sessions, and publish a replacement under a new file ID and digest. Those separate actions avoid pretending that deleting metadata from one system removes copies already delivered elsewhere.
Test the boundary
Exercise a file ID from another application, a disabled record, an expired subscription, a revoked session, malformed, local, private, or non-web URLs, a changed remote artifact, a digest mismatch, redirect loops, interrupted transfer, and an external host that is unavailable. Errors should remain stable without disclosing foreign records.
This design does not pretend that a URL is DRM. It makes the authorization decision explicit, prevents Konvoa from becoming a content host or fetch proxy, and gives the client a signed digest it can enforce before trusting downloaded bytes.