Skip to content

PointSav Documentation

The engineering library for the PointSav platform — operating systems and services for regulated businesses that own their data, their AI, and their record-keeping outright. Where the monorepo holds the code, this wiki holds the reasoning: architecture, services, security, and the governance commitments that bind future development.

PointSav Digital Systems

Revision as of · 89db9436

Historical revision — this record as it stood on 22 August 2026, not the current version. View the current record →

Private binary download endpoint for paying customers

The binary release server is the component of software.pointsav.com that delivers compiled binaries to paying customers. It is a thin, stateless gate: it holds no payment records, no customer data, and no signing keys. Its sole responsibility is to verify that a presented license token is genuine and authorises the requested product, then stream the binary file.

Route structure

Product and version discovery. An unauthenticated products index lists every product with releases on the server; a per-product index lists that product's available versions. Both are designed for tooling — package managers, installer scripts, CI pipelines.

Versioned binary download. The primary gated endpoint serves a binary for a specific product, version, and platform, and requires a valid license token — with one exception: a product whose manifest sets requires_license: false is served to anyone, no token required. A detached Ed25519 signature file for each binary is available at a corresponding path and is always unauthenticated — detached signatures are public by design, letting any party verify a binary's authenticity without holding a license.

Latest-version redirect. A convenience endpoint resolves the highest available version for a given product and platform and issues a redirect to the versioned download path, forwarding the license token through. It only redirects to a platform for which a release actually exists.

Release manifest and install script. A per-version manifest endpoint and a per-product install.sh endpoint are both unauthenticated, letting tooling inspect a release or fetch an installer without a license token.

Token introspection. An authenticated endpoint checks a presented token against a product and returns its validity, product ID, version floor, channel expiry, and entitlements — without initiating a download. A separate endpoint serves the server's own public verification key in hex, so a client can verify a detached signature independently. A health-probe endpoint supports uptime monitoring.

Authentication

The release server accepts a license token as an Authorization: Bearer header or as a token query parameter. The query-parameter form exists specifically for browser-initiated one-click downloads: a storefront can generate a URL carrying the token so a customer can download directly from their browser with no header configuration. Both forms are equally secure — neither exposes the token to any party beyond the client and the server.

Verification logic

A token is base64url(signature[64 bytes] || payload_json) — an Ed25519 signature over the payload bytes, prepended to the payload itself. The server splits the token, verifies the signature against its stored public key, then checks the payload's product field against the requested product and confirms the channel hasn't expired. A bad or malformed signature returns 401; a valid signature for the wrong product, or an expired channel, returns 403.

Platform strings

Platform strings follow the Rust target triple convention — x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, x86_64-apple-darwin, and similar. The server maps product, version, and platform directly to a file path in the releases directory; a combination with no built binary returns 404. The latest-version redirect only targets platform strings for which a release file actually exists.

Key management and fail-safe behaviour

The server loads its public Ed25519 verification key at startup from configuration. If no key is configured, it does not silently accept every token — the download and introspection endpoints return 503 instead. A correctly configured instance accepts only tokens signed by the corresponding private key.

What the server does not do

The Git protocol path is a stub: it returns a 503 with a pointer to the public GitHub repository, not a live proxy and not an HTTP redirect — smart-HTTP Git access is not yet enabled.

See also

Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is currently a trade name of Woodfine Capital Projects Inc. ("Woodfine"), planned to become a wholly-owned Woodfine subsidiary upon incorporation. PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. The full trademark notice appears in the footer of every page on this site.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →