Module update 

Update-URL conventions shared by the runtime and the packer.

The runtime derives the detached-signature URL from the update URL, and the packer has to predict that name so a publisher uploads the signature where it will actually be requested. Both sides deriving it from one function is the point: a signature published under a name the runtime never asks for fails silently, and only for users who try to update.

Functions

detached_sig_filename

The bare filename a publisher must upload the signature as, derived from the update URL the package carries.

detached_sig_url

Build the detached-signature URL by appending .sig to the path component, before any query string or fragment. https://h/a?t=1 becomes https://h/a.sig?t=1, preserving query-bearing update URLs.