This guide is for partners authorised to publish SphereOX binary packages on the TIARC Lounge, manually or from their continuous integration pipeline.

Prerequisites

• A Lounge account with the Publisher role, approved by TIARC. Request it at contact@tiarc.be.
• Maximum file size: 512 MB.
• Accepted suffixes: .tar.gz .tgz .tar.xz .tar.zst .zip .deb .rpm .apk .img .iso .bin .efi .sig .asc .sha256
• Available channels: stable, beta, dev.

Manual upload (web form)

1. Sign in on the My account page.
2. In the “Publish a package” section, fill in the name (e.g. sphereox-core), version, channel and platform.
3. Select the binary file. You may provide the expected SHA-256 checksum: the server verifies it and rejects the upload on mismatch.
4. Click “Publish”: the package immediately appears in the catalog.

API upload (CI/CD)

1. Create an API token

The API uses WordPress application passwords (Basic authentication over HTTPS). In your Lounge profile (wp-admin → Profile → Application Passwords), create a password named e.g. “ci-sphereox” and store it safely (it will not be shown again).

2. Publish a package

curl -u "utilisateur:mot-de-passe-application" 
  -F "file=@sphereox-core-1.4.2.tar.gz" 
  -F "name=sphereox-core" 
  -F "version=1.4.2" 
  -F "channel=stable" 
  -F "platform=x86_64" 
  -F "description=Noyau SphereOX" 
  -F "sha256=$(sha256sum sphereox-core-1.4.2.tar.gz | cut -d' ' -f1)" 
  https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages

Response: 201 Created with the package metadata (id, computed sha256, download_url). The sha256 field is optional but strongly recommended: on mismatch the upload is rejected (400).

3. Available endpoints

• GET https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages — public catalog (filters ?name= and ?channel=).
• GET https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages/<id> — package details.
• GET https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages/latest?name=&channel= — latest published version.
• GET https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages/<id>/download — binary (authentication required).
• POST https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages — publish (Publisher role required).

Retrieving packages

Latest version of a package (public metadata):

curl "https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages/latest?name=sphereox-core&channel=stable"

Binary download (approved Lounge account):

curl -u "utilisateur:mot-de-passe-application" -OJ 
  "https://lounge.tiarc.be/wp-json/tiarc-lounge/v1/packages/<id>/download"

An RSS feed of new releases is available: lounge.tiarc.be/?feed=sphereox-releases.

Best practices

• Use SemVer versioning (MAJOR.MINOR.PATCH).
• Always publish the SHA-256 checksum; verify it after download.
• Reserve stable for validated releases; use beta/dev otherwise.
• One API token per system (CI, workstation): revoke individually if leaked.