Notifying the consortium

There are a few ways and techniques that can be applied to ensure that every organization is notified that a business network is ready to be updated.

The one thing that is for certain is that manual notification is not an option; as the number of smart contracts and participants grows, you need a reliable notification process.

The following diagram depicts a potential process for deploying a business network following the delivery of a new release:

As we've previously discussed, we do not distribute the BNA as this would create the opportunity for someone to tamper with the archive. Instead, the notification only informs every organization of the existence of a new release and lets the consortium retrieve and deploy the archive.

This is effectively what the concept of the release listener is doing: listening for notification and then issuing a request to GitHub to retrieve the archive of the new release.

The release listener is a concept that would need to be implemented by a consortium should they decide to adhere to this approach. 
Do not look for the source code—it does not exist (yet).

The release listener could be implemented to listen for events coming from one of two sources:

The choice of the mechanism really depends on your business requirements but, generally, the use of GitHub webhooks would be preferable as they are triggered by the actual event we are interested in: the release of a new version of the smart contract.

Even if someone was to send a false notification to the release listener, because it only retrieves released binaries from GitHub, it would not be possible for a third party to inject a bad archive.