Trust
How updates are verified
An update is only installed when the app can prove it came from the publisher, unchanged.
Signatures
Each app has its own signing key. The private key never leaves the publishing machine: installers are built on separate build machines, unsigned, and signed afterwards. The public half of the key is compiled into the app, so the app knows what a genuine update looks like without trusting the network.
What the app checks
- It fetches a small manifest over HTTPS:
https://downloads.cloudtrust.us/<app>/latest.json, listing the newest version, its release notes, and one signed file per platform. - If the version is newer, it downloads that file in the background.
- It verifies the file's signature against the built-in public key. Any mismatch and the update is discarded.
- Only then does it offer to restart, or install the next time you quit.
Checksums
Every file is published with a .sha256 file next to it, for example
Kestrel-0.1.1-windows-x64-setup.exe.sha256. On Linux or macOS: shasum -a 256 <file>;
on Windows: Get-FileHash <file> in PowerShell.
Files are never changed in place
A published version is never replaced. Fixes ship as a new version, so a link to a version always returns the same bytes.
Operating-system signing
Current builds are not yet code-signed for Windows or notarized for macOS, so the first launch shows a warning (Windows SmartScreen: More info then Run anyway; macOS: right-click the app and choose Open). Automatic updates are still signed and verified as described above.