Skip to content

v0.41.0 — tufup auto-updater scaffold

Choose a tag to compare

View all tags
@heidihelena heidihelena released this 27 Jun 13:59
v0.41.0
956f267
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Signed auto-updates for the frozen desktop app, built on tufup → The Update Framework. Updates are signed metadata + hashes, so a client accepts a new version only if signed by CiteVahti's offline keys — integrity even if the update server is compromised. The maintainer flow keeps the root/targets trust-anchor keys offline (the TUF key split).

INERT and safe until configured: with no update URL + no bundled trusted root (the state until the founder generates keys), every entry point is a no-op — never touches the network, never affects a launch, and nothing is auto-applied silently. docs/AUTO_UPDATE.md has the security model, key generation, per-release sign flow, and a key-management runbook.

🤖 Generated with Claude Code

Assets 5
Loading