Updates

Capystreama ships a signed auto-updater on Windows. Updating there is safe by default: every release is verified against a detached OpenPGP signature before it’s applied, and the swap on disk is atomic.

On Linux the app does not update itself. The recommended install is the repository’s Nix flake, which exposes the app as capystreama (and as the flake’s default package). Add it to your system or home-manager configuration the way you would any other flake input:

{
    inputs.capystreama.url = "gitlab:terryp/capystreama";

    # ... in the module that builds your package set:
    environment.systemPackages = [
        capystreama.packages.${system}.capystreama
    ];
}

You then move to a new version by updating the lock — nix flake update capystreama — and rebuilding, the same as everything else you track.

If you did not install it that way, download the new archive from GitLab releases and replace your copy, or use whatever package manager you installed it with. If you want another package format — Flatpak, an AUR entry, a .deb — open an issue. The Settings tab shows the running version so you can tell whether you are behind.

On Windows

The Updates section of the Settings tab shows your current version, a Check for updates button, and a Check for updates on startup toggle (on by default, and throttled to at most one check a day). When a startup check finds a newer release, a dismissible banner appears across the top of the window — it never interrupts what you are doing. Updates are applied while the app is running; once one is installed, Restart now switches to the new version. If you choose to restart later, launching Capystreama again restarts the running copy into the new version, even if it is hidden in the tray.

How verification works

• The updater downloads the release for your platform from GitLab, along with its detached OpenPGP signature.

• The trust root is keys.openpgp.org over TLS — not the release repository itself — so a compromised release host can’t also hand you a matching key.

• The downloaded binary is verified against its signature. Only if verification succeeds is the running binary replaced, in a single atomic on-disk swap.

Versions

Release versions are injected at build time. A binary you built yourself reports its version as dev, which the updater treats as older than any release — so a local build will always offer to update to the latest published version.

Releases & signing

Releases are published on GitLab. Each one includes a signed checksums.txt (checksums.txt.sig), and each binary ships its own detached signature, so you can verify anything you download by hand — on any platform, in addition to the in-app verification the Windows updater performs.