Updates

Updates

Capystreama ships a signed auto-updater. Updating is safe by default: every release is verified against a detached OpenPGP signature before it's applied, and the swap on disk is atomic.

How it works

• The updater downloads the release for your platform from GitLab, along with its detached OpenPGP signature.
• The trust root is keys.openpgp.org over TLS — not the release repository itself — so a compromised release host can't also hand you a matching key.
• The downloaded binary is verified against its signature. Only if verification succeeds is the running binary replaced, in a single atomic on-disk swap.

Versions

Release versions are injected at build time. A binary you built locally reports its version as dev, which the updater treats as older than any release — so a local build will always offer to update to the latest published version.

Windows has a dedicated updater UI for applying updates while the app is running.

Releases & signing

Releases are cut with the project's release tooling (mage release:{patch,minor,major}) and published on GitLab . Each release includes a signed checksums.txt (checksums.txt.sig) so you can verify archives you download by hand, in addition to the in-app verification the auto-updater performs.