Updates and release downloads come from git.kof22.com #170

New Issue

2026-11-11T01:53:35Z

james.maes commented

2026-11-11 01:53:35 +00:00

Why

The project's home moved to git.kof22.com (#165), but the in-app updater, the Scoop and Chocolatey manifests and several documents still take releases from GitHub. The owner's decision: 1.1.1 is installed by hand from Gitea, and every version after it must update and download from git.kof22.com.

Checked before the change

Velopack 1.2.161 (already in use) has GiteaSource. A standalone program read https://git.kof22.com/KofTwentyTwo/gclo with it: the stable channel returns 1.1.0 (full and delta) and 1.0.0; the dev channel with prereleases returns its packages.
The 1.1.0 CLI zip on Gitea has the SHA-256 that the Scoop and Chocolatey manifests pin.
/api/v1/repos/KofTwentyTwo/gclo/releases/latest answers anonymously.

Change

UpdateService: GiteaSource instead of GithubSource.
Scoop manifest: homepage, download URL, version check and auto-update against Gitea. Chocolatey: download URL and release notes link. The script that regenerates both for a release writes Gitea URLs.
README, SECURITY.md, threat model, an ADR that amends ADR 0001.

Not in this issue

How a release gets built and published on Gitea. The release workflow is GitHub-only today; that route is the owner's decision and is tracked with the 1.1.1 release.

## Why The project's home moved to git.kof22.com (#165), but the in-app updater, the Scoop and Chocolatey manifests and several documents still take releases from GitHub. The owner's decision: 1.1.1 is installed by hand from Gitea, and every version after it must update and download from git.kof22.com. ## Checked before the change - Velopack 1.2.161 (already in use) has `GiteaSource`. A standalone program read `https://git.kof22.com/KofTwentyTwo/gclo` with it: the stable channel returns 1.1.0 (full and delta) and 1.0.0; the dev channel with prereleases returns its packages. - The 1.1.0 CLI zip on Gitea has the SHA-256 that the Scoop and Chocolatey manifests pin. - `/api/v1/repos/KofTwentyTwo/gclo/releases/latest` answers anonymously. ## Change - `UpdateService`: `GiteaSource` instead of `GithubSource`. - Scoop manifest: homepage, download URL, version check and auto-update against Gitea. Chocolatey: download URL and release notes link. The script that regenerates both for a release writes Gitea URLs. - README, SECURITY.md, threat model, an ADR that amends ADR 0001. ## Not in this issue How a release gets built and published on Gitea. The release workflow is GitHub-only today; that route is the owner's decision and is tracked with the 1.1.1 release.

james.maes referenced this issue from a commit

2026-11-11 01:58:54 +00:00

feat(update): updates and release downloads come from git.kof22.com

james.maes referenced a pull request that will close this issue

2026-11-11 01:58:54 +00:00

feat(update): updates and release downloads come from git.kof22.com #171

james.maes referenced this issue from a commit

2026-11-11 02:16:21 +00:00

fix(update): review of #171: say what the updater verifies, guard the manifests, and bring the runbook along

james.maes referenced this issue from a commit

2026-11-11 02:16:50 +00:00

docs(release): the tea command to mark a release as a prerelease takes a value