- Threat model T1 and ADR 0009 state that the updater checks hashes from the
same feed and no signature: whoever can publish on the server can deliver an
update. T1 is accepted, not mitigated.
- Update-PackageManifests.ps1 refuses to write a manifest whose download does
not answer, so a package cannot be pushed before its release is on the
server.
- RELEASING.md: what a release on git.kof22.com must contain, the prerelease
flag, the ten-release window, and where a broken release is withdrawn.
- PackagingManifestTests pin the auto-update URL, the hash URL, the release
notes link and the version check exactly.
- UpdateService no longer says GitHub; the Chocolatey license and icon links
and ADR 0001/0003 follow.
Refs #170
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
The in-app updater reads the project's releases on its own Gitea server
through Velopack's GiteaSource, anonymously. The Scoop manifest (homepage,
download, version check, auto-update), the Chocolatey package and the script
that regenerates both for a release name the same server. ADR 0009 amends
ADR 0001; the threat model records the change of where that trust is placed.
Versions up to 1.1.0 look for updates on GitHub and are updated once by hand.
Closes#170
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandClaude Fable 5.2