Update channels

Three channels. You pick one per application, and you can move between them at any time.

• Stable. The default. Released after the full gate passes and a staged rollout completes.
• Beta. Feature complete builds that have passed the gate but want real-world exposure.
• Canary. Current development builds. Expect breakage; do not run these on a machine that matters.

How an update is verified

The update manifest is signed with a key that is kept offline and never touches our build system. Your application verifies that signature before it downloads anything. If the signature does not check out, no bytes are fetched.

This matters more than it sounds. An update channel is a path for running new code on your machine. If it were possible to tamper with the manifest, that path would belong to whoever did the tampering.

Large updates

Point releases ship as delta patches against the version you already have, so a small fix to a multi-gigabyte application is a small download. Full artifacts remain available if you would rather reinstall clean, and every download resumes if it is interrupted.

If the update service is down

The application runs normally and retries later. An update check that cannot complete never blocks the software from starting.