Trust

Verify an update

Connect uses a signed update manifest and SHA-256 so the client can verify published update metadata and the downloaded artifact.

01

Ed25519 manifest

The Update API signs its canonical manifest with a dedicated Ed25519 key. The app verifies that signature with the public key embedded in the client.

02

SHA-256

Each published installer receives a SHA-256 hash. After download, Connect can compare the file with the hash contained in the signed manifest.

Update API public key →Release history →