Updates

The app checks for a newer version of itself when it starts (unless Check for updates on launch is off; it is on by default) and installs it itself. Everything about that lives under Settings → App → Updates: the channel, a Check for updates button, and — for administrators — the update source.

Stable and beta

Switching back from beta to stable does not downgrade you: you stay on the build you have until a stable release newer than it exists.

Every update is signature-checked

Each release is signed when it is built, and the public half of the signing key is compiled into the app. An update whose signature does not verify against that key is refused before anything on disk is replaced — so a compromised download host, or a manifest pointing somewhere else, can at worst fail to update you.

Where it looks

1. The update manifest in TMC’s downloads bucket — latest.json for stable, latest-beta.json for beta — which the release pipeline writes last, after every file it names has been uploaded. A build made without that address uses the site’s own update route (/api/app/v1/update/…) instead.
2. If the manifest cannot be reached — or the build has no signing key — the “newer version” banner asks the site’s /version, which answers with a download page rather than something to install.

So the banner works on every build, and the install button works whenever a key is configured.

The update source (administrators)

Update source (administrators) shows where updates come from and which key they must be signed with. It is read-only: the source cannot be changed from inside the app. To point the app at a staging bucket, a fork or a rotated key without rebuilding, an administrator sets updaterEndpoint (an HTTPS manifest address) and updaterPubkey (the key tauri signer generate printed) in the app’s settings.json while the app is closed. Because the key decides what the app will install over itself:

• only HTTPS addresses with no credentials in them are accepted, and the key has to be a valid public key; a value that fails either check is ignored;
• an override in force is written to the app’s audit log at Security level at every start, and that cannot be switched off;
• while either is set, the section stays expanded and marked overridden. Removing both keys from settings.json returns to the built-in source.