Komorebi
Documentation

Updates

How Komorebi checks for a new version, downloads it only when you ask, and verifies its SHA-256 and Ed25519 signature before installing.

On this page

Checking

Settings > About > Check for updates asks GitHub for the project's latest release. With Check for updates automatically on, Komorebi also checks at most once a day. A check is one HTTPS request to api.github.com, with the User-Agent Komorebi/<version> and nothing else about you or your mail. When a newer version exists, Settings > About says so, and a quiet bar above the message list says "Version X is available."

Downloading and installing

Nothing is downloaded until you press Download and install. Komorebi then downloads three files of the release from github.com into a new komorebi-update-* folder in your temporary folder:

  • the installer, komorebi-<version>-setup.exe, with a progress bar when the server announces its size;
  • komorebi-<version>-setup.exe.sha256, its SHA-256 hash;
  • komorebi-<version>-setup.exe.sig, an Ed25519 signature.

How the download is verified

The installer runs only if both checks pass:

  1. Its SHA-256 matches the published .sha256.
  2. The Ed25519 signature verifies against the public key compiled into Komorebi. The signature covers the version and the hash together, so an older installer cannot be served as a newer one.

The private key that makes these signatures stays with the maintainer, outside the repository. When both checks pass, the installer runs without questions: it closes Komorebi, updates it in place and starts it again.

Checking a release yourself

To check an installer you downloaded with your browser, compare its SHA-256 with the release's .sha256 file, as shown in Getting started. With the source code, the project's sign_update example also verifies the Ed25519 signature:

cargo run --example sign_update -- verify komorebi-0.7.0-setup.exe 0.7.0