Application update feeds

Feed URLs and ordering

An enabled link serves /releases/TOKEN for downloads, /releases/TOKEN/latest.json for the latest publication, and /releases/TOKEN/index.json for all published versions. /releases/TOKEN/RELEASE_ID.json pins a publication.

Latest means most recently published, not highest semantic version. Deleting it restores the previous publication. Drafts never appear; revocation disables the page, feeds, and future downloads.

Feed schema

{
  "schemaVersion": 1,
  "version": "1.0.0",
  "title": "My app 1.0",
  "notes": "Release notes",
  "publishedAt": "2026-10-08T12:00:00.000Z",
  "assets": [{
    "name": "app-linux.tar.gz",
    "size": 12345,
    "sha256": "<64 lowercase hex characters>",
    "url": "https://orbitgit.com/releases/TOKEN/assets/RELEASE_ID/ASSET_ID/app-linux.tar.gz"
  }]
}

Implement the check

1. Fetch latest.json without account credentials. Handle 404 for absent publications or revoked links without breaking the installed app.
2. Validate schemaVersion and metadata, compare installed and available versions, then select your platform’s artifact.
3. Download to a temporary location and verify exact byte length and SHA-256 against the feed.
4. Use your platform’s installation and rollback process. The feed does not install or execute anything itself.

Treat the unlisted link as an access credential. The checksum is not an author signature; signed-updater applications should also verify their own signatures.

Check anonymously with the CLI

This reports available files without sending your account token or installing the app. OrbitGit’s own CLI uses its official update channel.

orbitgit release check https://orbitgit.com/releases/TOKEN --current 1.0.0