Public release log + update channel.
Every Dryx release is signed twice and listed here, so you can verify it before you install it.
What lives here
log.txt
Append-only record of every official Dryx release. Each line carries the version, SHA-256 of the binary, and the EdDSA signature over its release manifest. Gaps are publicly visible — an unofficial release is detectable by its absence.
appcast.xml
The release feed Dryx reads for its once-a-day update check. Each entry carries an EdDSA signature from the same offline key that signs every release. Dryx reads this feed to tell you a newer version exists and points you at dryx.ai/download; it does not download or install updates itself, and the check can be turned off in Settings.
pubkey.txt
The EdDSA public key Dryx uses to verify release manifests. The corresponding private key is held offline on dedicated hardware. The same public key is compiled into the Dryx app, which uses it to verify appcast entries.
How verification works
Every Dryx release ships with two signatures:
- Apple Developer ID — verifies via macOS Gatekeeper at install. Apple-revocable.
- Offline EdDSA — signed by a key Dryx never holds online. Even if Apple revokes our cert, Dryx still proves authentic.
Gatekeeper checks the Developer ID signature when you install. Dryx verifies the EdDSA signature on each appcast entry it reads during its once-a-day update check. Verifying this release log on every launch is planned; it is not in the shipping build yet, and this page will say so until it is.
For security researchers
Found something? Coordinated disclosure: dryx.ai/security; the contact address is in dryx.ai/.well-known/security.txt.