Public release log + update channel.
The Dryx release log, update feed and release verify key are published here. No release is listed yet, and the Dryx app does not yet read the log or check releases against the key.
What lives here
log.txt
The public record of Dryx releases, one line per release as it is published: the version, the SHA-256 of the installer, and the EdDSA signature over its release manifest. No release is listed yet, and the Dryx app does not read this log yet.
appcast.xml
The release feed Dryx reads for its update check, about once a day. Each entry will carry an EdDSA signature from the offline release key; the feed has no entries yet, and the app does not check entry signatures yet. Dryx reads this feed to tell you a newer version exists and points you at dryx.ai/download; it does not download or install updates itself, and the check can be turned off in Settings.
pubkey.txt
The EdDSA public key that verifies Dryx release manifests. The corresponding private key is held offline on dedicated hardware. The shipping build of the app does not use this key yet: it does not verify feed entries against it (see below).
How verification works
Each Dryx release is signed twice before it is listed here; none is listed yet:
- Apple Developer ID — verifies via macOS Gatekeeper at install. Apple-revocable.
- Offline EdDSA — signed by a key Dryx never holds online. Even if Apple revokes our certificate, a release listed here can still be checked against the published key.
Gatekeeper checks the Developer ID signature when you install. Today Dryx reads the feed only to tell you a newer version exists; it does not verify the signature on feed entries, and it never downloads or installs anything itself. Verifying each feed entry and this release log inside the app is planned; neither is in the shipping build yet, and this page will say so until they are.
For security researchers
Found something? Coordinated disclosure: dryx.ai/security; the contact address is in dryx.ai/.well-known/security.txt.