Palomar Sentry documentation Română

Updates

The app checks at start and then every six hours whether a new release exists, reading a list signed with the release key K1. A release is accepted only if its signature verifies under an active key, if its release number is above the running version’s and if the downloaded file has the signed hash; otherwise it is refused, and the file is deleted. No update is ever forced.

What a security update is

A release is a security update when it remedies a security advisory that concerns your version and system, or when the running version is below the oldest version still supported. The app downloads it at once and installs it at the next quit, unless you postponed it — by one, three or seven days — or turned automatic installation off. Security updates never depend on the licence.

When an update installs

Any other update is only announced and downloads only when you ask for it; once downloaded, it installs at the next quit of the app, under the same rule. “Install now” installs it on the spot and clears the postponement. On Linux, an AppImage is replaced in place, and a deb package installs with the system’s elevation prompt, never silently. A release signed with a key dropped in the meantime is withdrawn, and its download is deleted.

The setting

In About → Updates, “Install updates automatically” is on by default: a downloaded update installs on its own at the next quit of the app. Off, the app downloads it, tells you and waits for you to install it. There you also see the last successful check and can check now.

Windows: the SmartScreen step

The Windows installer is listed with its hash in SHA256SUMS, which is signed with the release key K1, and is verified like every file of the release. While it does not also carry a signature Windows recognises, SmartScreen shows the warning “Windows protected your PC” at its first start. Verify the installer by the steps on the release-verification page, then:

  1. Click “More info” in the SmartScreen window.
  2. Compare the file name with the one you downloaded and verified.
  3. Click “Run anyway”; the installer starts.

macOS

The macOS build is built and tested but is not published until it can be signed for macOS; it follows, with no date announced. Until then, the downloads page lists the installers for Windows and Linux.