Auto-update feed for Aegis (macOS, Apple Silicon). Binaries only — the source lives in a separate private repository.
Each release carries a Aegis.app.tar.gz and its minisign .sig. The app's
updater resolves them through a manifest gist and verifies the signature
against a public key compiled into the bundle, so a tampered artifact is
rejected before it is ever unpacked.
This repository exists so the update download needs no credential. GitHub
answers 404 — not 403 — for release assets on a private repository, so a
machine without a token sees a missing release rather than an auth failure,
and goes looking for a problem that is not there. A public feed removes the
credential from the path entirely.
Nothing here is intended to be cloned or built. There is no source in it.