Context

The repository is private, so release assets can't be served from it, and downloads shouldn't cost per gigabyte.

Decision

CI uploads DMGs, signed update bundles and latest.json to an R2 bucket at downloads.shortleash.dev. The website redirects /download/* there. The Tauri updater checks updates/latest.json and verifies signatures with Short Leash's public key.

Consequences

No egress fees. The updater private key must stay out of the repository (it's a CI secret).