Skip to main content
The most subtle attack on a desktop application is the one that gets a malicious build into your installer or your update channel. This page describes the controls that protect that path.

​
The build pipeline

Studio’s cloud deployment and desktop release use related but separate pipelines: The current desktop packaging targets macOS Apple silicon and Windows x64. Production publication has an approval gate and depends on platform verification and the required build checks. Preview and production channels use separate release configuration and feeds. Dependencies are installed from the committed lockfile. Some build steps execute dependency installation scripts; Studio does not make a blanket claim that all install scripts are disabled.

​
Code signing

Release checks verify the platform artifacts. The operating system applies its own signature and execution policy. Do not bypass an unexpected publisher, signature, or Gatekeeper warning; report it with the artifact version.

​
Update flow

The desktop app uses electron-updater for self-update. The flow:
1

App checks for updates

On launch and on a periodic schedule, Studio checks the release feed at download.altostrat.io for the current channel.
2

Compare with installed version

If a newer version exists, Studio downloads its metadata file (latest-mac.yml or latest.yml) which contains the version, release date, and SHA-512 hashes for each artifact.
3

Download the artifact

Studio downloads the platform-specific installer.
4

Verify SHA-512

electron-updater computes the SHA-512 of the downloaded artifact and compares it against the hash in the metadata file. A mismatch aborts the update.
5

Verify signature

The OS verifies the installer’s signature. macOS additionally checks notarization status. A failed signature aborts the update.
6

Apply on next restart

The verified update is staged. Studio applies it on the next restart so a long-running session is not interrupted mid-task.
The metadata file is served alongside the artifacts on the same controlled domain. Both are TLS-protected; the SHA-512 verification provides a defense-in-depth check that the bytes you ran through the OS-level signature check are also the bytes the release pipeline produced.

​
Release artifacts and component updates

Get Studio through the official download links in Install and sign in, or use the update action in Settings → About. Select the correct platform and release channel. A URL ending in latest identifies a moving release alias, not an immutable version. The bundled Go helper is shipped with Studio. Managed Remote Desktop has an additional viewer bridge and separately installed endpoint agent. Do not assume that updating Studio updates every managed endpoint or that an endpoint package belongs to the desktop update feed. Use the supported deployment process described in Managed Remote Desktop. Generated apps, plugins, MCP servers, and browser content have their own execution and trust boundaries. A signed Studio installer does not certify arbitrary third-party content or connector behavior.

​
What you can verify

  • The macOS signature: codesign -dv --verbose=4 /Applications/Altostrat\ Studio.app reports the signing identity and team.
  • The macOS notarization: spctl --assess --type execute /Applications/Altostrat\ Studio.app reports accepted from the notary service.
  • The Windows signature: right-click the installer → Properties → Digital Signatures, or Get-AuthenticodeSignature in PowerShell.
  • The release SHA-512: visible in latest-mac.yml / latest.yml on the download server, comparable against your downloaded installer.

​
Reporting a supply-chain concern

If you find something that looks like a tampered installer, an unexpected signature, a suspicious update prompt, or any indication that the supply-chain controls described here failed, contact us through troubleshooting. Supply-chain concerns are escalated immediately and not subject to normal triage queues.

Identity and access

The runtime authentication that depends on the signed binary having reached your machine intact.

Agent and local runtime

The two processes inside the signed installer and how they coordinate.