# update-hub

> Signed release and auto-update server at https://update.kimhwan.kr. Projects contain components; each component has channel releases (stable, beta, ...) made of files. Apps read one manifest, verify an ECDSA P-256 signature with an embedded public key, and download only the files that changed.

AI agents: read the full guide before doing anything. It covers sign-in without pasting secrets (device flow), creating projects and components, putting the upload token straight into CI secrets, the CI upload step, and client code that verifies signatures (C#, Node, Python, Go, Java). The guide is written in Korean; commands and code are copy-paste ready for this server.

## Docs

- [Agent guide](https://update.kimhwan.kr/agents.md): the complete how-to and API reference (markdown)
- [Rendered guide](https://update.kimhwan.kr/docs): the same guide as a web page

## Tools

- [Device-flow sign-in helper, bash](https://update.kimhwan.kr/cli/login.sh): `bash login.sh start "client name"`, then `bash login.sh wait`; stores the token in ~/.config/update-hub/auth-header without printing it
- [Device-flow sign-in helper, PowerShell](https://update.kimhwan.kr/cli/login.ps1)
- [Release signing public key](https://update.kimhwan.kr/api/v1/signing-key): SubjectPublicKeyInfo base64 + fingerprint 8e7a6fe0acdd5116