# Distribution plan

Lumbridge source and release metadata live in the public Gitea repository. Users
should not need a Rust toolchain.

Initial release artifacts:

- macOS arm64: signed and notarized `.dmg` plus a tar archive.
- macOS x86_64: added when a maintained Intel runner is available.
- Ubuntu x86_64: `.deb` and AppImage.
- Omarchy/Arch x86_64: signed package archive and an AUR recipe that downloads
  the matching release artifact.

Each release includes SHA-256 checksums, a signed update manifest, SBOM, license
notices, and the exact source commit. Reproducibility is a goal, but a release is
not called reproducible until two clean builders produce matching artifacts.

The updater must verify signatures before replacing binaries, retain the prior
version for rollback, and never update a running session runtime in place.