lumbridge-code/docs/DISTRIBUTION.md

Distribution plan

Lumbridge source and release metadata live in the public Gitea repository. Users should not need a Rust toolchain.

Initial release artifacts:

• macOS arm64: signed and notarized .dmg plus a tar archive.
• macOS x86_64: added when a maintained Intel runner is available.
• Ubuntu x86_64: .deb and AppImage.
• Omarchy/Arch x86_64: signed package archive and an AUR recipe that downloads the matching release artifact.

Each release includes SHA-256 checksums, a signed update manifest, SBOM, license notices, and the exact source commit. Reproducibility is a goal, but a release is not called reproducible until two clean builders produce matching artifacts.

The updater must verify signatures before replacing binaries, retain the prior version for rollback, and never update a running session runtime in place.