BUS Core v1.1.0 — Secure Manual Updates

BUS Core v1.1.0 adds the first full secure manual update pipeline.

This release moves BUS Core beyond a simple update-check/download-link model. Updates can now be manually staged through a verified local chain before the launcher offers to run the newer version.

What changed

Secure manual update staging

BUS Core now supports a manual Update flow from the app UI.

When an update is available, the user can click Update. BUS Core then stages the update locally through the following trust chain:

1. verifies the signed update manifest
2. downloads the release ZIP into the local update cache
3. verifies the ZIP SHA256 against the signed manifest metadata
4. safely extracts the ZIP into the local update cache
5. verifies the extracted EXE with Windows Authenticode
6. checks the signer subject is True Good Craft
7. checks the signer thumbprint matches the pinned TGC signing certificate
8. promotes the staged update to verified_ready only when every gate agrees

Verified launcher handoff

The launcher can now detect a newer verified_ready BUS Core executable after acquiring the DB ownership lock.

Depending on the configured launch policy, BUS Core can:

• ask before running the verified newer version
• always run the newest verified version
• continue running the current version only

The currently running EXE is never overwritten.

Update UI changed from Download to Update

The sidebar update panel now uses a manual Update button instead of a raw download action.

Check now remains a check-only action. It does not stage, install, restart, or launch anything by itself.

Update cache and staged state

BUS Core now uses a local update cache under the user’s BUS Core AppData area.

The staged update lifecycle is:

signed manifest → hash_verified ZIP → extracted package → exe_verified executable → verified_ready

Each stage is recorded conservatively. Failed stages do not promote the update.

Security improvements

• Signed update manifest support using Ed25519.
• Production manifest public key pinned in BUS Core.
• ZIP hash verification against signed manifest metadata.
• ZIP extraction hardening against path traversal / zip-slip.
• EXE Authenticode verification.
• True Good Craft signer subject enforcement.
• Pinned signer certificate thumbprint enforcement.
• Single-instance / DB ownership lock before launcher handoff decisions.
• No update artifact is treated as runnable until all trust gates pass.

What this release still does not do

BUS Core still does not:

• force updates
• auto-install updates
• overwrite the running executable
• silently restart the app
• run downloaded files directly
• stage updates during startup checks
• change /app/update/check into an install/apply endpoint

The update process remains user-controlled.

Upgrade notes

No migration action is required.

Users on older versions may still see a download-style update action depending on their installed version. Once running v1.1.0, future updates can use the new secure manual staging flow.

Release asset

Expected release asset:

BUS-Core-1.1.0.zip

The ZIP should contain the signed Windows executable:

BUS-Core-1.1.0.exe

The EXE must be signed before the ZIP is created.

Known limits

• Native secure update staging is Windows-focused because EXE trust verification uses Windows Authenticode.
• BUS Core does not yet provide a rich progress UI for each update staging step.
• Restart remains user-controlled; users may close and reopen BUS Core to run the verified newer version.

CHANGELOG entry

v1.1.0 — Secure Manual Updates

Added

• Added manual secure update staging through POST /app/update/stage.
• Added UI Update action for manually staging available updates.
• Added signed update manifest verification using Ed25519.
• Added production manifest public key policy.
• Added hash-verified update ZIP download into the local update cache.
• Added safe ZIP extraction into the local update cache with path traversal / zip-slip protections.
• Added Windows Authenticode verification for extracted BUS Core executables.
• Added True Good Craft signer subject enforcement.
• Added pinned signer certificate thumbprint enforcement.
• Added verified_ready promotion gate that requires hash, extraction, executable trust, and path consistency.
• Added launcher-side detection of newer verified-ready executables after DB ownership lock acquisition.
• Added verified launch policy options:
• ask
• always_newest
• current_only

Changed

• Replaced the raw update Download action with a manual Update staging action.
• Preserved /app/update/check as a check-only endpoint.
• Extended update cache state to track:
• hash_verified
• extracted
• exe_verified
• verified_ready
• Launcher startup now checks for verified-ready newer versions after acquiring the DB/app ownership lock and before normal server/browser startup.

Security

• Update artifacts are not considered ready until all trust gates pass.
• Extracted executables must be Authenticode-valid and signed by the pinned True Good Craft certificate.
• Running EXEs are never overwritten.
• Update staging does not auto-launch downloaded files.
• Update checks do not auto-stage or auto-install anything.

Not included

• No forced update behavior.
• No automatic installer behavior.
• No silent restart.
• No startup auto-update.
• No overwrite of the currently running executable.
• No release workflow or Lighthouse behavior change required for local staging beyond the signed manifest/update metadata already in place.