Updates

Starf can tell you when a new version is out. This is the only part of it that uses the network, and it does nothing until you have answered a question about it.

The question comes first

On the first launch, before a single byte has gone anywhere:

Watch for new versions? Starf has not used the network, and will not without an answer here.

Answer no and Starf never opens a socket. Answer yes and it fetches one small file from elyracode.com once a day. Either answer is changeable from the status bar at any time.

What goes out

A plain GET for one static file. That is the whole request.

Two installations' requests are indistinguishable apart from their network addresses, which any request to any host necessarily reveals.

What comes back, and what it is allowed to do

{
  "version": "0.3.0",
  "released": "2026-09-20",
  "notes": [
    "Per-process network counters from nettop.",
    "Diagnostics gains a Reports page."
  ],
  "minimumMacos": "13.0"
}

Published at https://elyracode.com/starf/latest.json. Only version is required, so an older build never chokes on a file a newer one added a field to.

The download address is compiled into Starf and is never read from this file. That is the important part. A hijacked host, a mistaken edit or a hostile intermediary can change what the notice says; it cannot change where the button goes. Tested:

{ "version": "../../etc/passwd",
  "downloadUrl": "https://evil.example/malware.dmg" }
→ rejected: "The version file does not name a version."

Release notes are shown as plain text, never as markup. Nothing is downloaded and nothing is installed on its own — Starf tells you, and you choose.

A version that does not parse is never treated as newer, so a broken file cannot announce an update that does not exist. A pre-release does not supersede the release it precedes: 1.2.0-beta does not replace 1.2.0.

Where the state lives

~/Library/Application Support/no.gets.starf/updates.json:

{
  "enabled": true,
  "lastCheck": 1789217304070.3,
  "skipped": "0.3.0",
  "latest": { "version": "0.3.0", "notes": ["…"] }
}

enabled: null means the question has not been put yet. Deleting the file asks again.

The time is recorded before the request, so a host that is down is not retried on every launch.

The rules, in code

src-tauri/src/update.rs. Version comparison is a pure function with tests for a later version, an equal one, an older one, pre-releases, short versions like 2.1, and deliberate nonsense — an unparseable version, a four-part version, a path traversal and a number too large to hold. None of them is ever "newer".