Ships signed, self-updating builds to closed testers from a Cloudflare Worker, with no public downloads. It suits any updater that can send an auth header and verify a signature. This is a pattern to adapt, so read the updater's own docs for the client side.

How it works

Client sends GET feed with Authorization: Bearer <token>.
Worker looks up sha256(token) in KV. Unknown gets 401, over a rate limit gets 429.
Registered client gets the feed from R2, then GET /download/<archive> with the same header.
Client verifies the signature against its embedded public key, then installs.

Two separate controls:

Access comes from the Worker. KV holds only SHA-256 hashes of tokens, so a KV leak yields nothing usable.
Integrity comes from the signature. The client accepts only archives signed by the key it shipped with, so a compromised bucket or Worker can't push code to testers.

Per project: a Worker, an R2 bucket, a KV namespace, a hostname and an update signing key. Releases run locally, so signing keys stay off CI.

private-software-distribution

How it works

Setup