The native binary updater now fetches a manifest.json.raw-sig.json sidecar and verifies an RSASSA-PKCS1-v1_5-SHA512 signature over the manifest against a pinned public key before trusting the checksums and platform info used to download and install a new Claude Code binary. Releases that predate signing can still be accepted in some modes, and enforcement of the check is itself controlled remotely.
Native updater now verifies signed release manifests
The native updater verifies a signed release manifest before trusting checksums and installing a new binary.
You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
UpdaterArea: what it touches
ImprovementsKind: in v2.1.257,
What probably matters to youSection of the release