{"version":"2.1.257","anchor":"native-updater-now-verifies-signed-release-manifests","canonical_anchor":"native-updater-now-verifies-signed-release-manifests","heading":"Native updater now verifies signed release manifests","tier":"notice","area":"Updater","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/native-updater-now-verifies-signed-release-manifests","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### Native updater now verifies signed release manifests\n\nThe native updater verifies a signed release manifest before trusting checksums and installing a new binary.\n\nThe native binary updater now fetches a `manifest.json.raw-sig.json` sidecar and verifies an RSASSA-PKCS1-v1_5-SHA512 signature over the manifest against a pinned public key before trusting the checksums and platform info used to download and install a new Claude Code binary. Releases that predate signing can still be accepted in some modes, and enforcement of the check is itself controlled remotely.\n\n- Area: Updater\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 4\/5"}