Updates
Signed, one-click, and never without your say-so.
How do updates work?
Donna checks GitHub Releases once at launch. If a newer version exists, a banner offers Update & restart: one click downloads, verifies, and relaunches. Updates are cryptographically signed (minisign); the app refuses anything that doesn’t match the public key baked into it. No update ever installs without your click.
Offline or on a flaky connection?
The check fails silently and tries again next launch. Nothing blocks, nothing nags.