updates.jiraff.co — signed, pull-only release manifests. Appliances poll; nothing is ever pushed.
Latest non-yanked release for a component+channel, with update_available, artifact URL, SHA-256, Ed25519 signature and the public key. Verify the signature before applying.
curl 'https://updates.jiraff.co/api/v1/updates/manifest?component=appliance&channel=stable¤t=8.0.0'
The Ed25519 public key used to verify every release + plugin signature.