Updates and releases

Updating

The one-line installer: run it again. It downloads the newest release, checks its signature, installs it and restarts the server on the new version:

curl -fsSL https://homefellow.org/install.sh | sh

A package: install the newer .deb or .rpm. Docker: pull or build the newer image, then docker compose up -d again. The desktop app: install the newer app; the household it runs is updated with it.

What’s kept: the household’s data, its backups, the chosen models and the settings. If a new release changes the default settings, your /etc/homefellow/server.toml is kept and the new defaults are put beside it as server.toml.new.

The database is upgraded automatically when the new version starts. It’s a good idea to make a backup first: sudo homefellow backups run.

The apps and the server don’t have to be updated together, but keep them close: a much newer app may need a newer server.

sudo homefellow version shows the version that’s running.

Releases and signatures

Homefellow’s releases are published at https://releases.homefellow.org:

releases.homefellow.org/
  latest                       the latest version
  install.sh                   the one-line installer
  <version>/
    homefellow-<version>-x86_64-linux.tar.gz     .sig  .sha256
    homefellow-<version>-aarch64-linux.tar.gz    .sig  .sha256
    homefellow_<version>_amd64.deb …             .sig  .sha256
    homefellow-host-<version>-aarch64-macos.tar.gz …
    SHA256SUMS                                   SHA256SUMS.sig

homefellow.org/install.sh serves the same installer, so the one-line install works from either address.

Signatures

Every file is signed with Homefellow’s release key, as an SSH signature (ssh-keygen -Y sign, in the namespace homefellow-release). Checking one needs only ssh-keygen, which comes with OpenSSH on almost every Linux computer and Mac. The key, in SSH’s allowed-signers form:

release@homefellow.org namespaces="homefellow-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6g0I19tJIxxVqDn6B2hJspd9TyjWm7AU8xHQYC2pad

The same line is built into the one-line installer, which refuses any release whose signature doesn’t check. The file names carry the version. SHA256SUMS lists them all and is signed too. So the installer checks a download against that signed list, which ties each file to its release.

Checking a release by hand

Save the key line above as allowed_signers, then:

v=$(curl -fsSL https://releases.homefellow.org/latest)
curl -fsSLO https://releases.homefellow.org/$v/SHA256SUMS
curl -fsSLO https://releases.homefellow.org/$v/SHA256SUMS.sig
ssh-keygen -Y verify -f allowed_signers -I release@homefellow.org -n homefellow-release \
    -s SHA256SUMS.sig < SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

How releases are cut, signed and published is docs/RELEASES.md in Homefellow’s source.

Free and open source. For families of every shape.homefellow.org Privacy For AI assistants