'%20fill='%23EDEDED'%3e%3cg%20id='symbol'%3e%3crect%20x='0'%20y='0'%20width='10.5'%20height='42'%20rx='3.5'/%3e%3crect%20x='16'%20y='0'%20width='10'%20height='28'%20rx='3.5'/%3e%3crect%20x='31'%20y='14'%20width='10.5'%20height='28'%20rx='3.5'/%3e%3c/g%3e%3cg%20transform='translate(-19.88%20-0.33)%20scale(1.08)'%3e%3cg%20id='wordmark'%3e%3cpath%20d='M76%203H82V9H76Z%20M76%2011H82V36H76Z'/%3e%3cpath%20d='M86%2011H91.5V15.4C93.1%2012.3%2095.5%2010.8%2098.6%2010.8H100V16.5H97.9C93.7%2016.5%2092%2019%2092%2023.5V36H86Z'/%3e%3cpath%20fill-rule='evenodd'%20d='M110.8%2010.8C118.1%2010.8%20122.5%2015.8%20122.5%2023.5C122.5%2031.3%20118.1%2036.5%20110.8%2036.5C103.5%2036.5%2099.1%2031.3%2099.1%2023.5C99.1%2015.8%20103.5%2010.8%20110.8%2010.8Z%20M110.8%2015.5C107%2015.5%20105%2018.3%20105%2023.5C105%2028.8%20107%2031.8%20110.8%2031.8C114.6%2031.8%20116.6%2028.8%20116.6%2023.5C116.6%2018.3%20114.6%2015.5%20110.8%2015.5Z'/%3e%3c/g%3e%3cg%20fill='%23767676'%3e%3cpath%20id='period'%20d='M124%2030H130V36H124Z'/%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
Packages and updates
Format
.iropkg is a zip read by the kernel’s own strict reader (stored/deflate, no zip64/encryption/links, ≤ 5,000 files, ≤ 100 MiB) with signature.json checked in memory before anything is written: Ed25519 over a canonical { id, version, files } list plus rotation chains. The first install pins the publisher’s key for updates. Every publisher follows the same signature, pin and consent checks.
Install sources
Install package…, drop on Iro’s window, or an iro://install?url=…&sha256=… link. Sources: file, https:// URL, github:owner/repo (latest release’s one .iropkg), or a catalog entry. Only the kernel downloads: https only, no cookies/credentials, ≤ 5 redirects, ≤ 100 MiB, and the bytes checked are the bytes unpacked. A link only ever opens the consent sheet, never over another sheet.
Updates and rollback
Iro checks URL/GitHub/catalog sources daily, on wake and on Check now. Only a newer version from the pinned key (or a rotation from it) is offered; another key is refused on the app’s page and tile. Update automatically (per app, off by default) applies only same-key updates that ask for nothing new; anything else waits for the update sheet on the old version.
Updates keep the replaced version; Roll back restores its files and only consented grants, keeps app data and the pin, and turns auto-update off. A version revoked by the install’s source catalog cannot be restored.
Catalogs and the Store
A catalog is static signed JSON (iro catalog init/add/verify/revoke). Stores choose what they list and verify catalog signatures; Iro independently checks each package’s signature and publisher pin. The Store installs through iro.install.request and hears only installed/cancelled.
A catalog’s revoked: [{ id, versions, reason }] list turns off versions installed from that catalog. Iro enforces this for connections, calls, services, jobs and rollback, and closes the app’s views. Data, grants, bindings and accounts stay. An update to a version not revoked, or the catalog removing the revocation, turns the app on again.