# Windows Update Feed

QSfera Desktop uses the built-in Windows updater from `src/gui/updater`.
The updater reads `APPLICATION_UPDATE_URL`, appends query parameters such as
`version`, `platform=win32`, and `msi=true`, and expects an XML document with
root element `QSfera`.

Production feed URL:

```text
https://qsfera.kusoft.xyz/desktop/updates/stable.xml
```

The no-update feed is valid when no signed Windows MSI is available yet:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<QSfera>
  <version></version>
  <versionstring></versionstring>
  <web>https://qsfera.kusoft.xyz/</web>
  <downloadurl></downloadurl>
</QSfera>
```

To advertise a signed MSI update, publish the MSI over HTTPS and replace the
feed with a concrete version:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<QSfera>
  <version>1.3.7</version>
  <versionstring>1.3.7</versionstring>
  <web>https://qsfera.kusoft.xyz/</web>
  <downloadurl>https://qsfera.kusoft.xyz/desktop/downloads/QSfera_Desktop-1.3.7-x64.msi</downloadurl>
</QSfera>
```

From the repository root, prepare the feed XML from a signed MSI and optionally
upload the MSI/feed to the web host:

```powershell
.\scripts\package-windows-desktop.ps1
.\scripts\publish-windows-desktop.ps1 -MsiPath ".\artifacts\windows-desktop\QSfera-Desktop-4.0.0-win-x64.msi"
.\scripts\publish-windows-desktop.ps1 `
  -MsiPath ".\artifacts\windows-desktop\QSfera-Desktop-4.0.0-win-x64.msi" `
  -RemoteHost "192.168.0.185" `
  -RemoteDownloadDirectory "/var/www/qsfera/desktop/downloads" `
  -RemoteFeedPath "/var/www/qsfera/desktop/updates/stable.xml"
```

`publish-windows-desktop.ps1` refuses remote publication when the MSI is not
Authenticode-signed. `-SkipSignatureCheck` is only for local feed validation and
is rejected when `-RemoteHost` is set.

From the repository root, validate the feed before a Windows production release:

```powershell
.\Desktop\scripts\validate-desktop-update-feed.ps1 -Url "https://qsfera.kusoft.xyz/desktop/updates/stable.xml"
.\Desktop\scripts\validate-desktop-update-feed.ps1 -Path ".\artifacts\windows-desktop\publish\stable.xml"
.\Desktop\scripts\validate-production-release.ps1 -VerifyUpdateFeed
```

For a stable signed tag release, `validate-production-release.ps1 -RequireSigning`
also verifies this live feed.