English · 中文
A local vault for the release-signing keys of self-updating desktop apps.
Every app that updates itself over the network eventually relies on the same trust model: a private key signs the update manifest, and a public key embedded in the installed app verifies it. Sparkle, Tauri's updater, electron-updater, WinSparkle, Google Omaha — the scheme is universal. What nobody hands you is custody for the private half: where it lives, how it reaches CI, when it rotates, and how you notice a stray copy before it rotates you.
📖 New to update signing? Read the bilingual handbook — 使用手册 / Handbook (中文原文， with an idiomatic English translation; switchable per language) — or the source markdown: install, connect a vault, every daily operation, wiring CI, shipping updates, and key rotation, written for complete beginners.
Keyward is a small desktop app that guards those keys. Built on the family Rivet line — a Racket engine with native hosts — it keeps the vault file in your own synced folder and adds the discipline a plaintext store lacks:
- Never displayed, copy-only. Key values are only ever returned by an explicit copy-to-clipboard action.
- Loss protection. Every mutation snapshots the store first (append-only, inside the synced folder); writes are atomic and permissions are tightened.
- Deep check. Parses each key (Ed25519 / RSA PKCS#8, base64-DER, base64-PEM or bare PEM), derives the public half, computes the fingerprint, and pairs it against the stored public material — the audit that used to be a pile of hand-run openssl commands. Every private entry is checked against all public anchors of the same purpose; a section passes only when every private key passes, with each fingerprint labelled in multi-key sections.
- Collect, don't scatter. In-app keypair generation writes straight into the vault; PEM imports land as single-line base64 values. No stray key files, even momentarily.
- Orphan detection. Multi-line residue from a bad paste shows up as line numbers the moment the vault is opened.
The vault format is plain INI ([product] sections, NAME = value,
comments preserved) and stays the single source of truth — Keyward is a
discipline layer over it, not a lock-in.
Free release-infrastructure tool under AGPL-3.0; no commercial activation. Desktop previews for macOS, Windows and Linux. Use a synthetic disposable vault before connecting real release credentials.
Installation, first use, privacy, backup and recovery · 简体中文
v0.2.0 is out — installers for all three desktops on the Releases page: macOS (arm64 / x64, DMG + zip), Windows (x64, MSI + zip) and Linux (x64 / arm64, deb + rpm + AppImage + tar.gz + zip), each with a SHA-256 sidecar. The Windows (WinUI 3) and Linux (GTK4) hosts are built and CI-covered. Roadmap: rotation workflow (generate-next → promote, following the two-phase runbook), stray-key scanner for working trees, Sparkle/Tauri key format import and export.
The vault is plaintext by design — it lives in a private sync between
your own trusted devices, and the budget goes to full-disk encryption on
each device instead. Keyward never sends a key anywhere: there is no
network code in the engine. See AGENTS.md for the operating rules
(never print values, never commit the vault, collect strays immediately).
raco rivet dev # build backend + macOS host, run the app
raco test tests/ # engine tests (store + key metadata)
raco rivet package # distributable- Shared engine:
app/backend.rkt+app/core/(RVT1 contract — the wire surface shared by every future host) - macOS UI:
macos-host/Sources/RivetHost/ - Windows UI:
windows/· Linux UI:linux/
AGPL-3.0