Ferman

Self-hosted live updates for apps that don’t ship through a public store, with signed patches and staged rollouts.

Role: Architecture, Development, Rust
Status: v0.1, private repository
Stack: Rust · C ABI · Swift · Kotlin / JNI · C# / .NET · Flutter · Docker
Links: Private repository

01 The problem

Sideloaded and enterprise apps (point-of-sale terminals, internal tools, kiosk devices) still need fast fixes, but hosted live-update services are a poor fit when the fleet lives on your own network or under your own compliance rules.

An update channel is also an attack surface: whoever controls it controls every device.

02 What I built

A Rust update engine exposed through a C ABI, so one core serves native Android (JNI), Windows (C++/C#/.NET launcher and updater), internal iOS (Swift FermanKit) and Flutter on the stock engine.

A server and CLI for the release workflow: register a shipped base, publish a signed patch to a channel, roll it out to a percentage, promote, pause or roll back. The CLI is built for CI with app-scoped tokens.

Devices boot offline from an A/B slot, mark a patch good once healthy, and verify everything against pinned public keys. The signer owns the sequence number, so a server proposing one ahead of it is refused.

03 Worth knowing

Release pipeline builds CLI and server for Linux, macOS and Windows, plus a multi-arch server image smoke-tested per architecture.
Licensing split on purpose: the server is AGPL with a commercial option; everything that ships inside your app is Apache-2.0.
Architecture and threat model documented alongside the code.