Learn · Foundations · 04 of 04

How releases reach you

GitHub builds the image, Cloudflare R2 stores it, the Worker serves and verifies it.

Opichy does not build Raspberry Pi images in the cloud runtime. The pipeline is:

GitHub (source) → GitHub Actions (pi-gen build) → Cloudflare R2 (storage) → You

What is published for each release

releases/<version>/
  opichy-controller-pi5.img.xz   flashable image
  opichy-runtime.tar.gz          application package for existing controllers
  *.opichy.json                  example configuration bundles
  manifest.json                  machine-readable description of the above
  sha256.txt                     checksums

The Worker at opichy.com reads the release catalogue from D1, streams files from R2 with resumable range requests, and tracks per-controller state in a Durable Object so a controller can ask "is there a newer version for me?".

Verifying a download

Every artifact carries a SHA-256 checksum. The Downloads page can verify a file you've downloaded entirely in your browser — the hashing runs in a WebAssembly module compiled from the same Rust code the controller uses, and the file never leaves your machine.