Clients query GET /v2/check?product=<id>&version=<x.y.z>&channel=stable and receive a manifest with a short-lived signed URL.
Binary downloads under /dl/ require a valid signature (X-Expires, X-Signature). Direct links without a signature are rejected with 403.
Delta patches are provided for the last three minor versions.