LotusGuild/cinny-desktop
3
0
Fork 0
Code Issues 12 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

feat(release): signed SHA256SUMS.txt for the Linux downloads (#36)

Browse Source 
The .deb and .pkg.tar.zst are not signed packages, and the in-app
update prompt has users install them by hand, so nothing checked them.
A new checksums job hashes the Linux downloads into SHA256SUMS.txt,
signs it with the updater's minisign key (tauri signer) and uploads
SHA256SUMS.txt + SHA256SUMS.txt.minisig. The README shows the
verify-then-install command.

Refs #36

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
This commit is contained in:
Lotus CI
2026-10-19 00:35:30 -04:00
co-authored by Claude Opus 5.5
parent 4019cbaef1
commit 4b9f3c092d
2 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16
View File
@@ -19,6 +19,22 @@ Builds are published on this repo's releases page:
There is no macOS build at the moment.
### Verify a Linux download
Each release has a `SHA256SUMS.txt`, signed with the same key as the updater
(below). Check the signature, then the file, then install, e.g. for Arch:
```sh
B=https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest
curl -LO $B/LotusChat-x86_64.pkg.tar.zst -LO $B/SHA256SUMS.txt -LO $B/SHA256SUMS.txt.minisig
minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l \
&& sha256sum -c --ignore-missing SHA256SUMS.txt \
&& sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst
```
For Debian / Ubuntu use `LotusChat-x86_64.deb` and `sudo apt install ./LotusChat-x86_64.deb`.
`minisign` is in both distributions' repositories.
### Updates and signatures
The app updates itself from