The .deb and .pkg.tar.zst are not signed packages, and the in-app
update prompt has users install them by hand, so nothing checked them.
A new checksums job hashes the Linux downloads into SHA256SUMS.txt,
signs it with the updater's minisign key (tauri signer) and uploads
SHA256SUMS.txt + SHA256SUMS.txt.minisig. The README shows the
verify-then-install command.
Refs #36
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
The README was upstream's: its download buttons and minisign key pointed
at cinnyapp releases, so following it installed upstream Cinny and
verified it against the wrong key. Point downloads at this repo's
releases (NSIS exe, .deb, pacman package, AppImage), publish Lotus'
updater key, and list the desktop features.
Fixes#35
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Lotus CIandClaude Opus 5.5
Pietagorh
Tibor Szentmarjay
Andrew Davidson
Laker Turner
Krishan
Ajay Bura
Jakub Doboš