README is still upstream Cinny's: download links and signing key point at cinnyapp, and no Lotus desktop features are documented #35

New Issue

2026-10-04T19:50:23-04:00

jared commented

2026-10-04 19:50:23 -04:00

README.md is upstream's, unchanged:

Downloads: "Installers … can be downloaded from Github releases". The Windows/macOS/Linux buttons link to cinnyapp/cinny-desktop releases (Cinny_desktop-x86_64.msi, …AppImage, Flathub in.cinny.Cinny).
Signing key: the "Decoded public key" is upstream's (RWRflTUQD3RHFtn25QNANCmePR9+4LSK89kAKTMEEB4OKpOFpLMgc64z). The Lotus updater uses its own key (tauri.conf.json → plugins.updater.pubkey).

Anyone following the README installs upstream Cinny, not Lotus Chat, and verifies it against the wrong key.

Also missing: any description of the Lotus desktop features shipped in this repo. None of these are documented anywhere a user or contributor would look:

tray with unread/call/update state and DND;
launch on login and start minimized;
the first-close choice (tray or quit);
Windows rich toasts with Reply / Mark as read, and Focus Assist sync;
taskbar badge, flash, upload progress, thumbnail toolbar, jump list and SMTC media keys;
system-wide PTT/deafen;
the keychain mirror;
the call page on its own origin and WebView permission scoping;
the Linux NVIDIA/Wayland workarounds and the "call in browser" fallback;
updater behaviour for pacman/deb installs.

Fix: point downloads at https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/latest (NSIS exe, .deb, .pkg.tar.zst with the two-step pacman command); publish the Lotus updater public key; add a short features section (or a LOTUS_DESKTOP.md).

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

`README.md` is upstream's, unchanged: - **Downloads:** "Installers … can be downloaded from [Github releases](https://github.com/cinnyapp/cinny-desktop/releases)". The Windows/macOS/Linux buttons link to **`cinnyapp/cinny-desktop` releases** (`Cinny_desktop-x86_64.msi`, `…AppImage`, Flathub `in.cinny.Cinny`). - **Signing key:** the "Decoded public key" is upstream's (`RWRflTUQD3RHFtn25QNANCmePR9+4LSK89kAKTMEEB4OKpOFpLMgc64z`). The Lotus updater uses its own key (`tauri.conf.json` → `plugins.updater.pubkey`). Anyone following the README installs **upstream Cinny**, not Lotus Chat, and verifies it against the wrong key. **Also missing:** any description of the Lotus desktop features shipped in this repo. None of these are documented anywhere a user or contributor would look: - tray with unread/call/update state and DND; - launch on login and start minimized; - the first-close choice (tray or quit); - Windows rich toasts with Reply / Mark as read, and Focus Assist sync; - taskbar badge, flash, upload progress, thumbnail toolbar, jump list and SMTC media keys; - system-wide PTT/deafen; - the keychain mirror; - the call page on its own origin and WebView permission scoping; - the Linux NVIDIA/Wayland workarounds and the "call in browser" fallback; - updater behaviour for pacman/deb installs. **Fix:** point downloads at `https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/latest` (NSIS exe, .deb, .pkg.tar.zst with the two-step pacman command); publish the Lotus updater public key; add a short features section (or a LOTUS_DESKTOP.md). --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._