Refs #36: the checksum route (decision 2026-10-19), not signed repos.
The .deb and .pkg.tar.zst aren't signed packages, and the in-app update prompt has users install them by hand, so nothing verified them.
Change
New checksums job (after build-linux and build-arch). It downloads the three Linux files from the release and writes SHA256SUMS.txt. It signs that with the updater's minisign key, the same TAURI_SIGNING_PRIVATE_KEY that signs the AppImage update, via tauri signer sign. It uploads SHA256SUMS.txt and the decoded SHA256SUMS.txt.minisig.
The README gains a "Verify a Linux download" section: minisign -Vm → sha256sum -c → install.
Notes
The Tauri signer needs a file extension (it panics on a bare SHA256SUMS) and reads TAURI_PRIVATE_KEY/TAURI_PRIVATE_KEY_PASSWORD, hence the names.
Verified locally with a throwaway key:
The job script run against the real latest downloads gives three hashes, sha256sum -c OK, and a valid prehashed minisign signature.
minisign 0.11 verifies it. A tampered SHA256SUMS.txt fails with "Signature verification failed".
The workflow YAML parses.
Not done: signed pacman/apt repositories (needs a new signing key), and the "detect install kind by current_exe()" note.
Refs #36: the checksum route (decision 2026-10-19), not signed repos.
The `.deb` and `.pkg.tar.zst` aren't signed packages, and the in-app update prompt has users install them by hand, so nothing verified them.
**Change**
- New `checksums` job (after `build-linux` and `build-arch`). It downloads the three Linux files from the release and writes `SHA256SUMS.txt`. It signs that with the **updater's minisign key**, the same `TAURI_SIGNING_PRIVATE_KEY` that signs the AppImage update, via `tauri signer sign`. It uploads `SHA256SUMS.txt` and the decoded `SHA256SUMS.txt.minisig`.
- The README gains a "Verify a Linux download" section: `minisign -Vm` → `sha256sum -c` → install.
**Notes**
- The Tauri signer needs a file extension (it panics on a bare `SHA256SUMS`) and reads `TAURI_PRIVATE_KEY`/`TAURI_PRIVATE_KEY_PASSWORD`, hence the names.
**Verified locally** with a throwaway key:
- The job script run against the real `latest` downloads gives three hashes, `sha256sum -c` OK, and a valid prehashed minisign signature.
- `minisign 0.11` verifies it. A tampered `SHA256SUMS.txt` fails with "Signature verification failed".
- The workflow YAML parses.
**Not done:** signed pacman/apt repositories (needs a new signing key), and the "detect install kind by `current_exe()`" note.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
The .deb and .pkg.tar.zst are not signed packages, and the in-app
update prompt has users install them by hand, so nothing checked them.
A new checksums job hashes the Linux downloads into SHA256SUMS.txt,
signs it with the updater's minisign key (tauri signer) and uploads
SHA256SUMS.txt + SHA256SUMS.txt.minisig. The README shows the
verify-then-install command.
Refs #36
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared
merged commit 04ad8720b8 into main2026-10-19 00:37:44 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #36: the checksum route (decision 2026-10-19), not signed repos.
The
.deband.pkg.tar.zstaren't signed packages, and the in-app update prompt has users install them by hand, so nothing verified them.Change
checksumsjob (afterbuild-linuxandbuild-arch). It downloads the three Linux files from the release and writesSHA256SUMS.txt. It signs that with the updater's minisign key, the sameTAURI_SIGNING_PRIVATE_KEYthat signs the AppImage update, viatauri signer sign. It uploadsSHA256SUMS.txtand the decodedSHA256SUMS.txt.minisig.minisign -Vm→sha256sum -c→ install.Notes
SHA256SUMS) and readsTAURI_PRIVATE_KEY/TAURI_PRIVATE_KEY_PASSWORD, hence the names.Verified locally with a throwaway key:
latestdownloads gives three hashes,sha256sum -cOK, and a valid prehashed minisign signature.minisign 0.11verifies it. A tamperedSHA256SUMS.txtfails with "Signature verification failed".Not done: signed pacman/apt repositories (needs a new signing key), and the "detect install kind by
current_exe()" note.🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5