jared
706b02545d
script-src drops unsafe-inline/blob/data/http/https (any-origin script exec is gone); the single inline shim in index.html is hash-pinned; object-src 'none', base-uri 'self'. Kept deliberately: 'unsafe-eval' (the window.eval native→web bridge + crypto wasm), broad connect-src (arbitrary homeservers), http: in img/media (plain-http homeservers), and review-added allowances for Google Fonts (VT323) and the OpenStreetMap location iframe. NEEDS RUNTIME SMOKE ON WINDOWS before release (CI can't catch CSP breakage): boot, avatars/media, VT323 renders, location map embeds, calls connect, deep links navigate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cinny desktop
Cinny is a matrix client focusing primarily on simple, elegant and secure interface. The desktop app is made with Tauri.
Download
Installers for macOS, Windows and Linux can be downloaded from Github releases. Releases are signed with a Ed25519 public-key.
| Operating System | Download |
|---|---|
| Windows | Get it on Windows |
| macOS | Get it on macOS |
| Linux | Get it on Linux · Flatpak |
Decoded public key:
RWRflTUQD3RHFtn25QNANCmePR9+4LSK89kAKTMEEB4OKpOFpLMgc64z
To verify release files, you need to download minisign tool and decode the .sig file before running:
minisign -Vm RELEASE_FILE.msi.zip -P RWRflTUQD3RHFtn25QNANCmePR9+4LSK89kAKTMEEB4OKpOFpLMgc64z -x SINGATURE.msi.zip.sig
Local development
Firstly, to setup Rust, NodeJS and build tools follow Tauri documentation.
Now, to setup development locally run the following commands:
git clone --recursive https://github.com/cinnyapp/cinny-desktop.gitcd cinny-desktop/cinnynpm cicd ..npm ci
To build the app locally, run:
npm run tauri build
To start local dev server, run:
npm run tauri dev