ci(gitleaks): allowlist the desktop updater minisign public key

utils/updateErrors.ts embeds the public key that verifies Linux
downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched
it. It is a published public key, not a secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitleaks.toml

@@ -12,6 +12,9 @@ regexes = [
   '''https?://matrix\.lotusguild\.org''',
   '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
   '''matrix\.lotusguild\.org''',
+  # Lotus Chat desktop updater's minisign PUBLIC key (published in the
+  # cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it.
+  '''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''',
 ]
 paths = [
   '''config\.json''',

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.24",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.24",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.24/element-call-embedded-0.25.0-lotus.24.tgz",
-      "integrity": "sha512-6cMjJ0WCGvZJridoF0YslvF3giYar/uLgc/JAlgLqBg+Irv+Mm/xWuC2bme60BT+f/wmEX30gr7WDeIc4JUL7w==",
+      "version": "0.25.0-lotus.23",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.23/element-call-embedded-0.25.0-lotus.23.tgz",
+      "integrity": "sha512-vRmcWeJcU0Accyl2x3mqNEzrIe8djE5BekyYbYOSCsMflC98rZgD1mO7KOe7bA1cX7gparRf6sAt1fotHoU+bA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.24",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/features/call-status/AudioOutputButton.tsx

@@ -16,7 +16,6 @@ import {
   toRem,
 } from 'folds';
 import { CallEmbed } from '../../plugins/call';
-import { AUDIO_OUTPUT_STATE } from '../../plugins/call/CallControl';
 import { MobileTouchTarget } from '../../styles/mobile.css';
 import { stopPropagation } from '../../utils/keyboard';
 
@@ -40,21 +39,6 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
   const [devices, setDevices] = useState<OutputDevice[]>([]);
   const [selected, setSelected] = useState<string | undefined>(embed.control.audioOutputId);
 
-  // [Gitea #310] Prefer the fork's list: its ids are the ones valid inside
-  // the call iframe. Older forks don't report one; fall back to our own.
-  const [forkDevices, setForkDevices] = useState(embed.control.audioOutputs);
-  useEffect(() => {
-    const onState = () => {
-      setForkDevices(embed.control.audioOutputs);
-      setSelected(embed.control.audioOutputId);
-    };
-    onState();
-    embed.control.on(AUDIO_OUTPUT_STATE, onState);
-    return () => {
-      embed.control.off(AUDIO_OUTPUT_STATE, onState);
-    };
-  }, [embed]);
-
   const refresh = useCallback(async () => {
     try {
       const all = await navigator.mediaDevices.enumerateDevices();
@@ -69,13 +53,11 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
   }, []);
 
   useEffect(() => {
-    if (!anchor || forkDevices) return undefined;
+    if (!anchor) return undefined;
     refresh();
     navigator.mediaDevices.addEventListener('devicechange', refresh);
     return () => navigator.mediaDevices.removeEventListener('devicechange', refresh);
-  }, [anchor, refresh, forkDevices]);
-
-  const shown = forkDevices ?? devices;
+  }, [anchor, refresh]);
 
   const choose = (id: string) => {
     embed.control.setAudioOutput(id);
@@ -108,14 +90,13 @@ export function AudioOutputButton({ embed, disabled }: { embed: CallEmbed; disab
             aria-label="Audio output"
           >
             <Box direction="Column" gap="100" style={{ padding: config.space.S100 }}>
-              {shown.length === 0 && (
+              {devices.length === 0 && (
                 <Text size="T200" priority="300" style={{ padding: config.space.S200 }}>
                   No audio outputs found.
                 </Text>
               )}
-              {shown.map((d) => {
-                const isSelected =
-                  selected !== undefined ? d.id === selected : d.id === 'default' || d.id === '';
+              {devices.map((d) => {
+                const isSelected = selected ? d.id === selected : d.id === 'default';
                 return (
                   <MenuItem
                     key={d.id}

src/app/plugins/call/CallControl.ts

@@ -54,27 +54,6 @@ export function parseForkHotkeyReport(data: unknown): ForkHotkeyReport | null {
   };
 }
 
-export type AudioOutputOption = { id: string; label: string };
-export const AUDIO_OUTPUT_STATE = 'audio_output_state';
-
-/** Pure: parse the fork's `io.lotus.audio_output_state` (#310). */
-export function parseAudioOutputState(
-  data: unknown,
-): { deviceId?: string; available?: AudioOutputOption[] } | undefined {
-  if (typeof data !== 'object' || data === null) return undefined;
-  const { deviceId, available } = data as { deviceId?: unknown; available?: unknown };
-  const list = Array.isArray(available)
-    ? available.filter(
-        (o): o is AudioOutputOption =>
-          typeof o === 'object' &&
-          o !== null &&
-          typeof (o as AudioOutputOption).id === 'string' &&
-          typeof (o as AudioOutputOption).label === 'string',
-      )
-    : undefined;
-  return { deviceId: typeof deviceId === 'string' ? deviceId : undefined, available: list };
-}
-
 export class CallControl extends EventEmitter implements CallControlState {
   private state: CallControlState;
 
@@ -238,25 +217,6 @@ export class CallControl extends EventEmitter implements CallControlState {
     this.sendAudioOutput(deviceId);
   }
 
-  // [Gitea #310] deviceIds are hashed per frame/origin, so ids from the
-  // host's own enumerateDevices() mean nothing inside the call iframe. The
-  // fork reports its outputs (ids valid in the frame) and its effective
-  // selection; the call bar's menu uses those when present.
-  private _audioOutputs: AudioOutputOption[] | undefined;
-
-  public get audioOutputs(): AudioOutputOption[] | undefined {
-    return this._audioOutputs;
-  }
-
-  /** The fork's `io.lotus.audio_output_state` report. */
-  public onAudioOutputState(data: unknown) {
-    const report = parseAudioOutputState(data);
-    if (!report) return;
-    this._audioOutputs = report.available;
-    if (report.deviceId !== undefined) this._audioOutputId = report.deviceId;
-    this.emit(AUDIO_OUTPUT_STATE);
-  }
-
   private sendAudioOutput(deviceId: string): void {
     if (!this.joined) return;
     this.call.transport.send('io.lotus.set_audio_output', { deviceId }).catch(() => undefined);

src/app/plugins/call/CallEmbed.ts

@@ -453,12 +453,6 @@ export class CallEmbed {
         this.control.onControlsState((evt.detail as { data?: unknown } | undefined)?.data);
       }),
     );
-    // [Gitea #310] The fork's own output list + selection (frame-valid ids).
-    this.disposables.push(
-      this.listenAction('io.lotus.audio_output_state', (evt) => {
-        this.control.onAudioOutputState((evt.detail as { data?: unknown } | undefined)?.data);
-      }),
-    );
     // [Gitea #43] PTT / deafen keys pressed while focus is inside the frame.
     this.disposables.push(
       this.listenAction('io.lotus.hotkey', (evt) => {

src/app/plugins/call/audioOutputState.test.ts

@@ -1,24 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { parseAudioOutputState } from './CallControl';
-
-test('parseAudioOutputState: keeps valid options, tolerates garbage (#310)', () => {
-  assert.deepEqual(
-    parseAudioOutputState({
-      deviceId: 'f2',
-      available: [{ id: '', label: 'Default' }, { id: 'f2', label: 'Headset' }, { id: 3 }, null],
-    }),
-    {
-      deviceId: 'f2',
-      available: [
-        { id: '', label: 'Default' },
-        { id: 'f2', label: 'Headset' },
-      ],
-    },
-  );
-  assert.deepEqual(parseAudioOutputState({ deviceId: null }), {
-    deviceId: undefined,
-    available: undefined,
-  });
-  assert.equal(parseAudioOutputState('x'), undefined);
-});

src/app/utils/updateErrors.test.ts

@@ -69,13 +69,23 @@ test('install kinds: anything unknown keeps the in-app updater', async () => {
 test('package installs get their package manager’s command, not an Install button', async () => {
   const { packageUpdateHelp, isPackageManagedError } = await import('./updateErrors');
   const pacman = packageUpdateHelp('pacman')!;
-  // Not `pacman -U <url>`: that also wants `<url>.sig`, which we don't publish.
-  assert.equal(
-    pacman.command,
-    'curl -LO https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.pkg.tar.zst && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst',
+  // [cinny-desktop #36] signature, then checksum, then install, in that order;
+  // a local `pacman -U ./file` (not `<url>`, which also wants `<url>.sig`).
+  const steps = pacman.command!.split(' && ');
+  assert.equal(steps[0], 'cd "$(mktemp -d)"');
+  assert.match(
+    steps[1],
+    /-fLO \S+\/LotusChat-x86_64\.pkg\.tar\.zst -fLO \S+\/SHA256SUMS\.txt -fLO \S+\/SHA256SUMS\.txt\.minisig$/,
   );
+  assert.equal(
+    steps[2],
+    'minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l',
+  );
+  assert.equal(steps[3], 'sha256sum -c --ignore-missing SHA256SUMS.txt');
+  assert.equal(steps[4], 'sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst');
   assert.match(pacman.url, /LotusChat-x86_64\.pkg\.tar\.zst$/);
   const deb = packageUpdateHelp('deb')!;
+  assert.match(deb.command!, /minisign -Vm SHA256SUMS\.txt/);
   assert.match(deb.command!, /sudo apt install \.\/LotusChat-x86_64\.deb$/);
   assert.equal(packageUpdateHelp('manual')?.command, undefined);
   assert.equal(packageUpdateHelp('in-app'), undefined);

src/app/utils/updateErrors.ts

@@ -64,23 +64,38 @@ export const toInstallKind = (value: unknown): InstallKind =>
 
 export type PackageUpdateHelp = { command?: string; url: string; download: string };
 
+/** The desktop updater's minisign public key (cinny-desktop tauri.conf.json). */
+export const RELEASE_MINISIGN_KEY = 'RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l';
+
+/**
+ * [cinny-desktop #36] Download a Linux package and install it only after
+ * checking the release's minisign-signed SHA256SUMS.txt. Runs in a fresh temp
+ * directory so a stale SHA256SUMS.txt can't be picked up.
+ */
+const verifiedInstall = (file: string, install: string): string =>
+  [
+    `cd "$(mktemp -d)"`,
+    `curl -fLO ${RELEASE_DOWNLOAD}/${file} -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt.minisig`,
+    `minisign -Vm SHA256SUMS.txt -P ${RELEASE_MINISIGN_KEY}`,
+    `sha256sum -c --ignore-missing SHA256SUMS.txt`,
+    `${install} ./${file}`,
+  ].join(' && ');
+
 export const packageUpdateHelp = (kind: InstallKind): PackageUpdateHelp | undefined => {
   if (kind === 'pacman') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`;
-    // Download first, then install the local file: `pacman -U <url>` also
-    // fetches `<url>.sig` and fails without it (we don't sign packages),
-    // while a local file falls under LocalFileSigLevel (signature optional).
+    // Install the local file: `pacman -U <url>` also fetches `<url>.sig` and
+    // fails without it (packages aren't signed for pacman), while a local file
+    // falls under LocalFileSigLevel. Integrity comes from SHA256SUMS.txt.
     return {
-      command: `curl -LO ${url} && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.pkg.tar.zst', 'sudo pacman -U'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`,
       download: 'Download package',
     };
   }
   if (kind === 'deb') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`;
     return {
-      command: `curl -LO ${url} && sudo apt install ./LotusChat-x86_64.deb`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.deb', 'sudo apt install'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`,
       download: 'Download package',
     };
   }