fix(desktop): the Linux update command verifies the signed SHA256SUMS before installing (cinny-desktop #36)

The pacman / apt update command installed the downloaded package with
no integrity check. Download it with the release's SHA256SUMS.txt and
.minisig into a fresh temp dir, verify the signature with the updater
key (minisign), check the hash, then install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

package-lock.json

@@ -81,7 +81,7 @@
       },
       "devDependencies": {
         "@axe-core/playwright": "4.13.0",
-        "@lotusguild/element-call-embedded": "0.25.0-lotus.25",
+        "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
         "@playwright/test": "1.63.0",
         "@rollup/plugin-inject": "5.0.5",
         "@rollup/plugin-wasm": "6.2.2",
@@ -2695,9 +2695,9 @@
       "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA=="
     },
     "node_modules/@lotusguild/element-call-embedded": {
-      "version": "0.25.0-lotus.25",
-      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.25/element-call-embedded-0.25.0-lotus.25.tgz",
-      "integrity": "sha512-Vvw6B+QoG0/qFJcBzhlAbE+vnk83DikpeeF2xbygpoHfmG9r1H/mS47V91jAMH2vmNbGiALwFlLbJjEET43A2g==",
+      "version": "0.25.0-lotus.23",
+      "resolved": "https://code.lotusguild.org/api/packages/LotusGuild/npm/%40lotusguild%2Felement-call-embedded/-/0.25.0-lotus.23/element-call-embedded-0.25.0-lotus.23.tgz",
+      "integrity": "sha512-vRmcWeJcU0Accyl2x3mqNEzrIe8djE5BekyYbYOSCsMflC98rZgD1mO7KOe7bA1cX7gparRf6sAt1fotHoU+bA==",
       "dev": true
     },
     "node_modules/@matrix-org/matrix-sdk-crypto-wasm": {

package.json

@@ -108,7 +108,7 @@
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
-    "@lotusguild/element-call-embedded": "0.25.0-lotus.25",
+    "@lotusguild/element-call-embedded": "0.25.0-lotus.23",
     "@playwright/test": "1.63.0",
     "@rollup/plugin-inject": "5.0.5",
     "@rollup/plugin-wasm": "6.2.2",

src/app/components/CallEmbedProvider.tsx

@@ -86,7 +86,6 @@ import { CallAvatarAnimation } from '../styles/Animations.css';
 import { webRTCSupported } from '../utils/rtc';
 import { CallsUnavailableMessage } from '../features/call/CallsUnavailable';
 import { zIndices } from '../styles/zIndex';
-import { useReconnectWhenSynced } from '../hooks/useCallError';
 import { useDenoiseNotices } from '../hooks/useDenoiseNotices';
 
 const PIP_MIN_W = 200;
@@ -815,7 +814,6 @@ function CallUtils({ embed, joined }: { embed: CallEmbed; joined: boolean }) {
   useCallPolicyRevokedToast(embed, joined);
   useCallEndedToast(embed);
   useScreenshareNotices(embed);
-  useReconnectWhenSynced(embed.control);
   useDenoiseNotices(embed);
   // [Gitea #43] The in-frame screenshare button follows the same room policy
   // as the host bar's (hidden where the server would refuse the share).

src/app/features/call-status/CallStatus.tsx

@@ -1,5 +1,5 @@
 import React, { useMemo } from 'react';
-import { Box, Button, Spinner, Text, color } from 'folds';
+import { Box, Spinner, Text, color } from 'folds';
 import { useAtomValue } from 'jotai';
 import classNames from 'classnames';
 import { LiveChip } from './LiveChip';
@@ -18,7 +18,6 @@ import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { MemberSpeaking } from './MemberSpeaking';
 import { clockSkewAtom } from '../../state/clockSkew';
 import { describeSkewVsServer } from '../../utils/clockSkew';
-import { useCallError } from '../../hooks/useCallError';
 
 type CallStatusProps = {
   callEmbed: CallEmbed;
@@ -43,8 +42,6 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
   const clockSkew = useAtomValue(clockSkewAtom);
 
   const compact = screenSize === ScreenSize.Mobile;
-  // [Gitea #318] The call dropped ("Connection lost" in the frame).
-  const callError = useCallError(callEmbed.control);
 
   const memberVisible = callJoined && callMembers.length > 0;
 
@@ -68,25 +65,6 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
           {!compact && (
             <>
               <CallRoomName room={room} />
-              {callError && (
-                <>
-                  <StatusDivider />
-                  <Text size="T200" truncate role="alert" style={{ color: color.Critical.Main }}>
-                    Call disconnected
-                  </Text>
-                  {callError.recoverable && (
-                    <Button
-                      size="300"
-                      radii="300"
-                      variant="Critical"
-                      fill="Soft"
-                      onClick={() => callEmbed.control.reconnect()}
-                    >
-                      <Text size="B300">Reconnect</Text>
-                    </Button>
-                  )}
-                </>
-              )}
               {clockSkew.warning && clockSkew.skewMs !== null && (
                 <>
                   <StatusDivider />
@@ -124,19 +102,8 @@ export function CallStatus({ callEmbed }: CallStatusProps) {
       {memberVisible && !compact && <StatusDivider />}
       <Box shrink="No" alignItems="Center" gap="Inherit">
         {compact && (
-          <Box grow="Yes" alignItems="Center" gap="200">
+          <Box grow="Yes">
             <CallRoomName room={room} />
-            {callError?.recoverable && (
-              <Button
-                size="300"
-                radii="300"
-                variant="Critical"
-                fill="Soft"
-                onClick={() => callEmbed.control.reconnect()}
-              >
-                <Text size="B300">Reconnect</Text>
-              </Button>
-            )}
           </Box>
         )}
         <CallControl callJoined={callJoined} compact={compact} callEmbed={callEmbed} />

src/app/hooks/useCallError.ts

@@ -1,41 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import { SyncState } from 'matrix-js-sdk';
-import { CALL_ERROR_CHANGED, CallControl } from '../plugins/call/CallControl';
-import { CallErrorState } from '../plugins/call/callError';
-import { useMatrixClient } from './useMatrixClient';
-import { useSyncState } from './useSyncState';
-
-/** [Gitea #318] The fork's current call error (null while the call is fine). */
-export function useCallError(control: CallControl): CallErrorState {
-  const [err, setErr] = useState(control.callError);
-  useEffect(() => {
-    const on = () => setErr(control.callError);
-    on();
-    control.on(CALL_ERROR_CHANGED, on);
-    return () => {
-      control.off(CALL_ERROR_CHANGED, on);
-    };
-  }, [control]);
-  return err;
-}
-
-/**
- * [Gitea #318] After a homeserver stall the call drops with "Connection
- * lost". Once sync is back, reconnect automatically (once per drop).
- */
-export function useReconnectWhenSynced(control: CallControl): void {
-  const mx = useMatrixClient();
-  const err = useCallError(control);
-  const tried = useRef<CallErrorState>(null);
-  useSyncState(
-    mx,
-    useCallback(
-      (state: SyncState | null) => {
-        if (state !== SyncState.Syncing || !err?.recoverable || tried.current === err) return;
-        tried.current = err;
-        control.reconnect();
-      },
-      [err, control],
-    ),
-  );
-}

src/app/plugins/call/CallControl.ts

@@ -3,7 +3,6 @@ import { EventEmitter } from 'events';
 import { CallControlState } from './CallControlState';
 import { ElementMediaStateDetail, ElementMediaStatePayload, ElementWidgetActions } from './types';
 import { canDelegateCapability } from './utils';
-import { CallErrorState, parseCallError } from './callError';
 
 export enum CallControlEvent {
   StateUpdate = 'state_update',
@@ -55,8 +54,6 @@ export function parseForkHotkeyReport(data: unknown): ForkHotkeyReport | null {
   };
 }
 
-export const CALL_ERROR_CHANGED = 'call_error_changed';
-
 export class CallControl extends EventEmitter implements CallControlState {
   private state: CallControlState;
 
@@ -215,27 +212,6 @@ export class CallControl extends EventEmitter implements CallControlState {
     return this._audioOutputId;
   }
 
-  // [Gitea #318] The fork's error page ("Connection lost") is up; the host
-  // kept showing the call as joined with controls that did nothing.
-  private _callError: CallErrorState = null;
-
-  public get callError(): CallErrorState {
-    return this._callError;
-  }
-
-  /** The fork's `io.lotus.call_error` report. */
-  public onCallError(data: unknown) {
-    const next = parseCallError(data);
-    if (next === undefined) return;
-    this._callError = next;
-    this.emit(CALL_ERROR_CHANGED);
-  }
-
-  /** Press the fork's Reconnect / Try again. */
-  public reconnect(): void {
-    this.call.transport.send('io.lotus.reconnect', {}).catch(() => undefined);
-  }
-
   public setAudioOutput(deviceId: string): void {
     this._audioOutputId = deviceId;
     this.sendAudioOutput(deviceId);

src/app/plugins/call/CallEmbed.ts

@@ -453,12 +453,6 @@ export class CallEmbed {
         this.control.onControlsState((evt.detail as { data?: unknown } | undefined)?.data);
       }),
     );
-    // [Gitea #318] The fork's error page ("Connection lost") is up / cleared.
-    this.disposables.push(
-      this.listenAction('io.lotus.call_error', (evt) => {
-        this.control.onCallError((evt.detail as { data?: unknown } | undefined)?.data);
-      }),
-    );
     // [Gitea #43] PTT / deafen keys pressed while focus is inside the frame.
     this.disposables.push(
       this.listenAction('io.lotus.hotkey', (evt) => {

src/app/plugins/call/callError.test.ts

@@ -1,17 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { parseCallError } from './callError';
-
-test('parseCallError (#318)', () => {
-  assert.deepEqual(parseCallError({ code: 'CONNECTION_LOST_ERROR', recoverable: true }), {
-    code: 'CONNECTION_LOST_ERROR',
-    recoverable: true,
-  });
-  assert.deepEqual(parseCallError({ code: 'E2EE_NOT_SUPPORTED' }), {
-    code: 'E2EE_NOT_SUPPORTED',
-    recoverable: false,
-  });
-  assert.equal(parseCallError({ code: null }), null);
-  assert.equal(parseCallError({}), undefined);
-  assert.equal(parseCallError('x'), undefined);
-});

src/app/plugins/call/callError.ts

@@ -1,14 +0,0 @@
-/**
- * [Gitea #318] The fork's `io.lotus.call_error`: its error page is showing
- * (`{ code, recoverable }`) or was cleared (`{ code: null }`).
- */
-export type CallErrorState = { code: string; recoverable: boolean } | null;
-
-/** Pure: parse a report; undefined for garbage (ignored). */
-export function parseCallError(data: unknown): CallErrorState | undefined {
-  if (typeof data !== 'object' || data === null) return undefined;
-  const { code, recoverable } = data as { code?: unknown; recoverable?: unknown };
-  if (code === null) return null;
-  if (typeof code !== 'string' || !code) return undefined;
-  return { code, recoverable: recoverable === true };
-}

src/app/utils/updateErrors.test.ts

@@ -69,13 +69,23 @@ test('install kinds: anything unknown keeps the in-app updater', async () => {
 test('package installs get their package manager’s command, not an Install button', async () => {
   const { packageUpdateHelp, isPackageManagedError } = await import('./updateErrors');
   const pacman = packageUpdateHelp('pacman')!;
-  // Not `pacman -U <url>`: that also wants `<url>.sig`, which we don't publish.
-  assert.equal(
-    pacman.command,
-    'curl -LO https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.pkg.tar.zst && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst',
+  // [cinny-desktop #36] signature, then checksum, then install, in that order;
+  // a local `pacman -U ./file` (not `<url>`, which also wants `<url>.sig`).
+  const steps = pacman.command!.split(' && ');
+  assert.equal(steps[0], 'cd "$(mktemp -d)"');
+  assert.match(
+    steps[1],
+    /-fLO \S+\/LotusChat-x86_64\.pkg\.tar\.zst -fLO \S+\/SHA256SUMS\.txt -fLO \S+\/SHA256SUMS\.txt\.minisig$/,
   );
+  assert.equal(
+    steps[2],
+    'minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l',
+  );
+  assert.equal(steps[3], 'sha256sum -c --ignore-missing SHA256SUMS.txt');
+  assert.equal(steps[4], 'sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst');
   assert.match(pacman.url, /LotusChat-x86_64\.pkg\.tar\.zst$/);
   const deb = packageUpdateHelp('deb')!;
+  assert.match(deb.command!, /minisign -Vm SHA256SUMS\.txt/);
   assert.match(deb.command!, /sudo apt install \.\/LotusChat-x86_64\.deb$/);
   assert.equal(packageUpdateHelp('manual')?.command, undefined);
   assert.equal(packageUpdateHelp('in-app'), undefined);

src/app/utils/updateErrors.ts

@@ -64,23 +64,38 @@ export const toInstallKind = (value: unknown): InstallKind =>
 
 export type PackageUpdateHelp = { command?: string; url: string; download: string };
 
+/** The desktop updater's minisign public key (cinny-desktop tauri.conf.json). */
+export const RELEASE_MINISIGN_KEY = 'RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l';
+
+/**
+ * [cinny-desktop #36] Download a Linux package and install it only after
+ * checking the release's minisign-signed SHA256SUMS.txt. Runs in a fresh temp
+ * directory so a stale SHA256SUMS.txt can't be picked up.
+ */
+const verifiedInstall = (file: string, install: string): string =>
+  [
+    `cd "$(mktemp -d)"`,
+    `curl -fLO ${RELEASE_DOWNLOAD}/${file} -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt.minisig`,
+    `minisign -Vm SHA256SUMS.txt -P ${RELEASE_MINISIGN_KEY}`,
+    `sha256sum -c --ignore-missing SHA256SUMS.txt`,
+    `${install} ./${file}`,
+  ].join(' && ');
+
 export const packageUpdateHelp = (kind: InstallKind): PackageUpdateHelp | undefined => {
   if (kind === 'pacman') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`;
-    // Download first, then install the local file: `pacman -U <url>` also
-    // fetches `<url>.sig` and fails without it (we don't sign packages),
-    // while a local file falls under LocalFileSigLevel (signature optional).
+    // Install the local file: `pacman -U <url>` also fetches `<url>.sig` and
+    // fails without it (packages aren't signed for pacman), while a local file
+    // falls under LocalFileSigLevel. Integrity comes from SHA256SUMS.txt.
     return {
-      command: `curl -LO ${url} && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.pkg.tar.zst', 'sudo pacman -U'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`,
       download: 'Download package',
     };
   }
   if (kind === 'deb') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`;
     return {
-      command: `curl -LO ${url} && sudo apt install ./LotusChat-x86_64.deb`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.deb', 'sudo apt install'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`,
       download: 'Download package',
     };
   }