ci(gitleaks): allowlist the desktop updater minisign public key

utils/updateErrors.ts embeds the public key that verifies Linux
downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched
it. It is a published public key, not a secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitleaks.toml

@@ -12,6 +12,9 @@ regexes = [
   '''https?://matrix\.lotusguild\.org''',
   '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
   '''matrix\.lotusguild\.org''',
+  # Lotus Chat desktop updater's minisign PUBLIC key (published in the
+  # cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it.
+  '''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''',
 ]
 paths = [
   '''config\.json''',

src/app/components/presence/Presence.tsx

@@ -13,13 +13,11 @@ import {
 import React, { ReactNode } from 'react';
 import * as css from './styles.css';
 import { Presence, usePresenceLabel } from '../../hooks/useUserPresence';
-import { isDndPresence } from '../../utils/busyPresence';
 
 const PresenceToColor: Record<Presence, MainColor> = {
   [Presence.Online]: 'Success',
   [Presence.Unavailable]: 'Warning',
   [Presence.Offline]: 'Secondary',
-  [Presence.Busy]: 'Critical',
 };
 
 type PresenceBadgeProps = {
@@ -33,11 +31,9 @@ export function PresenceBadge({ presence, status, size }: PresenceBadgeProps) {
   // Disturb" to match PresenceRingAvatar and the settings picker (which both
   // special-case 'dnd' → Critical) — the badge was the lone outlier showing a
   // yellow "Idle". The 'dnd' sentinel isn't surfaced as a status line.
-  // [Gitea #283] or MSC3026 busy, which keeps a real status line.
-  const isDnd = isDndPresence(presence, status);
-  const legacyDnd = isDnd && status === 'dnd';
+  const isDnd = presence === Presence.Unavailable && status === 'dnd';
   const displayLabel = isDnd ? 'Do Not Disturb' : label[presence];
-  const displayStatus = legacyDnd ? undefined : status;
+  const displayStatus = isDnd ? undefined : status;
   const ariaLabel = displayStatus ? `${displayLabel} — ${displayStatus}` : displayLabel;
 
   return (

src/app/components/presence/PresenceRingAvatar.tsx

@@ -4,7 +4,6 @@ import { Presence, useUserPresence } from '../../hooks/useUserPresence';
 
 function presenceRingColor(presence: Presence | undefined, status?: string): string | null {
   if (!presence || presence === Presence.Offline) return null;
-  if (presence === Presence.Busy) return color.Critical.Main; // [Gitea #283] DND
   if (presence === Presence.Unavailable) {
     return status === 'dnd' ? color.Critical.Main : color.Warning.Main;
   }

src/app/features/settings/account/Profile.tsx

@@ -38,11 +38,7 @@ import { SettingTile } from '../../../components/setting-tile';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
 import { getAccountData, setAccountData } from '../../../utils/accountData';
 import { presenceStateFromSetting } from '../../../hooks/usePresenceUpdater';
-import {
-  describePresenceError,
-  setPresenceWithRetry,
-  writePresence,
-} from '../../../utils/presenceWrite';
+import { describePresenceError, setPresenceWithRetry } from '../../../utils/presenceWrite';
 import { useSetting } from '../../../state/hooks/settings';
 import { settingsAtom } from '../../../state/settings';
 import { UserProfile, useUserProfile } from '../../../hooks/useUserProfile';
@@ -558,7 +554,7 @@ function ProfileStatus() {
     localStorage.removeItem(STATUS_MSG_KEY(userId));
     localStorage.removeItem(STATUS_EXPIRY_KEY(userId));
     // Preserve the user's chosen presence when clearing the status message.
-    writePresence(mx, {
+    mx.setPresence({
       presence: presenceStateFromSetting(presenceStatus, hidePresence),
       status_msg: '',
     }).catch(() => undefined);

src/app/hooks/usePresenceUpdater.ts

@@ -1,27 +1,20 @@
 import { useEffect, useRef } from 'react';
 import { SetPresence } from 'matrix-js-sdk';
-import { PresenceDeduper, PresenceWrite, writePresence } from '../utils/presenceWrite';
+import { PresenceDeduper, PresenceWrite } from '../utils/presenceWrite';
 import { useMatrixClient } from './useMatrixClient';
 import { getLastLocalStatusWrite, pickHeartbeatStatus } from '../utils/ownStatusSync';
 import { useSetting } from '../state/hooks/settings';
 import { settingsAtom } from '../state/settings';
-import {
-  BUSY_PRESENCE,
-  BUSY_PRESENCE_FEATURE,
-  isBusyPresenceSupported,
-  setBusyPresenceSupported,
-} from '../utils/busyPresence';
 
 const IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const ACTIVITY_THROTTLE_MS = 1000;
 
 export type PresenceSetting = 'auto' | 'online' | 'idle' | 'dnd' | 'invisible';
-export type PresenceState = 'online' | 'unavailable' | 'offline' | typeof BUSY_PRESENCE;
+export type PresenceState = 'online' | 'unavailable' | 'offline';
 
 /**
  * Single source of truth for mapping the user's presence preference to the
- * Matrix presence value: auto/online → 'online', idle → 'unavailable', dnd →
- * MSC3026 busy (or 'unavailable' where the server lacks it),
+ * Matrix presence value: auto/online → 'online', idle/dnd → 'unavailable',
  * invisible (or the hidePresence override) → 'offline'. Shared with the Profile
  * status writer so setting/clearing a status message never overrides the user's
  * chosen presence (e.g. outing an Invisible user as online).
@@ -31,10 +24,7 @@ export function presenceStateFromSetting(
   hidePresence: boolean,
 ): PresenceState {
   if (hidePresence || presenceStatus === 'invisible') return 'offline';
-  // [Gitea #283] DND is MSC3026 busy where the server supports it, so status
-  // writes (save / clear / auto-clear) don't downgrade it to "unavailable".
-  if (presenceStatus === 'dnd') return isBusyPresenceSupported() ? BUSY_PRESENCE : 'unavailable';
-  if (presenceStatus === 'idle') return 'unavailable';
+  if (presenceStatus === 'idle' || presenceStatus === 'dnd') return 'unavailable';
   return 'online';
 }
 
@@ -72,7 +62,8 @@ export function usePresenceUpdater() {
     // by a heartbeat that changed nothing.
     const send = (write: PresenceWrite, label: string) => {
       if (!deduper.shouldSend(write)) return Promise.resolve();
-      return writePresence(mx, write)
+      return mx
+        .setPresence(write)
         .then(() => deduper.sent(write))
         .catch((err) => warnPresenceFailure(label, err));
     };
@@ -143,22 +134,7 @@ export function usePresenceUpdater() {
       return undefined;
     }
     if (presenceStatus === 'dnd') {
-      // [Gitea #283] Real "busy" presence where supported: the status text
-      // stays yours. /sync reporting "online" doesn't override busy on
-      // Synapse, so the sync loop can stay online. Older servers keep the
-      // legacy unavailable + "dnd" text encoding.
-      mx.doesServerSupportUnstableFeature(BUSY_PRESENCE_FEATURE)
-        .catch(() => false)
-        .then(async (busy) => {
-          setBusyPresenceSupported(busy);
-          if (!busy) {
-            setUnavailable('dnd');
-            return;
-          }
-          syncPresence(SetPresence.Online);
-          const status = await resolveStatus();
-          send({ presence: BUSY_PRESENCE, ...(status ? { status_msg: status } : {}) }, 'busy');
-        });
+      setUnavailable('dnd');
       return undefined;
     }
 

src/app/hooks/useUserPresence.ts

@@ -6,8 +6,6 @@ export enum Presence {
   Online = 'online',
   Unavailable = 'unavailable',
   Offline = 'offline',
-  // [Gitea #283] MSC3026 busy: Lotus's Do Not Disturb.
-  Busy = 'org.matrix.msc3026.busy',
 }
 
 export type UserPresence = {
@@ -131,7 +129,6 @@ export const usePresenceLabel = (): Record<Presence, string> =>
       [Presence.Online]: 'Online',
       [Presence.Unavailable]: 'Idle',
       [Presence.Offline]: 'Offline',
-      [Presence.Busy]: 'Do Not Disturb',
     }),
     [],
   );

src/app/utils/busyPresence.test.ts

@@ -1,11 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { BUSY_PRESENCE, isDndPresence } from './busyPresence';
-
-test('isDndPresence: busy, or the legacy unavailable + "dnd" text (#283)', () => {
-  assert.equal(isDndPresence(BUSY_PRESENCE, '🎮 Gaming'), true);
-  assert.equal(isDndPresence(BUSY_PRESENCE, undefined), true);
-  assert.equal(isDndPresence('unavailable', 'dnd'), true);
-  assert.equal(isDndPresence('unavailable', 'lunch'), false);
-  assert.equal(isDndPresence('online', 'dnd'), false);
-});

src/app/utils/busyPresence.ts

@@ -1,21 +0,0 @@
-/**
- * [Gitea #283] Do Not Disturb as a real presence state: MSC3026 "busy"
- * (Synapse `experimental_features.msc3026_enabled`). Before, DND was sent as
- * presence `unavailable` with the literal status text "dnd", which replaced
- * your status and showed as "dnd" in other clients.
- */
-export const BUSY_PRESENCE = 'org.matrix.msc3026.busy';
-export const BUSY_PRESENCE_FEATURE = 'org.matrix.msc3026.busy_presence';
-
-let busySupported = false;
-
-/** Recorded by the presence updater from the server's unstable_features. */
-export const setBusyPresenceSupported = (supported: boolean): void => {
-  busySupported = supported;
-};
-
-export const isBusyPresenceSupported = (): boolean => busySupported;
-
-/** Pure: whether a presence means Do Not Disturb (busy, or the legacy "dnd" text). */
-export const isDndPresence = (presence: string | undefined, status: string | undefined): boolean =>
-  presence === BUSY_PRESENCE || (presence === 'unavailable' && status === 'dnd');

src/app/utils/presenceWrite.ts

@@ -1,5 +1,4 @@
-import { MatrixClient, MatrixError, IPresenceOpts, Method } from 'matrix-js-sdk';
-import { BUSY_PRESENCE } from './busyPresence';
+import { MatrixClient, MatrixError } from 'matrix-js-sdk';
 
 /**
  * Synapse rate-limits `PUT /presence/{user}/status` to ONE request per 10 s per
@@ -11,29 +10,7 @@ import { BUSY_PRESENCE } from './busyPresence';
  * and `PresenceDeduper` lets the heartbeat skip writes that would not change
  * anything, so it stops spending the budget in the first place.
  */
-export type PresenceWrite = {
-  // [Gitea #283] or MSC3026 busy (Do Not Disturb)
-  presence: 'online' | 'offline' | 'unavailable' | typeof BUSY_PRESENCE;
-  status_msg?: string;
-};
-
-/**
- * `mx.setPresence` for a PresenceWrite. The SDK refuses anything but the three
- * spec presences ("Bad presence value"), so MSC3026 busy (#283) goes straight
- * to the same endpoint.
- */
-export const writePresence = async (
-  mx: Pick<MatrixClient, 'setPresence'> & Partial<Pick<MatrixClient, 'getSafeUserId' | 'http'>>,
-  write: PresenceWrite,
-): Promise<void> => {
-  if (write.presence !== BUSY_PRESENCE) {
-    await mx.setPresence(write as IPresenceOpts);
-    return;
-  }
-  if (!mx.getSafeUserId || !mx.http) throw new Error('busy presence needs a full MatrixClient');
-  const path = `/presence/${encodeURIComponent(mx.getSafeUserId())}/status`;
-  await mx.http.authedRequest(Method.Put, path, undefined, write);
-};
+export type PresenceWrite = { presence: 'online' | 'offline' | 'unavailable'; status_msg?: string };
 
 const sleep = (ms: number) =>
   new Promise<void>((r) => {
@@ -51,7 +28,7 @@ export async function setPresenceWithRetry(
   for (;;) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      await writePresence(mx, write);
+      await mx.setPresence(write);
       return;
     } catch (e) {
       if (!(e instanceof MatrixError) || e.httpStatus !== 429) throw e;

src/app/utils/updateErrors.test.ts

@@ -69,13 +69,23 @@ test('install kinds: anything unknown keeps the in-app updater', async () => {
 test('package installs get their package manager’s command, not an Install button', async () => {
   const { packageUpdateHelp, isPackageManagedError } = await import('./updateErrors');
   const pacman = packageUpdateHelp('pacman')!;
-  // Not `pacman -U <url>`: that also wants `<url>.sig`, which we don't publish.
-  assert.equal(
-    pacman.command,
-    'curl -LO https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.pkg.tar.zst && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst',
+  // [cinny-desktop #36] signature, then checksum, then install, in that order;
+  // a local `pacman -U ./file` (not `<url>`, which also wants `<url>.sig`).
+  const steps = pacman.command!.split(' && ');
+  assert.equal(steps[0], 'cd "$(mktemp -d)"');
+  assert.match(
+    steps[1],
+    /-fLO \S+\/LotusChat-x86_64\.pkg\.tar\.zst -fLO \S+\/SHA256SUMS\.txt -fLO \S+\/SHA256SUMS\.txt\.minisig$/,
   );
+  assert.equal(
+    steps[2],
+    'minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l',
+  );
+  assert.equal(steps[3], 'sha256sum -c --ignore-missing SHA256SUMS.txt');
+  assert.equal(steps[4], 'sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst');
   assert.match(pacman.url, /LotusChat-x86_64\.pkg\.tar\.zst$/);
   const deb = packageUpdateHelp('deb')!;
+  assert.match(deb.command!, /minisign -Vm SHA256SUMS\.txt/);
   assert.match(deb.command!, /sudo apt install \.\/LotusChat-x86_64\.deb$/);
   assert.equal(packageUpdateHelp('manual')?.command, undefined);
   assert.equal(packageUpdateHelp('in-app'), undefined);

src/app/utils/updateErrors.ts

@@ -64,23 +64,38 @@ export const toInstallKind = (value: unknown): InstallKind =>
 
 export type PackageUpdateHelp = { command?: string; url: string; download: string };
 
+/** The desktop updater's minisign public key (cinny-desktop tauri.conf.json). */
+export const RELEASE_MINISIGN_KEY = 'RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l';
+
+/**
+ * [cinny-desktop #36] Download a Linux package and install it only after
+ * checking the release's minisign-signed SHA256SUMS.txt. Runs in a fresh temp
+ * directory so a stale SHA256SUMS.txt can't be picked up.
+ */
+const verifiedInstall = (file: string, install: string): string =>
+  [
+    `cd "$(mktemp -d)"`,
+    `curl -fLO ${RELEASE_DOWNLOAD}/${file} -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt.minisig`,
+    `minisign -Vm SHA256SUMS.txt -P ${RELEASE_MINISIGN_KEY}`,
+    `sha256sum -c --ignore-missing SHA256SUMS.txt`,
+    `${install} ./${file}`,
+  ].join(' && ');
+
 export const packageUpdateHelp = (kind: InstallKind): PackageUpdateHelp | undefined => {
   if (kind === 'pacman') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`;
-    // Download first, then install the local file: `pacman -U <url>` also
-    // fetches `<url>.sig` and fails without it (we don't sign packages),
-    // while a local file falls under LocalFileSigLevel (signature optional).
+    // Install the local file: `pacman -U <url>` also fetches `<url>.sig` and
+    // fails without it (packages aren't signed for pacman), while a local file
+    // falls under LocalFileSigLevel. Integrity comes from SHA256SUMS.txt.
     return {
-      command: `curl -LO ${url} && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.pkg.tar.zst', 'sudo pacman -U'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`,
       download: 'Download package',
     };
   }
   if (kind === 'deb') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`;
     return {
-      command: `curl -LO ${url} && sudo apt install ./LotusChat-x86_64.deb`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.deb', 'sudo apt install'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`,
       download: 'Download package',
     };
   }