ci(gitleaks): allowlist the desktop updater minisign public key

utils/updateErrors.ts embeds the public key that verifies Linux
downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched
it. It is a published public key, not a secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitleaks.toml

@@ -12,6 +12,9 @@ regexes = [
   '''https?://matrix\.lotusguild\.org''',
   '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
   '''matrix\.lotusguild\.org''',
+  # Lotus Chat desktop updater's minisign PUBLIC key (published in the
+  # cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it.
+  '''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''',
 ]
 paths = [
   '''config\.json''',

src/app/components/CallEmbedProvider.tsx

@@ -90,9 +90,6 @@ import { useDenoiseNotices } from '../hooks/useDenoiseNotices';
 
 const PIP_MIN_W = 200;
 const PIP_MIN_H = 112;
-/** [Gitea #323] Minimised PiP bar size. */
-const PIP_MINI_W = 220;
-const PIP_MINI_H = 40;
 /** Default PiP top: just below the 64px-ish room header. */
 const PIP_DEFAULT_TOP = 72;
 
@@ -1006,28 +1003,6 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
   );
 
   const [pipIsFullscreen, setPipIsFullscreen] = useState(false);
-  // [Gitea #323] Minimised PiP: a small draggable bar (room name + expand)
-  // instead of the video. Remembered; phones start minimised.
-  const [pipMinimized, setPipMinimized] = useState<boolean>(() => {
-    try {
-      const v = localStorage.getItem('pip-minimized');
-      if (v !== null) return v === '1';
-    } catch {
-      /* storage unavailable */
-    }
-    return window.innerWidth < 600;
-  });
-  const pipFullSizeRef = React.useRef({ width: 280, height: 158 });
-  const togglePipMinimized = useCallback(() => {
-    setPipMinimized((m) => {
-      try {
-        localStorage.setItem('pip-minimized', m ? '0' : '1');
-      } catch {
-        /* storage unavailable */
-      }
-      return !m;
-    });
-  }, []);
   useEffect(() => {
     const onFsChange = () => setPipIsFullscreen(!!document.fullscreenElement);
     document.addEventListener('fullscreenchange', onFsChange);
@@ -1128,26 +1103,6 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
     }
   }, [pipMode, callVisible]);
 
-  // [Gitea #323] Apply the minimised / full PiP size (after the entry effect
-  // below has positioned and sized it). Keeps the bar on screen.
-  React.useEffect(() => {
-    const el = callEmbedRef.current;
-    if (!el || !pipMode) return;
-    if (pipMinimized) {
-      if (el.offsetHeight > PIP_MINI_H) {
-        pipFullSizeRef.current = { width: el.offsetWidth, height: el.offsetHeight };
-      }
-      el.style.width = `${PIP_MINI_W}px`;
-      el.style.height = `${PIP_MINI_H}px`;
-    } else {
-      el.style.width = `${pipFullSizeRef.current.width}px`;
-      el.style.height = `${pipFullSizeRef.current.height}px`;
-    }
-    const rect = el.getBoundingClientRect();
-    el.style.left = `${Math.max(0, Math.min(rect.left, window.innerWidth - el.offsetWidth))}px`;
-    el.style.top = `${Math.max(0, Math.min(rect.top, window.innerHeight - el.offsetHeight))}px`;
-  }, [pipMode, pipMinimized, callEmbedRef]);
-
   React.useEffect(() => {
     if (!pipMode) return;
     const onPipWindowResize = (): void => {
@@ -1466,50 +1421,19 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
                 position: 'absolute',
                 inset: 0,
                 zIndex: 1,
-                // Minimised: cover the frame so only the bar shows.
-                background: pipMinimized ? color.Surface.Container : 'transparent',
+                background: 'transparent',
                 cursor: 'grab',
                 // [Gitea #43] The call's "Share your screen?" prompt is drawn
                 // inside the frame: let the click reach its Share button.
                 pointerEvents: pipPromptOpen ? 'none' : undefined,
                 display: 'flex',
+                alignItems: 'flex-start',
                 justifyContent: 'flex-end',
-                alignItems: pipMinimized ? 'center' : 'flex-start',
                 padding: '6px',
               }}
             >
-              <div
-                style={{
-                  display: 'flex',
-                  gap: config.space.S100,
-                  alignItems: 'center',
-                  ...(pipMinimized ? { width: '100%' } : {}),
-                }}
-              >
-                {/* Leftmost: the top-right corner is a resize handle. */}
-                <IconButton
-                  type="button"
-                  size="300"
-                  radii="300"
-                  variant="Surface"
-                  fill="None"
-                  aria-label={pipMinimized ? 'Expand call' : 'Minimise call'}
-                  aria-pressed={pipMinimized}
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    togglePipMinimized();
-                  }}
-                  onMouseDown={(e) => e.stopPropagation()}
-                  onTouchStart={(e) => e.stopPropagation()}
-                  style={{
-                    background: 'rgba(0,0,0,0.65)',
-                    backdropFilter: 'blur(4px)',
-                    color: '#fff',
-                  }}
-                >
-                  <Icon size="100" src={pipMinimized ? Icons.ChevronTop : Icons.Minus} />
-                </IconButton>
-                {!pipMinimized && document.fullscreenEnabled && (
+              <div style={{ display: 'flex', gap: config.space.S100, alignItems: 'center' }}>
+                {document.fullscreenEnabled && (
                   <IconButton
                     type="button"
                     size="300"
@@ -1541,23 +1465,14 @@ export function CallEmbedProvider({ children }: CallEmbedProviderProps) {
                     fontSize: '11px',
                     fontWeight: 600,
                     pointerEvents: 'none',
-                    ...(pipMinimized
-                      ? {
-                          flexGrow: 1,
-                          minWidth: 0,
-                          overflow: 'hidden',
-                          textOverflow: 'ellipsis',
-                          whiteSpace: 'nowrap',
-                        }
-                      : {}),
                   }}
                 >
-                  {pipMinimized ? `↗ ${callEmbed.room.name ?? 'Call'}` : '↗ Return to call'}
+                  ↗ Return to call
                 </div>
               </div>
             </div>
-            {!pipMinimized && <PipMuteOverlay callEmbed={callEmbed} />}
-            {(pipMinimized ? [] : (['se', 'sw', 'ne', 'nw'] as Corner[])).map((corner) => {
+            <PipMuteOverlay callEmbed={callEmbed} />
+            {(['se', 'sw', 'ne', 'nw'] as Corner[]).map((corner) => {
               const s = corner.includes('s');
               const e2 = corner.includes('e');
               const dots = [

src/app/utils/updateErrors.test.ts

@@ -69,13 +69,23 @@ test('install kinds: anything unknown keeps the in-app updater', async () => {
 test('package installs get their package manager’s command, not an Install button', async () => {
   const { packageUpdateHelp, isPackageManagedError } = await import('./updateErrors');
   const pacman = packageUpdateHelp('pacman')!;
-  // Not `pacman -U <url>`: that also wants `<url>.sig`, which we don't publish.
-  assert.equal(
-    pacman.command,
-    'curl -LO https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.pkg.tar.zst && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst',
+  // [cinny-desktop #36] signature, then checksum, then install, in that order;
+  // a local `pacman -U ./file` (not `<url>`, which also wants `<url>.sig`).
+  const steps = pacman.command!.split(' && ');
+  assert.equal(steps[0], 'cd "$(mktemp -d)"');
+  assert.match(
+    steps[1],
+    /-fLO \S+\/LotusChat-x86_64\.pkg\.tar\.zst -fLO \S+\/SHA256SUMS\.txt -fLO \S+\/SHA256SUMS\.txt\.minisig$/,
   );
+  assert.equal(
+    steps[2],
+    'minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l',
+  );
+  assert.equal(steps[3], 'sha256sum -c --ignore-missing SHA256SUMS.txt');
+  assert.equal(steps[4], 'sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst');
   assert.match(pacman.url, /LotusChat-x86_64\.pkg\.tar\.zst$/);
   const deb = packageUpdateHelp('deb')!;
+  assert.match(deb.command!, /minisign -Vm SHA256SUMS\.txt/);
   assert.match(deb.command!, /sudo apt install \.\/LotusChat-x86_64\.deb$/);
   assert.equal(packageUpdateHelp('manual')?.command, undefined);
   assert.equal(packageUpdateHelp('in-app'), undefined);

src/app/utils/updateErrors.ts

@@ -64,23 +64,38 @@ export const toInstallKind = (value: unknown): InstallKind =>
 
 export type PackageUpdateHelp = { command?: string; url: string; download: string };
 
+/** The desktop updater's minisign public key (cinny-desktop tauri.conf.json). */
+export const RELEASE_MINISIGN_KEY = 'RWRZZdyii05/NUcz337A5SAbiZK+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l';
+
+/**
+ * [cinny-desktop #36] Download a Linux package and install it only after
+ * checking the release's minisign-signed SHA256SUMS.txt. Runs in a fresh temp
+ * directory so a stale SHA256SUMS.txt can't be picked up.
+ */
+const verifiedInstall = (file: string, install: string): string =>
+  [
+    `cd "$(mktemp -d)"`,
+    `curl -fLO ${RELEASE_DOWNLOAD}/${file} -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt -fLO ${RELEASE_DOWNLOAD}/SHA256SUMS.txt.minisig`,
+    `minisign -Vm SHA256SUMS.txt -P ${RELEASE_MINISIGN_KEY}`,
+    `sha256sum -c --ignore-missing SHA256SUMS.txt`,
+    `${install} ./${file}`,
+  ].join(' && ');
+
 export const packageUpdateHelp = (kind: InstallKind): PackageUpdateHelp | undefined => {
   if (kind === 'pacman') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`;
-    // Download first, then install the local file: `pacman -U <url>` also
-    // fetches `<url>.sig` and fails without it (we don't sign packages),
-    // while a local file falls under LocalFileSigLevel (signature optional).
+    // Install the local file: `pacman -U <url>` also fetches `<url>.sig` and
+    // fails without it (packages aren't signed for pacman), while a local file
+    // falls under LocalFileSigLevel. Integrity comes from SHA256SUMS.txt.
     return {
-      command: `curl -LO ${url} && sudo pacman -U ./LotusChat-x86_64.pkg.tar.zst`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.pkg.tar.zst', 'sudo pacman -U'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.pkg.tar.zst`,
       download: 'Download package',
     };
   }
   if (kind === 'deb') {
-    const url = `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`;
     return {
-      command: `curl -LO ${url} && sudo apt install ./LotusChat-x86_64.deb`,
-      url,
+      command: verifiedInstall('LotusChat-x86_64.deb', 'sudo apt install'),
+      url: `${RELEASE_DOWNLOAD}/LotusChat-x86_64.deb`,
       download: 'Download package',
     };
   }