fix(desktop): the Linux update command verifies the signed SHA256SUMS before installing (cinny-desktop #36) #422

2026-10-19T00:37:38-04:00

jared commented

2026-10-19 00:37:38 -04:00

Client half of cinny-desktop#36 (release half: cinny-desktop#41).

Hold until a desktop release has published SHA256SUMS.txt; until then this command would fail at the download step.

The pacman/apt update command shown in-app installed the package with no integrity check. It now runs:

cd "$(mktemp -d)" && curl -fLO …/<package> -fLO …/SHA256SUMS.txt -fLO …/SHA256SUMS.txt.minisig \
  && minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/… && sha256sum -c --ignore-missing SHA256SUMS.txt \
  && sudo pacman -U ./<package>     # or sudo apt install ./<package>

That's a fresh temp dir (no stale checksum file), the signature with the updater key, then the hash, then install.

Verified: the real generated command, run against a local mirror signed with a throwaway key: good files → installs; tampered SHA256SUMS.txt → "Signature verification failed", nothing installed. Unit tests check the step order.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Client half of cinny-desktop#36 (release half: cinny-desktop#41). **Hold until a desktop release has published `SHA256SUMS.txt`**; until then this command would fail at the download step. The pacman/apt update command shown in-app installed the package with no integrity check. It now runs: ``` cd "$(mktemp -d)" && curl -fLO …/<package> -fLO …/SHA256SUMS.txt -fLO …/SHA256SUMS.txt.minisig \ && minisign -Vm SHA256SUMS.txt -P RWRZZdyii05/… && sha256sum -c --ignore-missing SHA256SUMS.txt \ && sudo pacman -U ./<package> # or sudo apt install ./<package> ``` That's a fresh temp dir (no stale checksum file), the signature with the updater key, then the hash, then install. **Verified:** the real generated command, run against a local mirror signed with a throwaway key: good files → installs; tampered `SHA256SUMS.txt` → "Signature verification failed", nothing installed. Unit tests check the step order. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-19 00:37:38 -04:00

fix(desktop): the Linux update command verifies the signed SHA256SUMS before installing (cinny-desktop #36 )

CI / Build & Quality Checks (pull_request) Successful in 1m54s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Failing after 13s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 12m47s

Details

674aef94fb

The pacman / apt update command installed the downloaded package with
no integrity check. Download it with the release's SHA256SUMS.txt and
.minisig into a fresh temp dir, verify the signature with the updater
key (minisign), check the hash, then install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-19 04:24:55 -04:00

ci(gitleaks): allowlist the desktop updater minisign public key

CI / Build & Quality Checks (pull_request) Successful in 2m9s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Successful in 7s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 12m38s

Details

ec47d542dd

utils/updateErrors.ts embeds the public key that verifies Linux
downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched
it. It is a published public key, not a secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared merged commit 8459427c1e into lotus

2026-10-19 04:40:02 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#422