LotusGuild/cinny

fix(desktop): the Linux update command verifies the signed SHA256SUMS before installing (cinny-desktop #36) #422

Merged

jared merged 2 commits from fix/linux-update-verify into lotus

2026-10-19 04:40:02 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	ec47d542dd	ci(gitleaks): allowlist the desktop updater minisign public key CI / Build & Quality Checks (pull_request) Successful in 2m9s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 7s Details CI / Playwright smoke (e2e) (pull_request) Successful in 12m38s Details utils/updateErrors.ts embeds the public key that verifies Linux downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched it. It is a published public key, not a secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 04:24:51 -04:00
Lotus CIandClaude Opus 5.5	674aef94fb	fix(desktop): the Linux update command verifies the signed SHA256SUMS before installing (cinny-desktop #36 ) CI / Build & Quality Checks (pull_request) Successful in 1m54s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Failing after 13s Details CI / Playwright smoke (e2e) (pull_request) Successful in 12m47s Details The pacman / apt update command installed the downloaded package with no integrity check. Download it with the release's SHA256SUMS.txt and .minisig into a fresh temp dir, verify the signature with the updater key (minisign), check the hash, then install. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 00:37:34 -04:00