CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

release: the Linux / Windows updater signatures are made on the VDS (desktop-release add-remote, vds-key; tools/vds-sign.ts); the Mac no longer downloads those installers, verifies each returned .sig over its BLAKE2b-512 digest before publishing; release.ts --sign-local keeps the old path

Browse source
This commit is contained in:
CRTkafa 2026-10-21 03:14:53 +07:00
parent d94bf67340
commit ef3c66e8f0
6 changed files with 444 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGELOG.md
View file

@ -2,6 +2,12 @@
## Unreleased
- **Tooling: the desktop updater signatures of the Linux and Windows installers are made on the VDS.** The release
no longer downloads them to the Mac: the VDS fetches them from the Forgejo release, checks their SHA-256 against the
candidate, signs them with its copy of the updater key and sends back only the .sig texts, which the Mac verifies
against the app's public key before publishing. `desktop-release.ts vds-key` installs or rotates that key;
`release.ts --sign-local` keeps the old path.
## 0.8.19 · 2026-10-20
- **`shots capture` / `render` find Playwright's chromium in a project's CommonJS playwright** whether it comes on the