Sign the installer download with minisign#12
Merged
Conversation
Now that the repo is public, install.sh is a real distribution path, and it previously trusted the release download on TLS alone. It now verifies a minisign signature over the release checksums before unpacking the app, clearing its quarantine, or copying it into /Applications: - release.yml signs SHA256SUMS.txt with a key held only in the MINISIGN_SECRET_KEY CI secret and attaches the .minisig to the Release. The step fails closed if the secret is unset. - install.sh carries the matching public key, fetches the checksums + sig, verifies the signature (minisign -V), then confirms the downloaded asset's SHA-256 matches. Any failure aborts before install. minisign is required; a clear message points to `brew install minisign`. - The public key is a placeholder until signing is set up; install.sh refuses to run rather than silently skip verification. - Quarantine is now stripped only after cryptographic verification, so that step is justified rather than a blind trust. The exact sign/verify commands were smoke-tested locally with minisign 0.12: a valid signature verifies, a tampered checksums file is rejected (exit 1). One-time setup for the maintainer is documented at the top of install.sh (generate a passwordless keypair, add the secret, paste the public key). Assisted-by: Claude:claude-fable-5
Replaces the placeholder with the public half of the release signing key. The private half lives only in the MINISIGN_SECRET_KEY CI secret. Assisted-by: Claude:claude-fable-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Now that the repo is public,
install.shis a real distribution path forarbitrary users, and it previously trusted the release download on TLS alone
(then stripped the Gatekeeper quarantine). This adds end-to-end signature
verification.
What changes
SHA256SUMS.txtwith minisign using a key held only inthe
MINISIGN_SECRET_KEYCI secret, and attachesSHA256SUMS.txt+SHA256SUMS.txt.minisigto the Release. Fails closed if the secret is unset.signature, verifies the signature (
minisign -V), then confirms thedownloaded asset's SHA-256 matches — all before unpacking, clearing
quarantine, or copying into
/Applications. Any failure aborts. Requiresminisign(clear message →brew install minisign).installer refuses to run rather than silently skip verification.
minisignrequirement and the trust model.The exact sign/verify command pair was smoke-tested locally with minisign 0.12:
a valid signature verifies, a tampered
SHA256SUMS.txtis rejected (exit 1),and
shasum -c --ignore-missinghandles verifying just the one downloaded app.Merging this to
mainbefore a signed release exists will break the installone-liner for everyone (it will refuse the current unsigned
latestrelease).Sequence:
minisign.pub(theRW…string) intoMINISIGN_PUBKEYininstall.shon this branch, replacing the placeholder.Commit. Keep
minisign.keyout of git.SHA256SUMS.txtis published tolatest.Assisted-by: Claude:claude-fable-5