feat(install): verify release-asset minisign signatures#83
Merged
Conversation
Download the .sig companion published for each Tauri-updater asset and verify it with minisign (or rsign from rsign2) when available on PATH, using the public key embedded from src-tauri/tauri.conf.json. A missing verifier only warns and proceeds; a present verifier makes verification mandatory and fails closed on a missing, undecodable, or bad signature.
Older macOS base64 only accepts -D (not -d) for decoding, so a Mac with minisign installed but an old base64 would fail-closed and abort a good install. Try -d first, then -D, before handing the decoded signature to the verifier.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #76: the curl installer now verifies release-asset minisign signatures.
Design: verify-if-available — when
minisign(orrsign) is on PATH, verification is mandatory and fail-closed (bad, missing, or undecodable signature aborts before any tar parsing or install step); with no verifier present the installer prints a loud warning explaining what was skipped and how to install minisign, then proceeds. The Tauri updater public key (key id C9FDD29AA6D3DEA1) is embedded as a constant sourced from tauri.conf.json — never fetched from the network. The.sigcompanion downloads through the same allowlisted-host, HTTPS-pinned path as the asset. Verified empirically against the live v0.2.1 release on both asset types, including a tamper case, plus a portable base64 decode helper (-dwith-Dfallback) for older macOS.Smoke suite extended to 13 scenarios (good/bad/missing signature, no verifier, -D-only base64). Serious-class review panel: security lane clean (bypass, fail-closed completeness, TOCTOU, pubkey match all checked), shell-portability finding fixed and VERIFIED FIXED by targeted re-review.
Known limits (documented): rsign2 branch follows its documented CLI but was not empirically exercised (fails closed if wrong); a hostile earlier-PATH verifier shim is outside the script's trust model, same as its existing reliance on genuine curl/tar.
Closes #76.
🤖 Generated with Claude Code