Carmine Paolino 88a9c017e6 Sign release checksums behind the maintainer's approval ...

The publish job now runs in the release-signing environment (v* tags,
maintainer approval) and signs the checksums.txt that release-names.py
writes with Spotifast's Ed25519 key, then verifies the signature and every
listed file against the committed public key. The private key lives only
in that environment's secret, with a backup in 1Password. The updater
starts requiring the signature in a later release, once signed releases
exist.

2026-09-25 17:19:27 +02:00

..

ci.yml

Give the test job room to save a cold mbx cache on Windows

2026-09-25 16:33:20 +02:00

docs.yml

Rename the app to Spotifast while preserving installation identities

2026-09-14 10:43:11 +02:00

flatpak-from-release.yml

Complete Spotifast rename with upgrade-safe profile migration

2026-09-22 13:13:32 +02:00

issue-assessment.yml

Follow tested Copilot Triage releases automatically

2026-09-16 23:51:40 +02:00

packaging.yml

Move packaging to the native-packages fix for deploy-key pushes

2026-09-24 18:46:37 +02:00

release.yml

Sign release checksums behind the maintainer's approval

2026-09-25 17:19:27 +02:00

triage-open-backlog.yml

Add detached open-report triage backlog

2026-09-17 01:25:03 +02:00