mirror of
https://github.com/Felitendo/spotifast.git
synced 2026-11-01 17:33:26 +01:00
Carmine Paolino
88a9c017e6
The publish job now runs in the release-signing environment (v* tags, maintainer approval) and signs the checksums.txt that release-names.py writes with Spotifast's Ed25519 key, then verifies the signature and every listed file against the committed public key. The private key lives only in that environment's secret, with a backup in 1Password. The updater starts requiring the signature in a later release, once signed releases exist.
2 lines
65 B
Plaintext
2 lines
65 B
Plaintext
e44c87b1550484c687947bd927ae333ff431cc7adc6cc33533c628f82016b554
|