-
Release 0.8.1 Stable
admslader released this
2026-10-22 18:59:12 -04:00 | 11 commits to main since this releasev0.8.1 — Update verification hardening
This patch makes release builds verify their own updates, locks down the
signing key, and hardens the release tooling.🔐 Security
- 🛡️ Signed updates in release builds — the AppImage build now embeds the
release-signing public key, so the updater verifies every downloaded artifact.
A build without the key fails instead of shipping unverified updates. - 🛑 Fail closed on updates — a release build with no embedded key refuses
to apply an update rather than trusting it. - 🔑 Signing-key permissions —
keygenwrites the private key with0600
permissions and warns if an existing key is group/world-readable. - 🙈 Site secrets redacted —
SiteInput.toStringno longer renders the
site secret or service-role key. - 📦 Container build pins — the Debian base image is digest-pinned and the
Flutter tarball is verified against its published SHA-256. - 🕵️ Token out of
ps— the Forgejo token is passed tocurlvia a
short-lived0600config file instead of a command-line header. - 🔗 Stricter update URLs — asset URLs with embedded credentials or a
non-Forgejo port are refused; Forgejo uploads don't follow redirects; a
non-HTTPS Forgejo base URL is rejected. - 🧭 AppImage path check — the updater only replaces a real
.AppImage
file whenAPPIMAGEis set.
🐛 Fixes
- 🧹 Doc comment — the update-service repo example now reads
orbita.
🧱 Under the hood
- Added regression tests for the update-URL port/credentials checks, the
non-HTTPS Forgejo base URL, and the upload redirect refusal. dart analyzeclean, all tests green.
📦 Assets
Attach the matching asset (and its
.sig) to install automatically:
Linuxorbita-0.8.1-linux.AppImage.Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- 🛡️ Signed updates in release builds — the AppImage build now embeds the