mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Fable 5
25a2eae52f
Three latent bugs in the never-exercised publish path: - `tauri signer sign -k` loads the key from a *string*; we passed the mktemp path, so the CLI base64-decoded "/tmp/tmp.XXXX" and died with "Invalid symbol 46, offset 8" (the dot). Use `-f` (key from file). The stored secret was never read and never at fault. - checksums.sha256 lines carried "windows/"/"linux/" path prefixes; the v1.0.0 updater's ParseChecksumFile exact-matches the last field against "chatserver.exe", so every deployed 1.0.0 server would have failed the checksum lookup. Emit bare asset filenames (current updater accepts both). - No end-to-end proof the signed assets verify against the pinned public key that ships inside the server binary. Add a fail-closed minisign verify step before any release is created; it catches key/pubkey mismatch, signature format drift, and signer flag regressions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>