feat(install): minisign signature verification (#34)

jsutter commented

2026-08-06 04:24:54 +00:00

Owner

Coordinated with dit-operator fix-34-signing (PR #142). install.sh: always fetch SHA256SUMS.minisig, fail-closed on absence, verify with minisign when present. Production pubkey RWRnfHVIhpTTUobOxmCHpDThuxbJ25DX7joL+EVrj2qlZ0KoqH9oLNiN embedded (KEEP IN SYNC with dit-operator src/signing.rs). Refs: dit-operator #34.

jsutter added 2 commits

2026-08-06 04:24:54 +00:00

feat(install): minisign signature verification (#34 ) a6da1b0d0b

Add release-signature verification to install.sh (coordinated with
dit-operator fix-34-signing). Always fetch SHA256SUMS.minisig and fail
closed on absence (a free release-integrity signal needing no verifier);
verify cryptographically with minisign when present; warn (not block) when
the release is signed but no verifier is installed — install.sh is a TOFU
bootstrap and the installed binary enforces signatures fail-closed on every
self-update henceforth.

The embedded DITO_RELEASE_PUBKEY is the DEV placeholder (distinct from the
dit-operator test-fixture key). KEEP IN SYNC with dit-operator
src/signing.rs DITO_RELEASE_PUBKEYS[0] when the production key is provisioned.

Refs: dit-operator #34.

chore(install): swap in production release-signing public key (#34 ) fb0673e89e

Operator provisioned the minisign keypair (2026-08-05). Public key
RWRnfHVIhpTTUobOxmCHpDThuxbJ25DX7joL+EVrj2qlZ0KoqH9oLNiN replaces the
DEV placeholder. KEEP IN SYNC with dit-operator src/signing.rs
DITO_RELEASE_PUBKEYS[0].

jsutter merged commit 87b12d8c29 into main

2026-08-06 04:33:24 +00:00

jsutter referenced this pull request from a commit

2026-08-06 04:33:25 +00:00

Merge pull request 'feat(install): minisign signature verification (#34)' (#4) from fix-34-signing into main

Rows
Columns

feat(install): minisign signature verification (#34) #4