enricobuehler da13d14159 fix(ci): verify the pinned bun windows zip by sha256 before staging it ...

security-review 2026-08-15 finding 12 (windows). bun-windows-x64.zip was
downloaded and Expand-Archived with no integrity check, then Authenticode-signed
into the installer and its hash published in the Ed25519 update manifest — our
signature vouching for bytes we never verified (GitHub release assets are mutable
at a fixed URL). Pin and verify the sha256. The Linux curl|bash sites
(arch/rpm/deb + builder Dockerfiles) still need version+hash pinning — tracked.

2026-08-15 11:15:29 +02:00

..

ISSUE_TEMPLATE

feat(security): finish Windows firewall Public opt-in wiring + vuln-disclosure + doc cleanup

2026-07-03 14:08:17 +00:00

scripts

fix(ci): builder-image pushes authenticate, and :latest stops being a tag anyone can move

2026-08-05 19:52:19 +02:00

workflows

fix(ci): verify the pinned bun windows zip by sha256 before staging it

2026-08-15 11:15:29 +02:00