enricobuehlerandClaude Fable 5 c4c4f217bf ci(update): build+sign+publish the update manifest — stable at announce, canary after the canary installer ...

bash+openssl signer (raw-64-byte ed25519 over exact bytes, base64 .sig — the
plugin-index format) with the pinned-key cross-check, manifest-then-sig upload
order, and a live-feed self-verify. announce.yml re-hashes the installer against
its sidecar and fail-closes without UPDATE_MANIFEST_KEY; pre-release tags never
enter the stable feed. windows-host.yml grows a Linux canary-manifest job.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-30 14:34:47 +02:00

..

check-android-jni-imports.sh

fix(android): client loads again on Android < 13 — dlsym the API-33 render callback

2026-07-10 10:06:31 +02:00

discord-announce.sh

feat(ci/release): author release notes in-repo + announce stable releases to Discord

2026-07-23 16:43:18 +02:00

docker-prune.service

ci(runner): cap the act_runner cache + 30-min prune (fix recurring disk-full)

2026-06-19 07:53:08 +00:00

docker-prune.sh

feat(ci): builder images move to the LAN registry, content-keyed; fan-out scoped by paths

2026-07-29 21:04:05 +02:00

docker-prune.timer

fix(ci/runner): the disk guard has to fire before the disk is tight, not after

2026-07-29 18:58:32 +02:00

ensure-windows-toolchain.ps1

fix(ci/windows): install zstd, or every cache save dies on a missing gzip

2026-07-30 10:16:43 +02:00

gen-sbom.sh

ci: the supply chain accounts for itself — per-release SBOM, full-tree audits, a real license gate

2026-07-29 00:59:29 +02:00

gitea-release.ps1

feat(ci/release): every release asset now ships its own SHA256 sidecar

2026-07-29 12:12:21 +02:00

gitea-release.sh

feat(ci/release): every release asset now ships its own SHA256 sidecar

2026-07-29 12:12:21 +02:00

pf-version.ps1

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

pf-version.sh

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

provision-windows-punktfunk-extras.ps1

fix(security): anti-replay, 0600 client key, open redirect, supply-chain

2026-07-10 10:04:23 +02:00

provision-windows-wdk.ps1

feat(windows-ci): self-provisioning toolchain for the shared unom/infra runner

2026-07-01 11:41:31 +02:00

publish-update-manifest.sh

ci(update): build+sign+publish the update manifest — stable at announce, canary after the canary installer

2026-07-30 14:34:47 +02:00

retry.sh

fix(ci): flatpak job rides out the runner's network flake — retry every single-shot fetch

2026-07-10 10:20:40 +02:00

setup-macos-runner.sh

feat(release): production Apple builds — notarized macOS dmg + iOS TestFlight

2026-06-12 14:34:45 +00:00

winget-manifest.ps1

feat(packaging/winget): install the Windows host with winget, from our own source

2026-07-26 19:09:13 +02:00