[lidge-jun]

Summary

• Repair the two producer/verifier mismatches blocking desktop publication. Standalone checksum filenames now retain the archive extension. The updater verifier now decodes Tauri's outer-base64 minisign box and verifies its ED/BLAKE2b-512 signature plus the trusted-comment signature against the pinned key.
• Add an independent, attributed minisign 0.7.3 vector and rejection cases for altered payloads, signatures, comments, keys and malformed envelopes. Preserve asset counts, checksums, signature requirements and publication ordering.
• Ten independent Sol reviewers inspect only this release-verification issue. Unrelated regression work is excluded. The owner explicitly authorizes immediate dev integration without waiting for dev CI, followed by main/preview promotion and hosted verification there.

Verification

• Hosted evidence: https://github.com/lidge-jun/opencodex/actions/runs/35721661559. All eight packaging jobs passed, including Apple notarization Accepted and bundle signature verification. Final verification failed on five checksum names.
• Inspection of that run's actual MSI signature confirmed Tauri's four-line outer-base64 ED format. Pinned Tauri CLI 2.11.1 and minisign 0.7.3 source establish the prehash and global signature protocol.
• Independent upstream test vector comes from jedisct1/rust-minisign commit 068d25a2fffd3d9da96e43f3844c830d8176d5a0 with its license retained.
• Local tests, builds, typechecks and cryptographic execution: NOT RUN by owner instruction. Commit/push use --no-verify. Exact-head hosted tests and real artifact verification remain required; no source review is represented as an executed test.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 13f6cea7-36fc-468f-a88a-d7e8ee5b5434

📥 Commits

Reviewing files that changed from the base of the PR and between 7bd9985 and b4a5981.

📒 Files selected for processing (7)

• .github/workflows/release.yml
• desktop/scripts/verify-release-assets.ts
• structure/desktop-shell.md
• tests/ci-workflows/release-desktop-scripts.test.ts
• tests/ci-workflows/release-pipeline-contract.test.ts
• tests/fixtures/minisign/LICENSE
• tests/fixtures/minisign/prehashed-vector.json

 ________________________________
< Goodbye, diff induced despair. >
 --------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}