# feat: minisign signatures on every release download · clo/snowbound

[View on GitCafe](https://git.cafe/clo/snowbound/commit/0a185b6b6e414ab455bb8e02d0137bc7b0129f5b)

Repository: [clo/snowbound](https://git.cafe/clo/snowbound)

Visibility: public

Requested revision: 0a185b6b6e414ab455bb8e02d0137bc7b0129f5b

Requested commit: 0a185b6b6e414ab455bb8e02d0137bc7b0129f5b

Commit: 0a185b6b6e414ab455bb8e02d0137bc7b0129f5b

Tree: b300f2266d850775b7a8b5999182c244a13755b9

Author: clover caruso

Committer: clover caruso

## Message

```
feat: minisign signatures on every release download

Every published file gets a .minisig beside it, in the build folder and
in latest/, signed by the existing ed25519 release key in minisign's
prehashed format. minisign.pub at the root replaces
crates/snowbound/release-key.pub as the one public key, compiled into the
app and quoted in the readme's verify command.

The updater now trusts the archive's size and SHA-256 from the signed
build.json alone; release.py still writes each archive's raw signature
for older apps, which check it.

Assisted-by: claude-opus-5.5

```

## Parents

- [9b22f115f0b0570cfc78ce223c6a325b1714939b](https://git.cafe/clo/snowbound/commit/9b22f115f0b0570cfc78ce223c6a325b1714939b?format=markdown)

[Source at this commit](https://git.cafe/clo/snowbound/tree/0a185b6b6e414ab455bb8e02d0137bc7b0129f5b?format=markdown)