feat: add safe Gitea sync and signed updates

2026-08-27 00:38:58 +02:00
parent cb9bdcd713
commit d47c7b5e41
46 changed files with 1658 additions and 246 deletions
@@ -124,9 +124,13 @@ included model uses:
 - SSH passwords and private-key passphrases use Electron `safeStorage`;
 - diagnostics receive those runtime secrets only for redaction and never export
  encrypted credential fields;
- SSH deployment requires a pinned host-key fingerprint;
+- SSH host identity is previewed without credentials and authenticated sessions
+  require the exact user-confirmed pinned fingerprint;
 - remote folders and Compose paths are validated against traversal;
 - tracked server-side changes block exact-SHA reset;
 - updater tokens are sent only to the configured Gitea origin;
+- non-loopback Gitea connections require HTTPS;
+- packaged updates require a publisher-signed Ed25519 manifest that binds the
+  source commit, artifact identity, byte length and SHA-256 digest;
 - update archives are checksummed and validated by the full local quality gate;
 - source backup is restored when an update fails.