feat: add safe Gitea sync and signed updates

scripts/publish-binary-release.cjs

@@ -4,6 +4,7 @@ const fs = require("node:fs/promises");
 const path = require("node:path");
 const { execFileSync } = require("node:child_process");
 const { app, safeStorage } = require("electron");
+const { normalizeBaseUrl } = require("../src/shared/validation.cjs");
 
 const root = path.resolve(__dirname, "..");
 const configuredUserData =
@@ -59,10 +60,7 @@ app.whenReady().then(async () => {
     const token = safeStorage.decryptString(
       Buffer.from(config.gitea.encryptedToken, "base64"),
     );
-    const baseUrl = String(config.gitea.baseUrl || "").replace(/\/+$/, "");
-    if (!/^https?:\/\//i.test(baseUrl)) {
-      throw new Error("The configured Gitea base URL is invalid.");
-    }
+    const baseUrl = normalizeBaseUrl(config.gitea.baseUrl);
     const owner = safeRepositoryPart(
       process.env.FORGEFLOW_RELEASE_OWNER || config.updates?.owner || "Jens",
       "Release repository owner",
@@ -181,6 +179,8 @@ app.whenReady().then(async () => {
     for (const [name, type] of [
       [`ForgeFlow-${version}-provenance.json`, "application/json"],
       [`ForgeFlow-${version}-sbom.cdx.json`, "application/vnd.cyclonedx+json"],
+      [`ForgeFlow-${version}-release-manifest.json`, "application/json"],
+      [`ForgeFlow-${version}-release-manifest.json.sig`, "application/octet-stream"],
     ]) {
       const bytes = await fs.readFile(path.join(root, "dist", name));
       const existing = (release.assets || []).find((asset) => asset.name === name);
@@ -194,6 +194,8 @@ app.whenReady().then(async () => {
       ...binaries.flatMap((binaryPath) => [path.basename(binaryPath), `${path.basename(binaryPath)}.sha256`]),
       `ForgeFlow-${version}-provenance.json`,
       `ForgeFlow-${version}-sbom.cdx.json`,
+      `ForgeFlow-${version}-release-manifest.json`,
+      `ForgeFlow-${version}-release-manifest.json.sig`,
     ];
     const missingAssets = requiredAssets.filter((name) => !(release.assets || []).some((asset) => asset.name === name));
     if (missingAssets.length) throw new Error(`Release remains draft because required assets are missing: ${missingAssets.join(", ")}`);