Triple-C

The first fully signed run (signer CN=OLS Digital LLC) signed the app
binary, the MSI, the NSIS installer and the uninstaller, and skipped the
seven build-time DLLs. It still failed verification on
target\release\triple-c.exe. Tauri patches that file with bundle-type
information before each bundle, signs it, packages it, and patches it
again, so the loose copy is unsigned by design and is not what ships.

Verification now:
- checks the installers themselves;
- unpacks the MSI with `msiexec /a` and checks the binaries inside it;
- for NSIS, which can't be unpacked that way, requires the signing log to
  show that the app binary and the uninstaller were signed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-23 18:53:58 -07:00

finalize-appimage.sh

Take the re-review: distinguish "absent" from "unreachable"

2026-09-03 09:17:34 -07:00

install-appimage.sh

Retire the Arch package, document AppImage desktop integration

2026-08-28 13:11:26 -07:00

publish-update-channel.sh

Take the re-review: distinguish "absent" from "unreachable"

2026-09-03 09:17:34 -07:00

scan-secrets.sh

Refuse a commit that adds something shaped like a credential