Skip to content

Multron Download Manager v0.0.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 07:56
untagged-57b1916c4ce6c8dfd38f
dc42f0c

Multron Download Manager v0.0.5

A security release for automatic updates.

Signed updates

Until now an update was checked only against the SHA256SUMS.txt published next to it on GitHub. That catches a broken download, but anyone who could change the files of a release could have changed that list too. From this version on, updates are signed:

  • Signed manifest. Every release has an update.json with its version and the SHA-256 of every file, signed with the Multron Download Manager release key (update.json.sig). The public half of the key is built into the app, and an update is installed only when the signature matches. Changing a file on the release without the private key no longer works.
  • No going back. The signed version must be exactly the release being installed and newer than the installed one, so an old signed release cannot be replayed to install an older version.
  • Official source only. The update, its manifest and its signature must come from GitHub over a verified TLS connection; anything else is refused.
  • Checked again before installing. The downloaded package is hashed once more right before it is installed, so a file changed on disk in the meantime is refused.
  • Private download folder. Updates now go into the app's own cache folder instead of a shared temporary folder. On Linux this closes a way for another user on the same computer to swap a .deb or .rpm package before it is installed with administrator rights.
  • Fail closed. A release without a valid signature is not installed.
  • Build provenance. Every file of the release has a GitHub build attestation that shows which workflow run and commit built it.
  • Only what was built gets signed. The build jobs no longer upload anything to the release. The signing job takes the files built in the same run, removes anything else that was put on the draft, signs and uploads them itself, and stops if the draft changes while it works. A file slipped onto a release by someone else can therefore never end up in the signed manifest.
  • Pinned build tools. The GitHub Actions used to build releases are pinned to exact commits, and the WebView2 installer bundled with the Windows setup is checked for Microsoft's signature before it is included.
  • The macOS .app.tar.gz archives are no longer attached to releases; use the .dmg.

You can check any download yourself:

  • node scripts/verify-update.mjs update.json update.json.sig <file> from the repository checks the signature and the file's SHA-256.
  • gh attestation verify <file> --repo Multron-Community/Multron-Download-Manager checks where it was built.

SHA256SUMS.txt is still published for older versions and for quick manual checks.

Updating

v0.0.4 and earlier update themselves to this version the next time they start; they check it with SHA256SUMS.txt. Updates after this one are verified with the signature.

For the browser extension updating itself see the v0.0.4 release; for update progress, the extension's hide button and Flatpak browsers the v0.0.3 release; for the Linux FFmpeg changes the v0.0.2 release; and for everything that came with the first release the v0.0.1 release.

Downloads

Platform File
Windows 10/11 (x64) Multron-Download-Manager-*-x64-Setup.exe
macOS Apple Silicon *_aarch64.dmg
macOS Intel *_x64.dmg
Ubuntu 24.04+ / Mint 22+ / Debian 13+ (apt) *_amd64.deb / *_arm64.deb → sudo apt install ./file.deb
Debian 12 bookworm / LMDE 6 (apt) *_debian12_amd64.deb / *_debian12_arm64.deb → sudo apt install ./file.deb
Fedora 43+ (dnf) *_fedora_x86_64.rpm / *_fedora_aarch64.rpm → sudo dnf install ./file.rpm
openSUSE Leap 16 / Tumbleweed (zypper) *_opensuse_x86_64.rpm / *_opensuse_aarch64.rpm → sudo zypper install --allow-unsigned-rpm ./file.rpm
Any Linux *.AppImage
Browser extension multron-browser-extension-chromium-*.zip (Chrome, Edge, Brave, Opera, Vivaldi) / multron-browser-extension-firefox-*.zip

Every file is listed with its SHA-256 in update.json, which is signed with the Multron Download Manager release key (update.json.sig). Verify a download with node scripts/verify-update.mjs update.json update.json.sig <file> from the repository, or check its build provenance with gh attestation verify <file> --repo Multron-Community/Multron-Download-Manager. SHA256SUMS.txt lists the same hashes without a signature.

macOS builds are not notarized: right-click → Open the first time, or run xattr -cr "/Applications/Multron Download Manager.app".

Assets 21
Loading