Skip to content

Nomad Launcher v1.0.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Jul 14:35
· 5 commits to main since this release
v1.0.3
d2c6915

Bug-fix release, and the first one built and attested by CI.

Fixed

  • The cleanup watcher now matches browser processes by executable path instead of file name. Every Chromium-based browser ships as chrome.exe, so on a machine that also runs a desktop Chrome the watcher could never see the count reach zero; when Chromium retired its initial process while the browser stayed open, the watcher timed out, scrubbed host traces early, and left nothing to scrub at the real exit. With an exact path it now waits on process handles until the portable browser tree has actually exited.
  • All HTTP clients now refuse redirects that downgrade from https to http. Downloads were already hash- and GPG-pinned, so this closes an exposure of full download URLs to on-path observers rather than an integrity hole.
  • SHA256SUMS is now written with LF line endings. The CRLF endings in earlier manifests made GNU sha256sum -c report "no file was verified"; comparing hashes by hand was unaffected.

Added

  • SECURITY.md: a private vulnerability-reporting channel and an explicit threat model, including what the post-exit scrub can and cannot remove.

  • Releases are now built from source by GitHub Actions with build provenance attestation. With the GitHub CLI you can check that a binary came from this repository's code rather than from someone's machine:

    gh attestation verify Nomad-Firefox.exe --repo cyph3rpuNk-dev/Nomad-Launcher

    The attestation is independent of the GPG signature below; the two checks back each other up.

  • The release signing key is also published on keyservers independent of this repository (keys.openpgp.org and keyserver.ubuntu.com), so the repository copy can be cross-checked.

Verify

gpg --import nomad-release-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

Signing key: Nomad Launcher, fingerprint 4F90CF11723DC3A2E7198331FEF981E909EF44ED.

The launchers are intentionally not Authenticode-signed; release integrity relies on the GPG-signed SHA256SUMS plus the build attestation.

Assets 15
Loading