Skip to content

Saavi v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 10:59
v0.3.1
b3dad63
  • Key details on a single click. Clicking a key row now opens the details
    dialog directly, in both the Saavi store and System GnuPG views — it used to
    need a double-click or the toolbar's Details button, so a plain click looked
    like it did nothing.

Install

These builds are GPG-signed (see below) but not yet code-signed with
Apple or Microsoft certificates, so each OS will warn on first launch.

  • macOS (.dmg, universal): drag Saavi to Applications. The build is
    not yet notarized, so on first open macOS says it "could not verify that
    Saavi is free of malware" and offers only Done / Move to Bin. Click
    Done, then System Settings → Privacy & Security, scroll to "Saavi was
    blocked", click Open Anyway. Or, in Terminal:
    xattr -d com.apple.quarantine /Applications/Saavi.app. Either way,
    verify the .sig first — that is the check this dialog stands in for.
  • Windows (.msi or -setup.exe): SmartScreen will show "Windows
    protected your PC" — click More info → Run anyway. The installer
    fetches Microsoft's WebView2 runtime if it is missing (Windows 10/11 ship it).
  • Linux: sudo apt install ./saavi_*_amd64.deb, or
    chmod +x saavi_*.AppImage && ./saavi_*.AppImage.

Your keys live in the app's own store (passphrase-locked) — nothing is
uploaded anywhere. Backups are plain text files you save yourself.

Verify this release

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Verifying Saavi v0.3.1

1. Download the asset you want, its detached signature (.sig), and
   saavi_pubkey.gpg from this release.

2. Import the key:

       gpg --import saavi_pubkey.gpg

3. Check the fingerprint:

       gpg --fingerprint "Saavi release signing"

   It must read, exactly:

       DCF5 773B 84E9 AABA 785F  D5A8 4D2A ECE6 8A95 3F46

   Compare it against https://kaditham.ie/saavi/ — published outside
   GitHub, so a compromised repository cannot swap the key and the
   binaries together. If it differs, stop and write to
   security@kaditham.me (see SECURITY.md in the repository).

4. Verify the asset:

       gpg --verify <asset>.sig <asset>

   Expect: Good signature from "Saavi release signing
   <webmaster@kaditham.me>". A "key is not certified" warning is
   normal here; step 3 is what establishes the trust.

This message is clearsigned by the same release key: save it to a
file and run gpg --verify on it to check it has not been altered.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTc9Xc7hOmqunhf1ahNKuzmipU/RgUCao7EugAKCRBNKuzmipU/
RurIAP9YoVSuth6WzMncXNFmrsX5rSm3fyzX+RASbwtmMoMtewD+O2LH3jx1yr0r
b4QJ2bg2FmR1Fgxt+sfivQAhkJgndAA=
=2AQ0
-----END PGP SIGNATURE-----
Assets 16
Loading