Skip to content

Saavi v0.3.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 12:04
v0.3.2
9518803
  • The running version is visible. A quiet vX.Y.Z sits in the status
    bar next to the update control — "what version am I on?" no longer needs
    the package manager.
  • Publish your key to keys.openpgp.org. A new action in key details
    uploads the public key (own keys only — Saavi store, or system keys with
    their secret half here). The key is findable by fingerprint immediately;
    the keyserver mails each address a verification link, and by-email search
    works once it is clicked.
  • Revocation certificates. Key details can now save the signed "this key
    is no longer valid" note — generated up front with new Saavi-store keys
    (and stored alongside them), derived on demand for imported or older keys
    (unlock required), and produced by gpg itself for system keys. Keep it
    separate from backups; import + publish it if a key is ever lost or
    compromised. GnuPG-interop tested.

Install

These builds are GPG-signed (see below) but not yet code-signed with
Apple or Microsoft certificates, so each OS will warn on first launch.

  • macOS (.dmg, universal): drag Saavi to Applications. The build is
    not yet notarized, so on first open macOS says it "could not verify that
    Saavi is free of malware" and offers only Done / Move to Bin. Click
    Done, then System Settings → Privacy & Security, scroll to "Saavi was
    blocked", click Open Anyway. Or, in Terminal:
    xattr -d com.apple.quarantine /Applications/Saavi.app. Either way,
    verify the .sig first — that is the check this dialog stands in for.
  • Windows (.msi or -setup.exe): SmartScreen will show "Windows
    protected your PC" — click More info → Run anyway. The installer
    fetches Microsoft's WebView2 runtime if it is missing (Windows 10/11 ship it).
  • Linux: sudo apt install ./saavi_*_amd64.deb, or
    chmod +x saavi_*.AppImage && ./saavi_*.AppImage.

Your keys live in the app's own store (passphrase-locked) — nothing is
uploaded anywhere. Backups are plain text files you save yourself.

Verify this release

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Verifying Saavi v0.3.2

1. Download the asset you want, its detached signature (.sig), and
   saavi_pubkey.gpg from this release.

2. Import the key:

       gpg --import saavi_pubkey.gpg

3. Check the fingerprint:

       gpg --fingerprint "Saavi release signing"

   It must read, exactly:

       DCF5 773B 84E9 AABA 785F  D5A8 4D2A ECE6 8A95 3F46

   Compare it against https://kaditham.ie/saavi/ — published outside
   GitHub, so a compromised repository cannot swap the key and the
   binaries together. If it differs, stop and write to
   security@kaditham.me (see SECURITY.md in the repository).

4. Verify the asset:

       gpg --verify <asset>.sig <asset>

   Expect: Good signature from "Saavi release signing
   <webmaster@kaditham.me>". A "key is not certified" warning is
   normal here; step 3 is what establishes the trust.

This message is clearsigned by the same release key: save it to a
file and run gpg --verify on it to check it has not been altered.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTc9Xc7hOmqunhf1ahNKuzmipU/RgUCao7UQgAKCRBNKuzmipU/
Rs2RAP9B1CJTxmIcmIKUkK50xlHJAqsSHcYnY1eTRO48VOSHGgD+I4IoTrhYmGN+
ZuUMSfiahtu5NAdkGOHjgr64QWWRqww=
=WxRr
-----END PGP SIGNATURE-----
Assets 16
Loading