Skip to content

Saavi v0.3.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 12:22
v0.3.3
d075f7c
  • Header polish: the top-left mark is now the Saavi key tile (the launcher
    icon, inlined SVG) instead of the Tamil "சா" letters, and the tagline
    reads "Friendly desktop OpenPGP" — here and everywhere else it appeared
    (README, package metadata, the installer's short description).

Install

These builds are GPG-signed (see below) but not yet code-signed with
Apple or Microsoft certificates, so each OS will warn on first launch.

  • macOS (.dmg, universal): drag Saavi to Applications. The build is
    not yet notarized, so on first open macOS says it "could not verify that
    Saavi is free of malware" and offers only Done / Move to Bin. Click
    Done, then System Settings → Privacy & Security, scroll to "Saavi was
    blocked", click Open Anyway. Or, in Terminal:
    xattr -d com.apple.quarantine /Applications/Saavi.app. Either way,
    verify the .sig first — that is the check this dialog stands in for.
  • Windows (.msi or -setup.exe): SmartScreen will show "Windows
    protected your PC" — click More info → Run anyway. The installer
    fetches Microsoft's WebView2 runtime if it is missing (Windows 10/11 ship it).
  • Linux: sudo apt install ./saavi_*_amd64.deb, or
    chmod +x saavi_*.AppImage && ./saavi_*.AppImage.

Your keys live in the app's own store (passphrase-locked) — nothing is
uploaded anywhere. Backups are plain text files you save yourself.

Verify this release

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Verifying Saavi v0.3.3

1. Download the asset you want, its detached signature (.sig), and
   saavi_pubkey.gpg from this release.

2. Import the key:

       gpg --import saavi_pubkey.gpg

3. Check the fingerprint:

       gpg --fingerprint "Saavi release signing"

   It must read, exactly:

       DCF5 773B 84E9 AABA 785F  D5A8 4D2A ECE6 8A95 3F46

   Compare it against https://kaditham.ie/saavi/ — published outside
   GitHub, so a compromised repository cannot swap the key and the
   binaries together. If it differs, stop and write to
   security@kaditham.me (see SECURITY.md in the repository).

4. Verify the asset:

       gpg --verify <asset>.sig <asset>

   Expect: Good signature from "Saavi release signing
   <webmaster@kaditham.me>". A "key is not certified" warning is
   normal here; step 3 is what establishes the trust.

This message is clearsigned by the same release key: save it to a
file and run gpg --verify on it to check it has not been altered.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTc9Xc7hOmqunhf1ahNKuzmipU/RgUCao7YDgAKCRBNKuzmipU/
RqABAQDghseZ11zphaR1HxZHuhnZzHIDOenXXEk7A5Ar4L9sYQD+OT9FBIBDXQp3
NEV2pOYlRGFWyxWUaYwOg0oVvjzDhQc=
=nAWL
-----END PGP SIGNATURE-----
Assets 16
Loading