Skip to content

Saavi v0.3.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 13:24
v0.3.4
c497768
  • One-click updates. When the banner announces a new release, Saavi now
    downloads the update package itself and verifies its signature against a
    public key baked into the running binary (Tauri updater, minisign — a
    separate key from the GPG release signing key) before offering a single
    Install & restart button. Nothing installs without that click; a
    package that fails verification is discarded and the browser flow
    returns.
  • One-click updates for .deb installs too. The Tauri updater cannot
    drive dpkg, so Saavi walks the manual chain itself: it verifies
    SHA256SUMS.asc against the release key pinned in the app, checks the
    downloaded .deb against its signed checksum, and installs on your
    click through polkit's system authentication (pkexec dpkg -i), then
    relaunches.
  • The update check runs on every launch. It was capped at once per
    calendar day, so "restart to see if there's an update" silently did
    nothing for the rest of the day. It is still a single GET of our own
    static manifest — nothing else changes: no third party, no identifiers,
    nothing downloaded or installed.

Install

These builds are GPG-signed (see below) but not yet code-signed with
Apple or Microsoft certificates, so each OS will warn on first launch.

  • macOS (.dmg, universal): drag Saavi to Applications. The build is
    not yet notarized, so on first open macOS says it "could not verify that
    Saavi is free of malware" and offers only Done / Move to Bin. Click
    Done, then System Settings → Privacy & Security, scroll to "Saavi was
    blocked", click Open Anyway. Or, in Terminal:
    xattr -d com.apple.quarantine /Applications/Saavi.app. Either way,
    verify the .sig first — that is the check this dialog stands in for.
  • Windows (.msi or -setup.exe): SmartScreen will show "Windows
    protected your PC" — click More info → Run anyway. The installer
    fetches Microsoft's WebView2 runtime if it is missing (Windows 10/11 ship it).
  • Linux: sudo apt install ./saavi_*_amd64.deb, or
    chmod +x saavi_*.AppImage && ./saavi_*.AppImage.

Your keys live in the app's own store (passphrase-locked) — nothing is
uploaded anywhere. Backups are plain text files you save yourself.

Verify this release

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Verifying Saavi v0.3.4

1. Download the asset you want, its detached signature (.sig), and
   saavi_pubkey.gpg from this release.

2. Import the key:

       gpg --import saavi_pubkey.gpg

3. Check the fingerprint:

       gpg --fingerprint "Saavi release signing"

   It must read, exactly:

       DCF5 773B 84E9 AABA 785F  D5A8 4D2A ECE6 8A95 3F46

   Compare it against https://kaditham.ie/saavi/ — published outside
   GitHub, so a compromised repository cannot swap the key and the
   binaries together. If it differs, stop and write to
   security@kaditham.me (see SECURITY.md in the repository).

4. Verify the asset:

       gpg --verify <asset>.sig <asset>

   Expect: Good signature from "Saavi release signing
   <webmaster@kaditham.me>". A "key is not certified" warning is
   normal here; step 3 is what establishes the trust.

This message is clearsigned by the same release key: save it to a
file and run gpg --verify on it to check it has not been altered.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTc9Xc7hOmqunhf1ahNKuzmipU/RgUCao7mGwAKCRBNKuzmipU/
RttxAQDafxXmt9vipY/uhFAYQQK/uyE2bNG3IwS9ETWBzZY9YgEAz6r1LDYZ8uLG
N20kXuCmXps0yk4LzACfcaLVYmgsWwk=
=hT67
-----END PGP SIGNATURE-----
Assets 17
Loading