perf(release): rank download sources by speed, resume transfers, and sign Linux archives

.github/workflows/desktop-package.yml

@@ -84,6 +84,10 @@ jobs:
       BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
       TAURI_UPDATER_ENDPOINT: https://github.com/GCWing/BitFun/releases/latest/download/latest.json
       TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+      # Same trust root, compiled into the Desktop binary so one-click relay
+      # deploy can verify the signed checksum locally and hand the remote host
+      # a hash it does not have to trust the mirror for.
+      BITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
       TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
       TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
@@ -243,6 +247,10 @@ jobs:
     name: Linux CLI and Relay Server
     needs: prepare
     uses: ./.github/workflows/linux-binaries.yml
+    secrets:
+      release_signing_key: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      release_signing_password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+      release_pubkey: ${{ secrets.TAURI_UPDATER_PUBKEY }}
     with:
       checkout_ref: ${{ needs.prepare.outputs.checkout_ref }}
       version: ${{ needs.prepare.outputs.version }}
@@ -316,6 +324,35 @@ jobs:
             --repo "GCWing/BitFun" \
             --out linux-release-assets/linux-binaries.json
 
+      # The Tauri bundler signs the five updater artifacts during `tauri build`,
+      # but the installers people download by hand from the release page — dmg,
+      # deb, rpm, the Windows installer and the direct AppImages — shipped with
+      # no signature at all. Sign them with the same key so every published
+      # artifact is verifiable. (This is not OS-level code signing: Gatekeeper
+      # and SmartScreen still need Apple/Authenticode certificates.)
+      - name: Sign installer packages
+        shell: bash
+        env:
+          BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+        run: |
+          set -euo pipefail
+          mapfile -t assets < <(
+            find release-assets -type f \
+              \( -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' \
+                 -o -name '*.dmg' -o -name '*bitfun-installer.exe' \) | sort
+          )
+          if [[ "${#assets[@]}" -eq 0 ]]; then
+            echo "No installer packages found to sign."
+            exit 0
+          fi
+          bash scripts/sign-release-assets.sh "${assets[@]}"
+
+          # Publish the public key alongside the signatures: a signature nobody
+          # can fetch a key for is not verifiable.
+          printf '%s' "${BITFUN_SIGNING_PUBKEY}" | base64 -d >release-assets/minisign.pub
+
       - name: Upload to release
         uses: softprops/action-gh-release@v3
         with:
@@ -328,10 +365,13 @@ jobs:
             release-assets/**/*.dmg
             release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
+            release-assets/**/*.sig
+            release-assets/minisign.pub
             linux-release-assets/bitfun-cli-*.tar.gz
             linux-release-assets/bitfun-cli-*.tar.gz.sha256
             linux-release-assets/bitfun-relay-server-*.tar.gz
             linux-release-assets/bitfun-relay-server-*.tar.gz.sha256
+            linux-release-assets/*.tar.gz.sig
             linux-release-assets/linux-binaries.json
           fail_on_unmatched_files: true
 
@@ -352,3 +392,25 @@ jobs:
             "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
             -o linux-binaries.published.json
           test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"
+
+      # Nudge the openbitfun.com mirror to sync now instead of on its next
+      # 10-minute cron tick. Until the mirror has these bytes, CN clients have
+      # only the GitHub origin to fall back to. Best effort: the cron run is
+      # still the source of truth, so a failed or unconfigured ping never fails
+      # the release. Receiver setup: scripts/openbitfun-release-sync.sh.
+      - name: Request openbitfun mirror sync
+        continue-on-error: true
+        env:
+          SYNC_WEBHOOK_URL: ${{ secrets.OPENBITFUN_SYNC_WEBHOOK_URL }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${SYNC_WEBHOOK_URL:-}" ]]; then
+            echo "OPENBITFUN_SYNC_WEBHOOK_URL is not configured; the mirror will pick this up on its next cron run."
+            exit 0
+          fi
+          curl -fsSL -X POST --retry 3 --retry-delay 5 --max-time 30 \
+            -H 'Content-Type: application/json' \
+            -d "{\"tag\":\"${RELEASE_TAG}\"}" \
+            "${SYNC_WEBHOOK_URL}" >/dev/null
+          echo "Mirror sync requested for ${RELEASE_TAG}."

.github/workflows/linux-binaries.yml

@@ -15,6 +15,16 @@ on:
         description: "Stable prefix that isolates artifacts in the caller run."
         required: true
         type: string
+    secrets:
+      release_signing_key:
+        description: "Tauri/minisign private key, base64. Absent on forks: archives ship unsigned."
+        required: false
+      release_signing_password:
+        description: "Password for release_signing_key."
+        required: false
+      release_pubkey:
+        description: "Tauri/minisign public key, base64. Compiled into the CLI as its trust root."
+        required: false
 
 permissions:
   contents: read
@@ -91,6 +101,11 @@ jobs:
 
       - name: Build CLI and Relay Server
         shell: bash
+        env:
+          # Compiled into the CLI; its presence makes signature verification
+          # mandatory for self-update. Unset on forks, which then fall back to
+          # checksum-only.
+          BITFUN_RELEASE_PUBKEY: ${{ secrets.release_pubkey }}
         run: |
           cargo build --release \
             --target ${{ matrix.platform.target }} \
@@ -118,6 +133,24 @@ jobs:
           TARGET: ${{ matrix.platform.target }}
         run: bash scripts/relay/package-unix.sh "$ASSET_VERSION" "$TARGET"
 
+      - name: Sign release archives
+        shell: bash
+        env:
+          BITFUN_SIGNING_KEY: ${{ secrets.release_signing_key }}
+          BITFUN_SIGNING_PASSWORD: ${{ secrets.release_signing_password }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.release_pubkey }}
+          CLI_ARCHIVE: ${{ steps.cli-stage.outputs.archive }}
+          RELAY_ARCHIVE: ${{ steps.relay-stage.outputs.archive }}
+        run: |
+          set -euo pipefail
+          # The .sha256 files are signed too: remote relay hosts have no
+          # minisign, so Desktop verifies the signature over the tiny checksum
+          # file locally and hands the trusted hash to the server, which then
+          # only needs sha256sum.
+          bash scripts/sign-release-assets.sh \
+            "$CLI_ARCHIVE" "${CLI_ARCHIVE}.sha256" \
+            "$RELAY_ARCHIVE" "${RELAY_ARCHIVE}.sha256"
+
       - name: Upload Linux binary artifacts
         uses: actions/upload-artifact@v6
         with:
@@ -129,3 +162,5 @@ jobs:
             ${{ steps.cli-stage.outputs.checksum }}
             ${{ steps.relay-stage.outputs.archive }}
             ${{ steps.relay-stage.outputs.checksum }}
+            *.tar.gz.sig
+            *.tar.gz.sha256.sig

.github/workflows/nightly.yml

@@ -67,6 +67,9 @@ jobs:
     if: needs.check-changes.outputs.should_build == 'true'
     env:
       NODE_OPTIONS: --max-old-space-size=6144
+      # Nightly relay archives are signed too (linux-binaries.yml receives the
+      # key), so nightly Desktop needs the same trust root to verify them.
+      BITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
 
     strategy:
       fail-fast: false
@@ -217,6 +220,10 @@ jobs:
     needs: check-changes
     if: needs.check-changes.outputs.should_build == 'true'
     uses: ./.github/workflows/linux-binaries.yml
+    secrets:
+      release_signing_key: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      release_signing_password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+      release_pubkey: ${{ secrets.TAURI_UPDATER_PUBKEY }}
     with:
       checkout_ref: ${{ github.sha }}
       version: ${{ needs.check-changes.outputs.nightly_version }}
@@ -272,6 +279,35 @@ jobs:
             --repo "GCWing/BitFun" \
             --out linux-release-assets/linux-binaries.json
 
+      # The Tauri bundler signs the five updater artifacts during `tauri build`,
+      # but the installers people download by hand from the release page — dmg,
+      # deb, rpm, the Windows installer and the direct AppImages — shipped with
+      # no signature at all. Sign them with the same key so every published
+      # artifact is verifiable. (This is not OS-level code signing: Gatekeeper
+      # and SmartScreen still need Apple/Authenticode certificates.)
+      - name: Sign installer packages
+        shell: bash
+        env:
+          BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+        run: |
+          set -euo pipefail
+          mapfile -t assets < <(
+            find release-assets -type f \
+              \( -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' \
+                 -o -name '*.dmg' -o -name '*bitfun-installer.exe' \) | sort
+          )
+          if [[ "${#assets[@]}" -eq 0 ]]; then
+            echo "No installer packages found to sign."
+            exit 0
+          fi
+          bash scripts/sign-release-assets.sh "${assets[@]}"
+
+          # Publish the public key alongside the signatures: a signature nobody
+          # can fetch a key for is not verifiable.
+          printf '%s' "${BITFUN_SIGNING_PUBKEY}" | base64 -d >release-assets/minisign.pub
+
       - name: Create nightly release
         uses: softprops/action-gh-release@v3
         with:
@@ -292,8 +328,11 @@ jobs:
             release-assets/**/*.dmg
             release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
+            release-assets/**/*.sig
+            release-assets/minisign.pub
             linux-release-assets/bitfun-cli-*.tar.gz
             linux-release-assets/bitfun-cli-*.tar.gz.sha256
             linux-release-assets/bitfun-relay-server-*.tar.gz
             linux-release-assets/bitfun-relay-server-*.tar.gz.sha256
+            linux-release-assets/*.tar.gz.sig
             linux-release-assets/linux-binaries.json

scripts/core-boundaries/rules/feature-rules.mjs

@@ -94,7 +94,10 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'oxc', ownerFeatures: ['canvas-runtime'] },
       { depName: 'qrcode', ownerFeatures: ['remote-connect'] },
       { depName: 'rand', ownerFeatures: ['mcp', 'remote-connect', 'remote-ssh-concrete'] },
-      { depName: 'reqwest', ownerFeatures: ['announcement', 'browser-control', 'debug-log', 'mcp', 'miniapp-runtime', 'remote-connect', 'review-platform', 'speech', 'web-tools'] },
+      // remote-ssh-concrete: one-click relay deploy fetches the signed release
+      // checksum over HTTPS and verifies it on this device, because the target
+      // server has no minisign and no trust root of its own.
+      { depName: 'reqwest', ownerFeatures: ['announcement', 'browser-control', 'debug-log', 'mcp', 'miniapp-runtime', 'remote-connect', 'remote-ssh-concrete', 'review-platform', 'speech', 'web-tools'] },
       { depName: 'rmcp', ownerFeatures: ['mcp'] },
       { depName: 'russh', ownerFeatures: ['remote-ssh-concrete'] },
       { depName: 'russh-keys', ownerFeatures: ['remote-ssh-concrete'] },

scripts/generate-linux-binaries-manifest.mjs

@@ -50,11 +50,19 @@ function asset(filename) {
   if (!fs.existsSync(checksumPath)) {
     throw new Error(`Required Linux checksum was not found: ${checksumPath}`);
   }
-  return {
+  const entry = {
     filename,
     url: `${releaseBase}/${filename}`,
     sha256Url: `${releaseBase}/${checksum}`,
   };
+  // Signature is optional: forks build without the release key. A checksum
+  // proves only that the transfer was intact, since whoever serves the archive
+  // serves the checksum too; the signature is what a mirror cannot forge.
+  const signature = `${filename}.sig`;
+  if (fs.existsSync(path.join(assetsDir, signature))) {
+    entry.sigUrl = `${releaseBase}/${signature}`;
+  }
+  return entry;
 }
 
 const manifest = {

scripts/linux-binaries-manifest.test.mjs

@@ -58,6 +58,50 @@ test('generates GitHub URLs for both Linux CLI and Relay architectures', () => {
   );
 });
 
+test('publishes sigUrl when a signature is present, omits it otherwise', () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'bitfun-linux-manifest-sig-'));
+  const assets = path.join(temp, 'assets');
+  const out = path.join(temp, 'linux-binaries.json');
+  fs.mkdirSync(assets);
+
+  for (const target of ['x86_64-unknown-linux-gnu', 'aarch64-unknown-linux-gnu']) {
+    for (const filename of [
+      `bitfun-cli-1.2.3-${target}.tar.gz`,
+      `bitfun-relay-server-${target}.tar.gz`,
+    ]) {
+      fs.writeFileSync(path.join(assets, filename), '');
+      fs.writeFileSync(path.join(assets, `${filename}.sha256`), '');
+    }
+  }
+  // Sign only the x86_64 CLI, so both branches are covered in one run.
+  fs.writeFileSync(
+    path.join(assets, 'bitfun-cli-1.2.3-x86_64-unknown-linux-gnu.tar.gz.sig'),
+    ''
+  );
+
+  const result = spawnSync(
+    process.execPath,
+    [
+      'scripts/generate-linux-binaries-manifest.mjs',
+      '--assets-dir', assets,
+      '--version', '1.2.3',
+      '--tag', 'v1.2.3',
+      '--repo', 'GCWing/BitFun',
+      '--out', out,
+    ],
+    { cwd: repoRoot, encoding: 'utf8' }
+  );
+  assert.equal(result.status, 0, result.stderr);
+
+  const manifest = JSON.parse(fs.readFileSync(out, 'utf8'));
+  assert.match(
+    manifest.platforms['linux-x86_64'].cli.sigUrl,
+    /bitfun-cli-1\.2\.3-x86_64-unknown-linux-gnu\.tar\.gz\.sig$/
+  );
+  assert.equal(manifest.platforms['linux-x86_64'].relay.sigUrl, undefined);
+  assert.equal(manifest.platforms['linux-aarch64'].cli.sigUrl, undefined);
+});
+
 test('rejects versions whose build metadata GitHub would rewrite in asset names', () => {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'bitfun-linux-manifest-meta-'));
   const assets = path.join(temp, 'assets');
@@ -105,7 +149,41 @@ test('openbitfun sync mirrors both products and their checksums', () => {
 
   assert.match(syncScript, /linux-binaries\.json/);
   assert.match(syncScript, /for product in \("cli", "relay"\)/);
-  assert.match(syncScript, /for key in \("url", "sha256Url"\)/);
+  assert.match(syncScript, /for key in \("url", "sha256Url", "sigUrl"\)/);
   assert.match(syncScript, /OPENBITFUN_BASE_URL/);
   assert.match(syncScript, /WEBSITE_RELEASE_DIR.*linux-binaries\.json/);
 });
+
+test('Linux archives are mirrored before the much larger Desktop packages', () => {
+  const syncScript = fs.readFileSync(
+    path.join(repoRoot, 'scripts/openbitfun-release-sync.sh'),
+    'utf8'
+  );
+
+  const linuxCall = syncScript.indexOf('\n  mirror_linux_binaries\n');
+  const desktopLoop = syncScript.indexOf('Mirroring Desktop asset');
+  assert.ok(linuxCall > 0, 'mirror_linux_binaries must be called from main');
+  assert.ok(desktopLoop > 0, 'Desktop asset mirroring must still exist');
+  assert.ok(
+    linuxCall < desktopLoop,
+    'CLI/Relay archives must be mirrored first: Desktop packages are ~700MB per ' +
+      'release, and until the Linux assets land the mirror advertises a version ' +
+      'whose CLI/Relay bytes it cannot serve'
+  );
+});
+
+test('the mirror retains enough releases for older Desktop builds', () => {
+  const syncScript = fs.readFileSync(
+    path.join(repoRoot, 'scripts/openbitfun-release-sync.sh'),
+    'utf8'
+  );
+  const keep = /^KEEP_VERSIONS=(\d+)$/m.exec(syncScript);
+  assert.ok(keep, 'KEEP_VERSIONS must be set');
+  // One-click Relay deploy asks the mirror for the version baked into the
+  // running Desktop binary; too few kept versions sends older installs into a
+  // 20-minute source rebuild.
+  assert.ok(
+    Number(keep[1]) >= 4,
+    `KEEP_VERSIONS must retain several releases, got ${keep[1]}`
+  );
+});