From 614363f93ab6efb9b7d1dd84623252ba6b106741 Mon Sep 17 00:00:00 2001
From: Pedro Ivo <ivo@verbeux.com.br>
Date: Sat, 8 Aug 2026 18:54:17 -0300
Subject: [PATCH] fix(release): install pinned minisign binary

---
 .github/workflows/release.yml            | 18 +++++++++++++++---
 package.json                             |  2 +-
 scripts/desktop-release/contract.test.ts |  5 +++++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7faf378c09..6a970887fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -296,10 +296,22 @@ jobs:
           path: .artifacts/desktop-cli
           merge-multiple: true
 
-      - name: Install Minisign
+      - name: Install pinned Minisign
+        env:
+          MINISIGN_VERSION: "0.12"
+          MINISIGN_LINUX_SHA256: 9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73
         run: |
-          sudo apt-get update
-          sudo apt-get install -y minisign
+          ARCHIVE="$RUNNER_TEMP/minisign-linux.tar.gz"
+          BIN_DIR="$RUNNER_TEMP/minisign-bin"
+          curl --fail --location --retry 3 --silent --show-error \
+            "https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz" \
+            --output "$ARCHIVE"
+          printf '%s  %s\n' "$MINISIGN_LINUX_SHA256" "$ARCHIVE" | sha256sum --check --strict -
+          mkdir -p "$BIN_DIR"
+          tar -xzf "$ARCHIVE" -C "$BIN_DIR" --strip-components=2 minisign-linux/x86_64/minisign
+          chmod 0755 "$BIN_DIR/minisign"
+          echo "$BIN_DIR" >> "$GITHUB_PATH"
+          "$BIN_DIR/minisign" -v
 
       - name: Require protected signing configuration
         run: |
diff --git a/package.json b/package.json
index 29c528e7b1..5d87082151 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@verboo/code",
-  "version": "0.15.9",
+  "version": "0.15.10",
   "description": "Verboo Code — coding agent for the Verboo platform",
   "type": "module",
   "bin": {
diff --git a/scripts/desktop-release/contract.test.ts b/scripts/desktop-release/contract.test.ts
index 3a8acb0419..2dbeb66fa0 100644
--- a/scripts/desktop-release/contract.test.ts
+++ b/scripts/desktop-release/contract.test.ts
@@ -60,6 +60,11 @@ describe('desktop CLI release contract', () => {
     expect(releaseWorkflow).toContain("github.repository == 'verbeux-ai/code'")
     expect(releaseWorkflow).toContain('VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64')
     expect(releaseWorkflow).toContain('VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY')
+    expect(releaseWorkflow).toContain('MINISIGN_VERSION: "0.12"')
+    expect(releaseWorkflow).toContain(
+      '9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73',
+    )
+    expect(releaseWorkflow).not.toContain('apt-get install -y minisign')
     expect(releaseWorkflow).toContain('gh release upload')
     expect(releaseWorkflow).not.toContain('--clobber')
     expect(pullRequestWorkflow).not.toContain('gh release upload')