fix(release): install pinned Minisign binary

.github/workflows/release.yml

@@ -296,10 +296,22 @@ jobs:
           path: .artifacts/desktop-cli
           merge-multiple: true
 
-      - name: Install Minisign
+      - name: Install pinned Minisign
+        env:
+          MINISIGN_VERSION: "0.12"
+          MINISIGN_LINUX_SHA256: 9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73
         run: |
-          sudo apt-get update
-          sudo apt-get install -y minisign
+          ARCHIVE="$RUNNER_TEMP/minisign-linux.tar.gz"
+          BIN_DIR="$RUNNER_TEMP/minisign-bin"
+          curl --fail --location --retry 3 --silent --show-error \
+            "https://github.com/jedisct1/minisign/releases/download/${MINISIGN_VERSION}/minisign-${MINISIGN_VERSION}-linux.tar.gz" \
+            --output "$ARCHIVE"
+          printf '%s  %s\n' "$MINISIGN_LINUX_SHA256" "$ARCHIVE" | sha256sum --check --strict -
+          mkdir -p "$BIN_DIR"
+          tar -xzf "$ARCHIVE" -C "$BIN_DIR" --strip-components=2 minisign-linux/x86_64/minisign
+          chmod 0755 "$BIN_DIR/minisign"
+          echo "$BIN_DIR" >> "$GITHUB_PATH"
+          "$BIN_DIR/minisign" -v
 
       - name: Require protected signing configuration
         run: |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verboo/code",
-  "version": "0.15.9",
+  "version": "0.15.10",
   "description": "Verboo Code — coding agent for the Verboo platform",
   "type": "module",
   "bin": {

scripts/desktop-release/contract.test.ts

@@ -60,6 +60,11 @@ describe('desktop CLI release contract', () => {
     expect(releaseWorkflow).toContain("github.repository == 'verbeux-ai/code'")
     expect(releaseWorkflow).toContain('VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64')
     expect(releaseWorkflow).toContain('VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY')
+    expect(releaseWorkflow).toContain('MINISIGN_VERSION: "0.12"')
+    expect(releaseWorkflow).toContain(
+      '9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73',
+    )
+    expect(releaseWorkflow).not.toContain('apt-get install -y minisign')
     expect(releaseWorkflow).toContain('gh release upload')
     expect(releaseWorkflow).not.toContain('--clobber')
     expect(pullRequestWorkflow).not.toContain('gh release upload')