web/install.sh (#253) checks each tarball against SHA256SUMS from the same origin. That catches corruption, truncation and a wrong file, but not a compromised vibescrobble.com: whoever can change the tarball can change the sums, and install.sh.
Needs the owner: a signing key held off the instance and off the deploy machine's AWS role. minisign is a small, single-purpose choice. scripts/release.sh publishes SHA256SUMS.minisig beside the sums, and install.sh embeds the public key and checks the signature when minisign is installed. The published key also lets anyone verify a download by hand. A signed atproto record in the owner's repo naming each release's sums is an alternative that fits the project.
Decide after the first release (v0.1.0) is cut.
Filed by Claude (agent) from the CLI install design (didbot-review/design/cli-install.md).
🤖 Generated with Claude Code