Release-pipeline supply-chain hardening from the audit (F15-3/4, F15-6):
- appimagetool: stop fetching the moving "continuous" AppImageKit tag and
running it unverified on the release builder. Pin appimagetool 1.9.0 and
verify its SHA-256 (46fdd785…83d1) before exec, refusing to package on
mismatch; a system-installed appimagetool (maintainer's own) is still used
as-is. Applied in both build.sh and scripts/create-appimage.sh.
- setup.sh --sapling: the z.cash param download is plain HTTPS with no
signature; verify both params against their fixed canonical SHA-256 (the
same values already pinned in build-lite-backend-artifact.sh) and delete
the file on mismatch.
All three scripts pass bash -n.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
DanSandClaude Fable 5
c6bd4eb733