From 6abd3323d2780900803bf4926e0c3b803e5446ae Mon Sep 17 00:00:00 2001 From: Maxim Shulga Date: Sun, 2 Aug 2026 16:07:18 -0700 Subject: [PATCH] Reconcile the improvement plan with the AppImage change The signature acceptance criterion assumed the signed APT repository. Upstream ships a bare AppImage with no digest or signature, so as written it could never be met and would block the release gate indefinitely. State what the build actually enforces, and track the weakened supply chain as its own item rather than only a note. --- IMPROVEMENTS.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md index faabe81..960eaf0 100644 --- a/IMPROVEMENTS.md +++ b/IMPROVEMENTS.md @@ -23,12 +23,17 @@ exploit scenarios are discussed in public issues. expected subcommands, and record the installed version from the package manager instead. - [ ] Scan the resulting image and review every high or critical finding. +- [ ] Establish a stronger trust anchor for the AppImage than a self-derived + checksum: an upstream digest or signature, or a verified artifact mirrored + somewhere we control. Acceptance criteria: - A clean `docker build --no-cache .` succeeds in CI. - The installed Seafile version is explicit and current. -- A missing or invalid artifact signature fails the build. +- An invalid artifact checksum fails the build. Upstream publishes no signature + for the AppImage, so signature verification is not achievable from this + source. ### Remove shell and path injection risks @@ -180,7 +185,7 @@ Acceptance criteria: ### Improve the public project page -- [ ] Link directly to the Docker Hub image near the top of `README.md`. +- [x] Link directly to the Docker Hub image near the top of `README.md`. - [ ] Add CI, release, Docker pulls, and license badges after the checks are trustworthy. - [ ] Add a short architecture and process-lifecycle section.