Files
aiongg 2cf91e3c09 Packaging: pin the signing client and appimagetool, and check their hashes (#3731)
* Packaging: pin the Windows signing client and check its hash

* Packaging: pin appimagetool and check its hash

* Packaging: fail clearly when no pinned appimagetool exists for the architecture

riscv64 has no pinned appimagetool, so building its AppImage without APPIMAGETOOL or a tool
on PATH stopped on an unbound APPIMAGETOOL_SHA256 after a download attempt.

* Packaging: pin the AppImage runtime and check its hash

appimagetool otherwise downloads the type2-runtime continuous build and embeds it unchecked.
The script fetches release 20251108 by version, checks its SHA-256 on download and on every
run, and passes it with --runtime-file. An architecture with no pinned runtime exits with a
clear message.
2026-10-23 13:00:09 -04:00
..