fix(releases): harden compare and pin deploy helper toolchain by jkaczman · Pull Request #55 · secluso/core

jkaczman · 2026-04-11T00:10:05Z

A couple of fixes:

Harden release verification by validating manifest bin_path values in compare.bash. Prevents path traversal and misleading (cross-run) binary comparisons.
Make deploy builds more supply-chain-safe by pinning and verifying external helper tooling (linuxdeploy, AppRun, NSIS helper DLL, cargo-xwin, and the global pnpm tarball)
Stop enabling the motion AI telemetry/debug feature in the default Raspberry camera hub release.

…ebug exporter

jkaczman added 5 commits April 10, 2026 17:05

fix(releases): don't trust manifest bin_path in compare.bash

3478358

fix(deploy): pin and verify linuxdeploy helpers

a616193

fix(deploy): explicitly pin cargo-xwin version

672aa3b

fix(deploy): pin pnpm tarball integrity

7f1ae48

fix(releases): production releases should not include the motion-ai d…

5ca66a6

…ebug exporter

jkaczman requested a review from arrdalan April 11, 2026 00:10

Provide feedback