release: simplify unsigned installation

server/cli/update.ts

@@ -400,7 +400,7 @@ export async function main(config: AppConfig = loadConfig()): Promise<void> {
       ...(deferCompletion ? { deferCompletion: true } : {}),
       ...(request ? { jobId: request.jobId } : {}),
       publicKey: config.updatePublicKey,
-      requireSignature: request ? true : config.updateRequireSignature,
+      requireSignature: config.updateRequireSignature,
       sqlite: database.sqlite,
     });
     console.log(`更新完成：${result.version}`);

server/config.ts

@@ -104,7 +104,10 @@ export function loadConfig() {
     || "https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest";
   const updateAllowedHosts = csvEnv("TALLYNOTE_UPDATE_ALLOWED_HOSTS");
   const updatePublicKey = updatePublicKeyEnv();
-  const updateRequireSignature = booleanEnv("TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", updateStrategyRaw === "systemd");
+  // Public releases always require HTTPS, host allowlisting, and SHA-256.
+  // Detached signatures remain an opt-in hardening layer so a self-hosted
+  // public repository can use one-click updates without provisioning a key.
+  const updateRequireSignature = booleanEnv("TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", false);
   if (!(updateStrategyRaw === "disabled" || updateStrategyRaw === "systemd")) {
     throw new Error("TALLYNOTE_UPDATE_STRATEGY 必须是 disabled 或 systemd");
   }