release: simplify unsigned installation

2026-09-01 00:10:35 +08:00
parent 12495fb6a4
commit 4434acf697
14 changed files with 130 additions and 93 deletions
@@ -104,7 +104,10 @@ export function loadConfig() {
    || "https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest";
  const updateAllowedHosts = csvEnv("TALLYNOTE_UPDATE_ALLOWED_HOSTS");
  const updatePublicKey = updatePublicKeyEnv();
-  const updateRequireSignature = booleanEnv("TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", updateStrategyRaw === "systemd");
+  // Public releases always require HTTPS, host allowlisting, and SHA-256.
+  // Detached signatures remain an opt-in hardening layer so a self-hosted
+  // public repository can use one-click updates without provisioning a key.
+  const updateRequireSignature = booleanEnv("TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", false);
  if (!(updateStrategyRaw === "disabled" || updateStrategyRaw === "systemd")) {
    throw new Error("TALLYNOTE_UPDATE_STRATEGY 必须是 disabled 或 systemd");
  }