[kalfasyan]

Answers the installer and documentation points from the latest outside security review.

Pinned, checked installs

• install.sh no longer runs app installers from main. Instead it installs the release of each app pinned in the script.
  • It downloads each file into a scratch folder and checks it against the SHA-256 written in the installer.
  • On a mismatch it stops before running anything.
  • I tested both outcomes: all Flowy files download and check out, and a wrong hash stops the install.
• scripts/pin-apps.sh rewrites the list after an app's release, and --check verifies it.
  • CI runs the check on every PR, every push and every Monday.
  • It also notes when an app has a newer release than the one pinned.
• Pinned now: Splitwiz v1.0.0, should-we v2.2.0, Flowy v1.0.0, Troye v0.1.0, Shoppa v0.1.0 and Calio v0.1.0.

The installer as a signed release

• release.yml, started by hand with gh workflow run release.yml -f version=v1.0.0, does the following:
  • re-checks the pins
  • publishes install.sh, selfhostit and SHA256SUMS in one release (the repos have immutable releases on, so the files go in at creation)
  • attests both scripts
• The docs now install from https://github.com/selfhostit/docs/releases/latest/download/install.sh. That URL works only after the first release is published, so run the workflow right after merging.

security.md

• The reporting route with response times, matching the new SECURITY.md in every app.
• A new "Sign-in, sessions and logs" section, checked against PocketBase v0.40 and the apps' code:
  • passwords are stored as bcrypt hashes
  • tokens live in localStorage and expire after 5 days, with renewal in the plasto apps and none in Splitwiz
  • changing your password or email signs out every device
  • request logs are kept 5 days and don't include request bodies
• The security scans and GitHub protections, the containers' user and read-only filesystem, and the remaining trust caveats.
• "What needs sudo", item by item.
• How to verify the installer (gh attestation verify or SHA256SUMS).
• "Not done yet" now lists only sign-out-everywhere, Scorecard and an independent review.

Updates and backups

• An encrypted backup example with age.

---

Generated by Claude Code