Two small supply-chain gaps found while dogfooding 0.2.1 on Linux:
1. No checksums published with releases. The 0.2.1 release ships three binaries (x86_64 AppImage, aarch64 AppImage, aarch64 dmg) and no .sha256 / CHECKSUMS.txt. A user has no way to verify a 262 MB download. I fell back to comparing byte size against the GitHub API (275585528 — matched), which is not a real integrity check.
2. Catalog packages install unsigned, and the warning is log-only. The official logos-repo.json declares "trustedSigners": [], so nothing in the catalog is signed. Install proceeds regardless, and the only signal is in the log file:
[warning] [package_manager] Warning: Package is unsigned: /tmp/blockchain_module-0.2.0.lgx
[warning] [package_manager] Warning: Package is unsigned: /tmp/blockchain_ui-0.2.0.lgx
Nothing surfaces in the UI.
Neither blocked anything for me — flagging while they're cheap to fix, since the module path is about to be the recommended route for non-technical node operators.
Two small supply-chain gaps found while dogfooding 0.2.1 on Linux:
1. No checksums published with releases. The 0.2.1 release ships three binaries (x86_64 AppImage, aarch64 AppImage, aarch64 dmg) and no
.sha256/CHECKSUMS.txt. A user has no way to verify a 262 MB download. I fell back to comparing byte size against the GitHub API (275585528— matched), which is not a real integrity check.2. Catalog packages install unsigned, and the warning is log-only. The official
logos-repo.jsondeclares"trustedSigners": [], so nothing in the catalog is signed. Install proceeds regardless, and the only signal is in the log file:Nothing surfaces in the UI.
Neither blocked anything for me — flagging while they're cheap to fix, since the module path is about to be the recommended route for non-technical node operators.