nostrvpn checkpoint

docker/ashigaru-terminal/artifacts/ashigaru_terminal_v1.0.0_signed_hashes.txt

@@ -0,0 +1,43 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+Linux (Intel/AMD): Ubuntu/Debian
+File name: ashigaru_terminal_v1.0.0_amd64.deb
+SHA-256 Hash of file: 15081f7f3957b2d60abf1f5c0dc5435d09e3387636b44215688dac2d01b4334f
+
+Linux (Intel/AMD): Standalone
+File name: ashigaru_terminal_v1.0.0_x86_64.tar.gz
+SHA-256 Hash of file: f0bb53055ac9a0f7712e0de09a08f0acf8aeda59332fff681e0480eae1a744d7
+
+Linux (Intel/AMD): Redhat/CentOS
+File name: ashigaru_terminal_v1.0.0_x86_64.rpm
+SHA-256 Hash of file: b98c58c389f1124dd26ae0ca5bacc46da5f4c5d98af4e4b64a3a18d2358c4da8
+
+MacOS (Apple M-series)
+File name: ashigaru_terminal_v1.0.0_macos_aarch64.dmg
+SHA-256 Hash of file: ca85bed92c7281490b08ba2a524e1e595be8531bd8e5a8f7fed2f44403225ac6
+
+MacOS (Intel): 11+
+File name: ashigaru_terminal_v1.0.0_macos_x86_64.dmg
+SHA-256 Hash of file: 8a67dff12c9c0dafdb175134a4fc73558d71e4bebbc3aafd43d21a8e322ef5d4
+
+Windows 10+
+File name: ashigaru_terminal_v1.0.0_windows.zip
+SHA-256 Hash of file: 771a6efe91f5eafa22715e6a1f93e8cdfaca3447a1a4c733906f49e95de4db96
+
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEERF+AeZb3BYa3Fce4oTgGsfoqZ2sFAmhYRNcACgkQoTgGsfoq
+Z2s6dhAA5aSK2jkzCuqTjRgeac7UpPwav2eA5w7VJeRHlauL+w69l/fiW6hZtey7
+8bKxC6CMaEUtydyvPJU2qyJKujE4sn/kl75/F2JAf0q5yNE0dZAKTgYTPnZ4XChD
+lI1ptXZ2/dDcxZU2YoNatNF0Ble48YsN/Te/zxyK5a1qtPxMVr/G2JRSLfUJrObp
+GWypPjyy1z+cWfNSOyW6ZhNBCHCr0Kff6VGWjIv6sXBJluay72AgylAMrnS/FWW9
+WAQRh3iCRsjXPHDuwlaNsfZ3k8ZRTnnq2HkbIxqDO12HRJnxFS9gbW97cB4fVeCi
+bEoTqCYBNQIBNaxKPZkMRVoaAUCdZ9ORXa2YH2316e3G8PC8Ir26yQnofB1UNdDc
+drVp5wffD7EP4Whn4shCYbaXxrdQMaHl+9WhP5CspX74B5Dzkh1a7X+F3qfDmRMN
++BHXFXCNAtpnNIhObp+aFrCGVsxxGNUuZ9/09nKsPG20BWHVNgtC/iyZmxFnpOMb
+Q3742Ad0T5gdEJRLU6hnI8iGulc3LVZ/er94uFCslcS1VP6ajR38ucscIMy3TnuA
+hWvfst9zsspi1rbvNaMWEI9lP7rAPwAC8ISJ7HuLPyFmKHIXw4Ftlrgo8mreFdRS
+OsOaEf0fyKNNgwrqswNCM9/falzbIUxQwVDYcmqYCveGmd33UkY=
+=iOWZ
+-----END PGP SIGNATURE-----

docker/nostr-vpn/Dockerfile

@@ -23,14 +23,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 # GitHub's anonymous smart-HTTP upload-pack refuses to fetch an arbitrary
-# SHA directly (only advertised refs) — fetch main by name and verify the
-# pinned commit is actually what we land on, so a force-push to main can't
-# silently swap out the reviewed code.
+# SHA directly (only advertised refs), and upstream has no release tags, so
+# a shallow fetch of master only works for as long as NVPN_COMMIT happens
+# to still be master's tip. It won't stay that way -- upstream is active
+# (moved at least once already since this was first pinned). Full fetch
+# instead of --depth 1: once NVPN_COMMIT is an ancestor rather than the
+# tip, only the full history makes it reachable at all, and the SHA check
+# still fails loudly rather than silently building whatever master has
+# drifted to.
 RUN git init -q . \
     && git remote add origin https://github.com/mmalmi/nostr-vpn.git \
-    && git fetch -q --depth 1 origin master \
-    && git checkout -q FETCH_HEAD \
-    && test "$(git rev-parse HEAD)" = "${NVPN_COMMIT}" \
+    && git fetch -q origin master \
+    && git checkout -q "${NVPN_COMMIT}" \
     && rm -rf .git
 
 FROM node:24-bookworm AS web-builder