v0.0.24 - Fix stale release installs by validating installer version and hardening release artifact build/version checks

Dockerfile.alpine-musl

@@ -80,6 +80,7 @@ RUN ARCH="$(uname -m)"; \
       /build/src/transport_frame.c \
       /build/src/key_store.c \
       /build/src/socket_name.c \
+      /build/src/auth_envelope.c \
       "$NOSTR_LIB" \
       -o /build/nsigner_static \
       $(pkg-config --static --libs libcurl openssl) \

increment_and_push.sh

@@ -153,14 +153,42 @@ git_commit_and_push_no_tag() {
     git push origin "$NEW_VERSION" || git push --force origin "$NEW_VERSION"
 }
 
+verify_binary_version() {
+    local bin_path="$1"
+    local expected="$2"
+
+    if [[ ! -x "$bin_path" ]]; then
+        print_error "Binary not found or not executable: $bin_path"
+        return 1
+    fi
+
+    local got
+    got="$($bin_path --version 2>/dev/null | awk '{print $2}')"
+    if [[ "$got" != "$expected" ]]; then
+        print_error "Binary version mismatch for $(basename "$bin_path"): expected $expected, got ${got:-<unknown>}"
+        return 1
+    fi
+
+    return 0
+}
+
 build_release_binary() {
     if [[ ! -f "build_static.sh" ]]; then
         print_error "build_static.sh not found"
         return 1
     fi
 
+    # Prevent stale artifacts from previous builds being uploaded.
+    rm -f build/nsigner_static_x86_64 build/nsigner_static_arm64
+
     ./build_static.sh > /dev/null 2>&1 || return 1
+    verify_binary_version "build/nsigner_static_x86_64" "$NEW_VERSION" || return 1
+
     ./build_static.sh --arch arm64 > /dev/null 2>&1 || print_warning "ARM64 build failed (continuing)"
+    if [[ -x "build/nsigner_static_arm64" ]]; then
+        verify_binary_version "build/nsigner_static_arm64" "$NEW_VERSION" || return 1
+    fi
+
     return 0
 }
 
@@ -253,9 +281,12 @@ main() {
             git tag "$NEW_VERSION" > /dev/null 2>&1
         fi
 
-        git_commit_and_push_no_tag
+        if ! build_release_binary; then
+            print_error "x86_64 release build failed; aborting release before push/upload"
+            exit 1
+        fi
 
-        build_release_binary || print_warning "x86_64 build failed"
+        git_commit_and_push_no_tag
 
         local binary_path_x86="build/nsigner_static_x86_64"
         local binary_path_arm64="build/nsigner_static_arm64"

install_qube_fips_nsigner.sh

@@ -110,6 +110,32 @@ download_nsigner_asset_url() {
     | head -n1 || true
 }
 
+verify_installed_version() {
+  local expected="$1"
+  local got_line=""
+  local got_ver=""
+
+  if [[ ! -x "${PREFIX_BIN}/nsigner" ]]; then
+    err "Installed binary missing: ${PREFIX_BIN}/nsigner"
+    exit 1
+  fi
+
+  got_line="$("${PREFIX_BIN}/nsigner" --version 2>/dev/null || true)"
+  got_ver="$(printf '%s\n' "${got_line}" | awk '{print $2}')"
+
+  if [[ -z "${got_ver}" ]]; then
+    err "Could not determine installed n_signer version from: ${got_line}"
+    exit 1
+  fi
+
+  if [[ "${got_ver}" != "${expected}" ]]; then
+    err "Downloaded binary version mismatch: expected ${expected}, got ${got_ver}"
+    err "Release asset appears stale or mislabeled."
+    err "Use NSIGNER_BINARY_URL to pin a known-good binary, or wait for a rebuilt release artifact."
+    exit 1
+  fi
+}
+
 install_nsigner() {
   local release_page=""
 
@@ -137,6 +163,8 @@ install_nsigner() {
     curl -fL -o "${PREFIX_BIN}/nsigner" "${asset_url}"
   fi
   chmod 0755 "${PREFIX_BIN}/nsigner"
+
+  verify_installed_version "${NSIGNER_VERSION}"
   log "Installed ${PREFIX_BIN}/nsigner from release binary"
 }
 

src/main.c

@@ -468,8 +468,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 22
-#define NSIGNER_VERSION "v0.0.22"
+#define NSIGNER_VERSION_PATCH 24
+#define NSIGNER_VERSION "v0.0.24"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */