Electron main process only. It uses node:crypto and node:fs; a bundler that pulls it into a renderer will either fail the build or, worse, substitute a polyfill and sign with the wrong bytes. It does not import electron — sessions and paths are passed in, so the tests run without a browser and another runtime (Tauri, a plain Node host) can hold the same contract.

npm i @zero.sc/desktop

What it does

import { app, session } from 'electron';
import { join } from 'node:path';
import { loadIdentity, installSignedUa, verifyRelease, checkUpdate } from '@zero.sc/desktop';

const id = await loadIdentity(join(app.getPath('userData'), 'identity.json'), 'b');
// Every request to our own origin now says who this install is. Nothing else is touched.
installSignedUa(session.defaultSession, id, {
  serverUrl: 'https://beam.zero.sc',
  product: 'Beam',
  version: app.getVersion(),
});

Identity. One Ed25519 pair, made on first run, written with owner-only permissions. The public half is what a server stores; the private half never leaves the file and never crosses the bridge — a renderer asks for a signature and gets a signature, not a key. A reinstall makes a new one, which is intended: a wiped laptop is a laptop whose old key has nowhere left to be.

Signed User-Agent. The signature covers method and path — not host, not query. Proxies do not preserve those, and a signature over something the log does not keep is a signature that never verifies. If signing throws, the request still goes with the plain product UA: an unsigned request can do everything except download a binary, and a shell that cannot open its own page because a signature failed is worse than one that says who it is without proof.

Updates. verifyRelease checks the publisher's signature over the manifest body — the exact string that was signed, never a re-serialised copy. checkUpdate then returns one of three verdicts: none, page (the remote page moved; a reload is the whole update), or shell (the shell's own source changed, so there is a binary worth fetching). Telling those apart is the point: make someone download 90MB for a changed line of HTML and they turn updates off.

Downloading, opening, and installing are deliberately not here. That is the host's decision and its platform's rules — this package only says what is true.

API

| | | |---|---| | loadIdentity(file, kidPrefix?) | read or create this install's key | | signUa(id, method, path, fields) | the signed User-Agent string | | uaPayload(o) | the canonical string a verifier must rebuild | | parseSignedUa(ua) | pull kid/t/n/sig out, or null | | installSignedUa(session, id, opts) | scope the UA hook to one origin | | verifyRelease(release, publicKeys) | publisher signature over the manifest | | checkUpdate({ current, release }) | none · page · shell | | sha256Matches(bytes, expected) | the bytes you got are the bytes that were signed | | shellIdOf(sources) | hash of shell source, ignoring build-time stamps |

Keep the publisher's public keys compiled into the shell. Fetching them from the server means whoever takes the server can mint their own release, and then none of this verifies anything.

Where this sits

License

MIT OR the Zero License v1.0 — see LICENSE.