Two download-trust gaps from #90.
A repo rename in the release feed only had to look like owner/name, so
a compromised feed could send an app's downloads, or the launcher's own
self-update, to another account's repository with matching links and
checksums, and every check would vouch for them. A rename now has to
stay under `catalog::GITHUB_OWNER` (storytold) at both ends, or it is
dropped and the feed's entry stops matching, so GitHub decides as before.
A release with neither a per-file digest nor a SHA256SUMS.txt line was
still installed, checked by size only, with a note after the fact; a
same-length altered file would have passed. `install::download` now
refuses it before fetching anything, with an error that says why. With
a checksum always in hand, the size-only path goes: `http::download`
takes the SHA-256 as `&str`, and `Verified` and `keep_download` are
removed.
Tests: a rename within storytold is followed, one out of it is dropped
in either direction, and a release without a checksum fetches nothing
and never reaches the installer.
Fixes#90
Co-authored-by: YangXZ2008 <141027290+YangXZ2008@users.noreply.github.com>
Every dialog shared one egui area id, "dialog". egui lays an area out in
the size it had the frame before, and the uninstall prompt's button row
was a right-to-left layout placed straight in the column, which fills
whatever height is left. So after Settings or the release notes had been
open, the prompt came up as tall as they were, with its buttons floating
in the middle, and never shrank back.
- Each dialog gets its own area id (`Dialog::key`), so a small prompt
starts from its own size, and so does each feed alert.
- The uninstall prompt's and the feed alert's button rows sit in
`ui.horizontal` like the other dialogs' rows, so they take only a
row's height.
- A UI test opens Settings, closes it, opens the uninstall prompt and
checks the buttons follow the text (they sat 243 px below it before).
Fixes#88
Co-authored-by: YangXZ2008 <141027290+YangXZ2008@users.noreply.github.com>
XianZheYangandYangXZ2008