feat(security): release v0.7.0 with comprehensive security hardening (S-01 to S-11)

scripts/package-release-linux.ps1

@@ -106,6 +106,22 @@ $AllLines += "$ElfHash  sanctum"
 
 $AllLines | Set-Content -Path $ChecksumFile -Encoding utf8
 
+# Minisign Signatur aktualisieren (S-02)
+Write-Host "`nSigniere aktualisierte Pruefsummen mit Minisign..." -ForegroundColor Yellow
+$MinisignExe = "C:\Users\pansih\AppData\Local\Microsoft\WinGet\Packages\jedisct1.minisign_Microsoft.Winget.Source_8wekyb3d8bbwe\minisign-win64\x86_64\minisign.exe"
+$KeyFile = Join-Path $ProjectRoot "sanctum-release.key"
+$SigFile = Join-Path $DistDir "SHA256SUMS.txt.minisig"
+
+if (Test-Path $KeyFile) {
+    if (Test-Path $MinisignExe) {
+        if (Test-Path $SigFile) { Remove-Item $SigFile -Force }
+        & $MinisignExe -S -s $KeyFile -m $ChecksumFile -W -x $SigFile
+        if ($LASTEXITCODE -eq 0 -and (Test-Path $SigFile)) {
+            Write-Host "[OK] Minisign-Signatur aktualisiert: dist\SHA256SUMS.txt.minisig" -ForegroundColor Green
+        }
+    }
+}
+
 $TarSizeMB = [math]::Round((Get-Item $TarGzFile).Length / 1MB, 2)
 $ElfSizeMB = [math]::Round((Get-Item $BinaryPath).Length / 1MB, 2)
 
@@ -116,4 +132,7 @@ Write-Host "  Archiv:        $TarGzFile ($TarSizeMB MB)"
 Write-Host "  TAR SHA-256:   $TarHash"
 Write-Host "  ELF SHA-256:   $ElfHash"
 Write-Host "  Checksum-File: $ChecksumFile"
+if (Test-Path $SigFile) {
+    Write-Host "  Minisign Sig:  $SigFile"
+}
 Write-Host "`nBereit fuer Gitea Release."

scripts/package-release.ps1

@@ -101,6 +101,29 @@ $AllLines | Set-Content -Path $ChecksumFile -Encoding utf8
 
 Write-Host "[OK] Pruefsummen in SHA256SUMS.txt gespeichert." -ForegroundColor Green
 
+# 5. Minisign Signatur generieren (S-02)
+Write-Host "`n[5/5] Signiere Pruefsummen mit Minisign..." -ForegroundColor Yellow
+$MinisignExe = "C:\Users\pansih\AppData\Local\Microsoft\WinGet\Packages\jedisct1.minisign_Microsoft.Winget.Source_8wekyb3d8bbwe\minisign-win64\x86_64\minisign.exe"
+$KeyFile = Join-Path $ProjectRoot "sanctum-release.key"
+$SigFile = Join-Path $DistDir "SHA256SUMS.txt.minisig"
+
+if (Test-Path $KeyFile) {
+    if (Test-Path $MinisignExe) {
+        if (Test-Path $SigFile) { Remove-Item $SigFile -Force }
+        & $MinisignExe -S -s $KeyFile -m $ChecksumFile -W -x $SigFile
+        if ($LASTEXITCODE -eq 0 -and (Test-Path $SigFile)) {
+            Write-Host "[OK] Minisign-Signatur erstellt: dist\SHA256SUMS.txt.minisig" -ForegroundColor Green
+        } else {
+            Write-Error "Minisign-Signierung fehlgeschlagen!"
+            exit 1
+        }
+    } else {
+        Write-Warning "minisign.exe nicht gefunden ($MinisignExe). Signatur wurde uebersprungen."
+    }
+} else {
+    Write-Warning "sanctum-release.key nicht gefunden ($KeyFile). Signatur wurde uebersprungen."
+}
+
 # Abschluss-Zusammenfassung
 $ZipSize = (Get-Item $ZipFile).Length / 1MB
 Write-Host "`n============================================================" -ForegroundColor Green
@@ -110,4 +133,7 @@ Write-Host "  Archiv:        dist\$PackageName.zip ($([math]::Round($ZipSize, 2)
 Write-Host "  ZIP SHA-256:   $ZipHash"
 Write-Host "  EXE SHA-256:   $ExeHash"
 Write-Host "  Checksum-File: dist\SHA256SUMS.txt"
+if (Test-Path $SigFile) {
+    Write-Host "  Minisign Sig:  dist\SHA256SUMS.txt.minisig"
+}
 Write-Host "`nBereit fuer Gitea Release / Verteilung.`n"

scripts/publish-release.ps1

@@ -155,8 +155,10 @@ Upload-ReleaseAsset -FilePath $LinuxTar -AssetName "sanctum-$TagName-linux-x86_6
 $LinuxElf = Join-Path $ProjectRoot "target\x86_64-unknown-linux-musl\release\sanctum"
 Upload-ReleaseAsset -FilePath $LinuxElf -AssetName "sanctum"
 
-# SHA256SUMS.txt hochladen
+# SHA256SUMS.txt & Minisign-Signatur hochladen
 Upload-ReleaseAsset -FilePath $ChecksumFile -AssetName "SHA256SUMS.txt"
+$SigFile = Join-Path $DistDir "SHA256SUMS.txt.minisig"
+Upload-ReleaseAsset -FilePath $SigFile -AssetName "SHA256SUMS.txt.minisig"
 
 
 Write-Host "`n============================================================" -ForegroundColor Green