Merge branch 'dev' into font_setting

.github/workflows/build.yml

@@ -112,7 +112,7 @@ jobs:
       shell: bash
 
   mac:
-    runs-on: macos-latest
+    runs-on: macos-13
 
     steps:
 

build/deps/.curlrc

@@ -0,0 +1,3 @@
+connect-timeout = 1
+max-time = 1
+retry = 0

build/deps/buskill.asc

@@ -0,0 +1,106 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF8EzWUBEADB6i1K7/TSr8ivgxAWWA7usOjeCDzYjmhG5FWtp3uU68vtMB77
+BwyzcACBfEMF+k2jgfE+KRwdIlsJXJXPmq5yRZHopMDUsrPTLs0KJ3vZkZl1z5Hu
+AkrK//VEFIRy8JzQiB+tih+kbToU/cTVjnsf8R0sa+/gmreshjE+85X3Y6sEV7HC
+19l/+9HvT+lD6ahagwyP8f/149xWM7h63L+t37TgaYuYt+CdyLfeEZmNLkIf+P/K
+qZMTocsQoNYrBkB9OVR0W2wusdqkNETIzuvLyCFDG6YCGhztsvCOp/YqlPfmBMP+
+0v6P7/Acq+99dLP7ca3XK3EwR7nKwH5Wlbb9FAB2gHiRlQRxqPelT6apZU7D9c19
+gz7fRdkZFHvdipBZZMMfoamP0kHpr8WJdxe7Sw4LUpg3wzNFEf54VKakUZX+EDUA
+e2e2AbVnW3CH6FE1Acm7AnyQddaudzGUskktoPWSK3aij/+heCbjADUxclR6B9GW
+uWHHsHVd/lvt+QvEpWhGqbth7YjlDLF7nPbqZWNVWvzQYllcbcCD08Ojj7BfEv/+
+I2oKDpR1sLLs+aQAn/isZ6YBM3xp1feamN1eqdJlG/NsmUk22X+08fAWG9XFszpH
+AuNWuMGfG5KYsUY3e3H3/IfW2hTOmAoTmdGpBZrcylvHXPsh4i3Wwtc7EQARAQAB
+tDpCdXNLaWxsIFJlbGVhc2VzIFNpZ25pbmcgS2V5IDIwMjAuMDcgPHJlbGVhc2Vz
+QGJ1c2tpbGwuaW4+iQI+BBMBAgAoBQJfBM1lAhsDBQkJZgGABgsJCAcDAgYVCAIJ
+CgsEFgIDAQIeAQIXgAAKCRBK4h4ZNs54aoHZEACAiEVwuyNQNuBmsRb+TtOoeh0G
+FPREYO7dkYevzqGGwzFDQ6d8baqgXZ6H2zaXU1n+RUekq1C/APmpkVpjlcXSQ1bO
+B+yQBrzHjYy2wpEmHjK1wGs8xNRMf0I3RTwZK0Vo3/yKBMMtk5XVvKI/yIIVUmvS
+Upx28EOb+ofQL6YyX0xEtm5YP5p7/Bx/JobNVy7oLrQVILI9DlU3Sf1IRQdRZZkq
+jwJECE50Q0dgTCUsF84eYsbw/mfQCaquCsIH/pd5HnjA6LFjiUYaMmSmH+yKt1yD
+BEEVt+z2zLCM/rcW/iw06F3WlTNI22LVR18Yd8guqpw6AtG+BDVxzucoF8w4oWis
+AYnAsHagmyTLSHMvubRWkHUXT6FNpO6V/xdKlG59Hqm49rSEB/0e+jhGV1ViVyQ6
+VEH8kXcSbAkeDwuWgwHYWt2I0C/JBhAe+YE4PtAQ0ES3b7u4PEkFD+EkXY3uxqTc
+X4LAsYQzsbgkodItvi/+TaEus+md+1CoCm05SBbFyjgiLytAz77Y3J5z4ll5CmSz
+mgQrtH9nAKGynmp7kp/xyzkW4WxEkQQkqfRgGNpaONKmtEkiAyjsknyjWyidR1PC
+p46wAMaebMDmIR1pCru6c4VCBDO0B+QZwfeND8hSibubRXzo76/JGmbQGID/qwD3
+yaU8FZmKAZzXXb02bIkBswQQAQoAHRYhBAU/swPQm9M4qVypk3iBoDbyHBX4BQJf
+BNOlAAoJEHiBoDbyHBX4OQQMANK8aMsgKfekl7pC7IkZOIwQZCo4t7W6Vykw3nAV
+aikXxtZt6Wkrnw9q+xG1XjFJ3jvSkfmfbW3HYtZYG1CILyUzMGWRQ3ceQcnfSXBZ
+klldt3pcw2Gx2gZ5zNPC7VgSuGbGRmplKTtZ+rG/+5h8q+DrXP1hj0DN4GRuNpi6
+3CC7KHyPvrMsuq7QkWTPz7zPvh0z5PDs9neV6zsOUskKQ6aMrbBLKx+b/cEizOaO
+0JHBnFUKkbCCNUjhK1kz/Rp/wjIkHy5NjYNpBcToHTkb3LUkVAP3YOLZdhhTcpih
+wnDfFS2O7ssA+1zAS7OI3QSRmUpz/+cm9fxCkCym0f9fEtIzi8/yOl45OcstfoSU
+em05NQF/YVW01QP3Bx5pBLIVHnQepjXxpx/J2BLwSI1t4JaSCD02QrozcM++1sYh
+jfuLOctuvFrHReEZ2zIPjp3GvbShtwUMiW2ihCPSohzO3xw7PEjOzoEOvZWvmKzj
+u+qA/9ZNed0taEPlDIs2veLLF4kCMwQQAQoAHRYhBARl5C9xIGeF6XJkTP4bhElO
+ZA1BBQJfBNPjAAoJEP4bhElOZA1Bft8QAKBg7V8rRq5ddyaiAVmVdYDaJdSh0AS7
+FJKblc/ee+2a6AjY9c/XElYyjtHiMO1xun1tEQh7wNIpwyb7z6NVRsQTDhXHt1ep
+GeMhsBJK5D4vH9Xf/RItvpC670tq31b/OGgzMv+dDtNFg3FEYjJ2ImX0g4opCe9/
+9cj0s8KmCKAMUNNSPiThXc9TzmNOybaPzDZuxsmMkpQlbvUFGaswRkyFINRq6pzh
+brqqO6Krt57jvjHHQtoVENsQCC9PhaYp60p3GuigTxB0k02mi9pOhwOvskFGBywy
+n3agTlWyb3PLbx+PPJio4LGe7McHEW+OgnK59fiwflCAzRsZupXnwh5ebxWiyw1B
+BCj6wuKMr8Guf2CF3j//XsclrvbcIi8iNuYa6TiBKWgv2U6nEbXgoSwOgktCGsUh
+A3xB5oMzn+SdnWk1nlYssnieO2s7Cz3gzbYl/ZNwdfP7Fb2l2pOcbaSMQSjc7D+t
+A2JF3o4YhUCEBbjfQT0tFdi575Gk1WcHmRK6GGnAJ2Ki160hz4s+sm9MdwrRzi58
+TR4yLyecjE3yAK4Q6/joLhZHpxaa7FmBvvL+Ry3HP90ypKufTslIsNWNL4p/4R+r
+mG77Yp2tIEE9oY1rASjjOHcHLKMkNYdsq/YWBsESC28uw0WgGIfgExlLGRxK7wUG
+RERpPvHi3tD+uQINBF8EzWUBEADA+QoxtW3klLSBPKX/Zm0GMvCOVzOHKtfpMGKa
+LkiGY0+8Td21ruYYvGisTRlHEIJiDjN13W6HhfXZUk5cVgDudqGqWNRQuPtyjHoE
+96LdtobJoXOpWhqXQJSUDPAJy3+JaM1vcXJXmaG1wyHqYVVi36MpPyS+mN1uqRw3
+hVISZj5TG/PsPhZwtM8NmhCtgfON5YtHT5B60iudvAKrR50R4iDzZ521ylASYcPb
+TlkB6Yz3d+FFM2IrCfeQ3voysw560rio3wWhMIfkBBQP4Kj5WXHr6y7QWvukfnbG
+54qCXyXMkts294sk6G9lwO7VDDc/zdZj6fqcNyqK4ey/yoH2dAT54ctrel4bQceh
+buCJBA0sllvb47aQ6faVEio9Dzt4Li5aEofLAN27M0wCJxY/daDZl5zP2nG5JtVb
+dvxE+u9uQ9ibGPzvMbNkfCUHlksq6YlTWT26n9j/oDDEpj7AT6QQB58E5s0FHgWE
+1OMAh7DnKZxYHipoQHIhmrc5Sex6f91buQ5araywxdDK8E7mZmGjXUgrtmeqoUDj
+1gaftzEWon+lxjly3zOqFQwBvDQRZ8ZtXWp1ULX0CMv86SxNlc2P7MsVSr+zIFFE
+LmQsDlDQ4Ov6NN0jv9aIlzKpa3IpBEOa6v3r7yCrJ40tbI5785Pjy3aI7/CZF7bI
+RQsXIQARAQABiQIlBBgBAgAPBQJfBM1lAhsMBQkJZgGAAAoJEEriHhk2znhqiGAP
+/iTZb5kYZfFPdXCEEQWuU8tOteTtZN4Y7iENZ4fe7QI5tJYCAaSdMXkJyW7mXD2o
+lQrVkdiUIMpOOFpVKCnoQjpvfhyRtUGBDrRKPrXvZP5FSGafmu4q96HQ7O36zy4m
+qibU1Zq4FXtJUjqkgFX6WOvKJOogaG8gl6n2CFw6O5jc+PMVh6GXg64pVIO5CJ+Y
+6D/S0N1GSDFKnShTK/sgOF8ZOpyn8CX55QkL20IhIdipNzhjmuizcrJ3WXcWyW6B
+Q5ye+F7n4wAjVt3/bGsjJ3POrjlutiv5dcHCXucYWz/+Gew/yUhl+HU5RgHzmnKS
+9rpTn25vGbkvmk9Pha1X+iKwqKLE3SpslF6zNJ2VBKgX6mTGWIf653Cqp2sQXtpr
+KIgr0Jy+TlmG1+b7q0reMgUT4+au2Zmq2tQmHhpjgnG9dXI6oF8KHtbRbfQ1289Z
+KrhJFdWSnGVrkt5d3J2C8H+lLvCGm/rxAGyrUE0JGUdrZAIWepc5DW1TqKCwK0ue
+skGOvvXqxBJ4o0U1RxcO++iU7PoUadjClG5zn8rLBkc7BwNMPtw93HUleioqWvc5
+BKwqOXWAFE2zwcDpw9mwMSJJ8xmkH0vn75KBih939DQeD0R21u8YE8BlMwSkfan9
+vRdz63ieT3Ed9ruegVq0SCQkArso3hRyjv2f/ZknpQq1uQINBF8Ez7cBEADguJIO
+IbRyQ7aDMI06Di8SspkolL4sYAndIUiAf5maZO2haSJqfCI+I0XkeB8x4T4SJmAo
+XsSvCeyqMt5xKqdjjhICzmbo2wmruS0GHYIiVv+Z/kpXN6jvpU67nD4MWfN6E3jc
+fWh5JgNFLNUXXycfnr+rjrNsxZKTySqMhXPhxQ+pp2XqlNv1k0UkjwC/al57dFQ8
+6BRbfmQn1of3y3MLizHyaNm9VJuDaLg+8JJWedPOC+DkZfws83Y50phDYjy8Ljfe
+6TecJvzxbBFc5bC7nvaLrjOp3Hz/A6aq0afpjXcEzoXb5UPzO1nRJKnByDj2DIEh
+rYeoDJ/WeYIcKI7gK98L0nagW44wg8YOg0xKXtsEdhic62dvIpvYnG353v90ZbJE
+Z6E5oEJ9QpC8xjwzs5U5mZIkSFnmveelytP0eUuhUj0C+a9O9uBEhN/fduFIO/HC
+RC0lFU2gL/kXQ7/u/59qfQx8gLztdmQeP1uyuqoPTRJKW7nHIsTXMV76LtbNbBV6
+t9t0FqWyQarqmUrqKREZ9+6c9k5hD/DXwRJHYY4bZv5x778SwZqUYJq2V/pL+Q+o
+wl32Kk4PshyZthXTvDXsFZibGzWg1KMnKIVDprRaeZ0h9VO5J2v+4maYhDtgksy1
+WTLyM5ybSanHuIRySvW2rI0F0OkUesuHQJ1HsQARAQABiQREBBgBAgAPBQJfBM+3
+AhsCBQkJZgGAAikJEEriHhk2znhqwV0gBBkBAgAGBQJfBM+3AAoJEGi4vLDFAjkF
+LHsP/258zkgV49QZ9g22LW0nDR5v6YE6+VEcIO7URB99E7tjLMn5GLr+gfpj3ehG
+dwNant/Xon+aAa0/p8TYfKzn/jBqT4pOJABCVGJVzvUrQcff/7236Uzdtum0GdlH
+Z889vSQ15ym/bdao8awVL7m98xe7j+1441aSTpPX6PgroCnFOBViq37qwMnn+CWc
+hB+rTASPTSPfTmHuBoAyk/vL3aWGGQw9/OOcjRNk93XJ6L6enCKX2zvKkIPp6SoI
+OR3HA3TdLXm1zjeAK9mjb1rmIUeHrnNiIc3T1/2hSYbYBuzf98vii7Ns7j0WJO0h
+GjzrFCtgGLxIi61MVc+li1VCkiFml6PLjyr1mVcl8tS9VCiKJJxM+4+651nA6p1+
+A+6JhTqSOwUWS+sEFywCB5UdhN6QzJi2hQQY6vLp6R0yqcn9KFAcxjp2XsgTslYZ
+T17E5byTdI2YnKFtqX2PsR6+hAkquFEVLcnOuRnYc5wTlxgYlr5TP2Oe8fSRQN6Z
+3SzCa8pPupEPxldKSCsj2RPwnlVyrbnHdEC5olzbrXDzDAurUt8l+QrDouf99jKL
+PZDqtmuMv0fdZVtG0H6MD7pygT4awM3t381+441FoeSgbubDA9T/WsZCWbNR59De
+slpoJkJBekDs/MNDHVMhAubrbwXGmgauLoNI/lB9zHE14O9NzdMP/ixxiRATXhHS
+TjmhNXyK3dWgEvMK82So45NderIzNeyPC/+SNnKYPd9ttl3kLzU//a9xCEPcG7Mt
+Zz6r/xBNpKUxx6HC4VU+HmjqGMirmYFHxxkvRPF3qcavRN9xSHKjdRq4NAjVqgmZ
+9xElqK2t0Nq0JvRuq5Q2nwgD7p31H4WmKd24Fn86jF+9RrCZpkfyQWt8gcE03Obm
+3x7I7ckXnf3qsrhnStseb2B4bpgK//t5hDEAW8L90RCwT6xnLJhWULOgOjrpwCeY
+fltvyRucPpbwnOlgNWs/v6GjGIInWH0zKQ1OfgqBy4lo9n7iZWHVd+vSydk2Jzmf
+zwAKJkin466/eo8v+UqE8itsiRTqr6C1tAyYgLpmz1knXQ73Rj9Ghg6X+XitVvCi
++Xyz1nxnm0fW7zfKFhogdPKPMUIfZXT9r6wQ/M/+dMgV7WFoEMCo6qXlppj+6j36
+W+LLXLYWG4L5q+oexvjFx+P+9+yN69iGHnkZL33fzUnS0fdImBMcR7XF9ZMiB81L
+RyQRqlO4A3E6pJHDYEPz+Cy2nU0ooSOWip9vtEMSqinnaR5pj+5MxuGvlRGnKr7b
+wlPVRfJeZhZKW15/lbpGtPDsHbhVh/xxzyFAiYAk1tEdcTKfMp/0wXYtD2ZqSMaM
+RbEzAj63WAwCiqKdyW+LjvcPiDZloWtE
+=MfmJ
+-----END PGP PUBLIC KEY BLOCK-----

build/deps/download.sh

@@ -45,13 +45,13 @@ ${PYTHON} -m pip install --upgrade pip==24.0
 ${PYTHON} -m pip download --no-cache-dir kivy==2.3.0 pyinstaller==6.5.0 altgraph==0.17.4 macholib==1.16.3 future==1.0.0 pefile==2023.2.7 pywin32-ctypes==0.2.2 setuptools==69.1.1 wheel==0.42.0 virtualenv==20.25.1
 
 # pip (platform-specific binaries/wheels)
-${WGET} `${CURL} -s https://pypi.org/simple/kivy/ | grep -oE 'https://.*Kivy-2.30-cp37-cp37m-win_amd64.whl#'`
+${WGET} `${CURL} -s https://pypi.org/simple/kivy/ | grep -oE 'https://.*Kivy-2.30-cp312-cp312-win_amd64.whl#'`
 ${WGET} `${CURL} -s https://pypi.org/simple/kivy/ | grep -oE 'https://.*Kivy-2.3.0-cp37-cp37m-macosx_10_9_x86_64.whl#'`
 ${WGET} `${CURL} -s https://pypi.org/simple/pypiwin32/ | grep -oE 'https://.*pypiwin32-223-py3-none-any.whl#'`
-${WGET} `${CURL} -s https://pypi.org/simple/pywin32/ | grep -oE 'https://.*pywin32-306-cp37-cp37m-win_amd64.whl#'`
-${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-sdl2/ | grep -oE 'https://.*kivy_deps.sdl2-0.7.0-cp37-cp37m-win_amd64.whl#'`
-${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-glew/ | grep -oE 'https://.*kivy_deps.glew-0.3.1-cp37-cp37m-win_amd64.whl#'`
-${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-angle/ | grep -oE 'https://.*kivy_deps.angle-0.4.0-cp37-cp37m-win_amd64.whl#'`
+${WGET} `${CURL} -s https://pypi.org/simple/pywin32/ | grep -oE 'https://.*pywin32-306-cp312-cp312-win_amd64.whl#'`
+${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-sdl2/ | grep -oE 'https://.*kivy_deps.sdl2-0.7.0-cp312-cp312-win_amd64.whl#'`
+${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-glew/ | grep -oE 'https://.*kivy_deps.glew-0.3.1-cp312-cp312-win_amd64.whl#'`
+${WGET} `${CURL} -s https://pypi.org/simple/kivy-deps-angle/ | grep -oE 'https://.*kivy_deps.angle-0.4.0-cp312-cp312-win_amd64.whl#'`
 
 # misc linux
 ${WGET} https://github.com/niess/python-appimage/releases/download/python3.12/python3.12.2-cp312-cp312-manylinux2014_x86_64.AppImage

build/deps/python-windows.asc

@@ -0,0 +1,53 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: https://keybase.io/stevedower
+Version: Keybase Go 1.0.11 (windows)
+
+xsFNBFUh1AUBEACdUPt6PwJVO23zGZqgtgBeA9JsO22dk3CMzrwPJdUmMd6mcRWa
+vl4BoAba66fuC17GvOgGXimKI+iaw5Vt9QI3uSjUjFSfc24J8T7NB/yAr/0zEcex
+raHD2dxT/JpE/iY0yWHxRlitvwGSw1Qlq3NnY8tDI1DJEJD+gBuCktvVvu1FfQTw
+6bd+aEq0c4sWJHAOnKLuLH0pNFOznnynAFGPGBBsm/YwYc5BP2JVvka775LUjA+W
+1h2Sgg3FAUPIm64pc4Pq6mUo6Tulw72xsWMpCL1/5atXNPXT6rJUOB8euTcNMr4l
+1O6GKSsiLeLAuvq4bmhOKtLzjWzXnY1gDVoOfdgpD6o4ZHk4xiVsdVE8hCa/ylz8
+1ZwRW2gGo2jP8t3hKciR2i+Qs+6lPNZpeFIxa6Uo9ER1IBgCHHapIR/UdcOFyoS0
+MNn7Ui7DLQNM4gI/G17eG9tfvjW2dl4SgFSYWMq/OtXnPDUBGqFUWsn8adOL2PFL
+B7kM5ZRTPc5SnY9hoSGa5E20rJZIXcpy1aygRz/xUjoKwNzAySSEyyIorUxZ8KaH
+EEBQSsqwe04MXIENqnDozH0/cvP4JXEDSl8EkzMSCWSoavQSIYD5pQppyFQpGHqa
+5CuOA25Ja+sgp2xqahtr3fEqZUknPQSoYlnJbaHnzsGSlRAVWMsklsZibQARAQAB
+zUBTdGV2ZSBEb3dlciAoUHl0aG9uIFJlbGVhc2UgU2lnbmluZykgPHN0ZXZlLmRv
+d2VyQG1pY3Jvc29mdC5jb20+wsFzBBMBCAAnBQJVIdQFCRD8YkZDSHA05QIbAwcL
+CQgHAwIBBhUIAgkKCwQWAgMBAAAeyhAAOjgznhaIkhWYZWbjvWSizp+YNUZ5519/
+/vUZR2srYXfYj1keluu0xTgSzIMsDrC0bS3ESUm/fJ4zjWoSdP3gN/D4p3/799E2
+58jZaNeY3EuhfXRRgXKkwXpgVBzIMYyUzg5XN7Sev1kSMlD3LeoEsVOFRruoJC2F
+J2VI9NTNO7dRO5QSqmagKoLa9S4KRSSHj4Gwxxa/HR6EijFvAui/O5juyF3zbt6L
+vSUaZyBFjO2cRW/rDzSh7kQlqAZqAWv+xKxHfktAUy0vBTN8qaUXhk+XDkmf98Uy
+Ocnj+Vo4GEM1OL0/LHJ77/2ATBmM+Jf6N5lCY/2Re6SsNzh9jKWLN6yflSr1j8Gl
+sbQnEg7p3VweBCJ6whZA5mZ9zwbzV8Zb3zua/B1n4kzW+WuuTL1JBloW+4NBreJG
+xStBj9kUvOuuHiG7Cv7Wn6ANLh8hRrIguqLt6U/FVfp5MU2/jbkwwy/eY8S7yqc7
+EuwFiuh537oi8lkIOcrhKzCv+XXFBxmtrGKmYO8T7CQ8vBIvNfmKTj46lVwwBp5U
+J8fMLPTLSDVHuWhe/MDmTCIiLR9apeqdnrbf3mWlCoqBx/KfaK4Whx6ahIX3ojJe
+EITwXqmeJX9AMGq8jp5hdxiaGBJ6OEeLkbKl7tks359V7wWPu2WfL0/L0tSTXd7C
+X65rUzwk+4XOwU0EVSHUBQEQALZp7GfQPKLySCfUZVniMpRIR0ckIn6s4HP6+dLg
+2VTwY3sDgOOti4x9/hesxRhJFPqtmqkntANEiTxf1oY+jDWFy6Im8YuQ+JhpKCGq
+PRMZ17eC1wHOqIEKWOrxUASVOTa/Fwnn0G5tJaGv6MubivCRy1gmdowKLLJ1acw8
+DXjdu/gfIefjon51oUAk7p9cc+RCYsnNMqAZn+Os35lOAjFAbD7613C5sOCd8Kd+
+apqx4NbTcj4Xe1QZYpDK4La1l/SGj2eNHZ6xhv1ozhWAdwisRm9KUwo+xguLm8aN
+rqXlmahy5nSFXOzc7H6fBHMCW04/o2dmX6uhfMvo3rG4IfAmsWJ+IRLNt2j2EauR
++P27lZmYVMN/wAC/WZsl+gLQENB5LVbUHu8pD+wy7BKXixvrzyRWN+t0Hg7Cx8Dq
+MZ2Unxs4lZQeDfyqiJIsTVnBUxvBkhNcynHSVTaFvtzAd/hbTGVlCYR9BcioOai2
+iQrQu2KOYLHXVPkAqk5+oHGQZzF+Y+C2gJluIYdUV338MLG374iuboV0AnlJ21Gq
+JInnrQ8eLOimsurfWoU0a9K/2d1Vs76/sQE8TVmc4sU3XswhjgdsnGdL6uGylwbj
+fAgMjsuV9YX+0XNQYgFUAiCxyQ7c9AJPx2segwGtgB58fWJboB0H9NNCq6CxGPhm
+samBABEBAAHCwV8EGAEIAAkFAlUh1AUCGwwACgkQ/GJGQ0hwNOUbchAAnThJhqJS
+9cRuiPpQ1XaLeqAWagvXtNtWi1qglKViRQ6dJtGk5gn5jiNYE2hY0nMYatVtBj1K
+CSlGYZN7ZVX3UgrVHJCPsblihH6iWLb1LU16SuIw3mmQaLydyjaSUSMp269eeusw
+kkCYR4ghlphPzOSjd4D7DkWwgUFxJDjUlbLJX9VpuuoVOrqkllGnHg/uH5eSwpW3
+JNQz1nIQD+/riyjxDrTkch+ikU4Cpe982KO8VNSuEDDf9WjI6Gz5Kjb75F51DcDu
+0DM9fDcflqj3OJLCYFtTtWj0Nqi/wEWOY2rWegQXe4srX8+3eiTodBTiJZoQam1n
+e3xBqy7EgPhIwRgcFuQZyDJsT9cYY4cK3CNfMvJACuVM3VtoW2wJXNq5bLsRHPsT
+mIfJBnHPpmdY/2jJ+IAC7E20jv9E/mCYXzgzZy9XQo+6D2yRpphuqW/6Oz+GswVF
+QvZRzrld15QD40picpZzbFe/j8cD5V5byoIeEuAuGT1HP4j3rbMV0dnY3HDqDcVV
+OAqiQamCoLpf6VKYV5Ie0HxCsh/uNlBE21YbLXQVVGsyeknlJ7/QpVQxrAhIXxGX
+zTpzqA8yRsQ3xEqAMO4ofdbyIU8hx7CvN6dhywzCz6bS88f9ABQX6OjFhhqXdkUp
+zFjW74efcIk4ZQ3iPg2rN5Z+Z7AKOu3TGHQ=
+=wMbA
+-----END PGP PUBLIC KEY BLOCK-----

build/linux/buildAppImage.sh

@@ -11,8 +11,8 @@ set -x
 #
 # Authors: Michael Altfield <[email protected]>
 # Created: 2020-05-30
-# Updated: 2024-03-06
-# Version: 1.2
+# Updated: 2024-03-22
+# Version: 1.3
 ################################################################################
 
 ################################################################################
@@ -112,6 +112,42 @@ else
 	${SUDO} apt-get -y install ${APT_PACKAGES}
 fi
 
+# get the app's dependencies
+tmpDir="`mktemp -d`" || exit 1
+pushd "${tmpDir}"
+git clone https://github.com/BusKill/buskill-app-deps.git
+
+mkdir gnupg
+chmod 0700 gnupg
+popd
+gpg --homedir "${tmpDir}/gnupg" --import "build/deps/buskill.asc"
+gpgv --homedir "${tmpDir}/gnupg" --keyring "${tmpDir}/gnupg/pubring.kbx" "${tmpDir}/buskill-app-deps/build/deps/SHA256SUMS.asc" "${tmpDir}/buskill-app-deps/build/deps/SHA256SUMS"
+
+# confirm that the signature is valid. `gpgv` would exit 2 if the signature
+# isn't in our keyring (so we are effectively pinning it), it exits 1 if there's
+# any BAD signatures, and exits 0 "if everything is fine"
+if [[ $? -ne 0 ]]; then
+	echo "ERROR: Invalid PGP signature!"
+	exit 1
+fi
+
+pushd "${tmpDir}/buskill-app-deps/build/deps"
+sha256sum --strict --check SHA256SUMS
+
+# confirm that the checksums of all the files match what's expected in the
+# the signed SHA256SUSM file.
+if [[ $? -ne 0 ]]; then
+	echo "ERROR: Invalid checksums!"
+	exit 1
+fi
+
+# copy all the now-verified files to our actual repo
+popd
+cat "${tmpDir}/buskill-app-deps/build/deps/SHA256SUMS" | while read line; do
+	file_path="${tmpDir}/buskill-app-deps/build/deps/$(echo $line | cut -d' ' -f2)"
+	cp ${file_path} build/deps/
+done
+
 #################
 # FIX CONSTANTS #
 #################

build/linux/debianWrapper.sh

@@ -18,6 +18,10 @@ set -x
 # SETTINGS #
 ############
 
+# WARNING: If you update this then you *must* update build/deps/docker.io
+#          If you do not update ^ this, then docker will happily download
+#          malicious code that could be used to poison our builds!
+# * https://security.stackexchange.com/q/238916/213165
 DOCKER_IMAGE_NAME='debian:bookworm-slim'
 
 #################