Split desktop artifact verification by platform

.github/workflows/desktop-build.yml

@@ -169,10 +169,34 @@ jobs:
             frontend/src-tauri/target/reproducibility/*.sha256
           retention-days: 5
 
-  verify-desktop-artifacts:
+  verify-linux-desktop-artifacts:
     needs:
-      - build-macos
       - build-linux
+    runs-on: ubuntu-latest-8-cores
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Download Linux desktop artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
+        with:
+          name: maple-linux
+          path: artifacts
+
+      - name: Verify Linux desktop artifact reproducibility proofs
+        run: nix develop .#desktop-linux -c ./scripts/ci/verify-release-artifacts.sh artifacts linux
+
+  verify-macos-desktop-artifacts:
+    needs:
+      - build-macos
     runs-on: macos-26-xlarge
     permissions:
       contents: read
@@ -186,13 +210,14 @@ jobs:
         with:
           github-token: ""
 
-      - name: Download desktop artifacts
+      - name: Download macOS desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
+          name: maple-macos-universal
           path: artifacts
 
-      - name: Verify desktop artifact reproducibility proofs
-        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos
+      - name: Verify macOS desktop artifact reproducibility proofs
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts macos
 
   build-windows:
     runs-on: windows-latest
@@ -303,6 +328,32 @@ jobs:
       - name: Show sccache stats
         run: sccache --show-stats
 
+      - name: Collect Windows release checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          source scripts/ci/_common.sh
+
+          repro_dir="${TAURI_DIR}/target/reproducibility"
+          mkdir -p "${repro_dir}"
+
+          windows_artifacts=()
+          while IFS= read -r -d '' file; do
+            windows_artifacts+=("${file}")
+          done < <(find "${TAURI_DIR}/target/release/bundle/nsis" -type f \( \
+            -name '*.exe' -o \
+            -name '*.nsis.zip' -o \
+            -name '*.nsis.zip.sig' \
+          \) -print0 | LC_ALL=C sort -z)
+
+          if [ "${#windows_artifacts[@]}" -eq 0 ]; then
+            echo "No Windows desktop artifacts found." >&2
+            exit 1
+          fi
+
+          write_sha256_manifest "${repro_dir}/desktop-release-windows-final.sha256" "${windows_artifacts[@]}"
+          print_file_hashes "${windows_artifacts[@]}"
+
       - name: Upload Windows Build
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
         with:
@@ -311,4 +362,40 @@ jobs:
             frontend/src-tauri/target/release/bundle/nsis/*.exe
             frontend/src-tauri/target/release/bundle/nsis/*.nsis.zip
             frontend/src-tauri/target/release/bundle/nsis/*.nsis.zip.sig
+            frontend/src-tauri/target/reproducibility/desktop-release-windows-*.sha256
           retention-days: 5
+
+  verify-windows-desktop-artifacts:
+    needs:
+      - build-windows
+    runs-on: ubuntu-latest-8-cores
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Download Windows desktop artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
+        with:
+          name: maple-windows-x64
+          path: artifacts
+
+      - name: Verify Windows desktop artifact reproducibility proofs
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows
+
+  verify-desktop-artifacts:
+    needs:
+      - verify-linux-desktop-artifacts
+      - verify-macos-desktop-artifacts
+      - verify-windows-desktop-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify desktop artifact checks completed
+        run: echo "Desktop artifact verification completed for Linux, macOS, and Windows."

.github/workflows/release.yml

@@ -448,7 +448,33 @@ jobs:
           MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1"
         run: nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android
 
-  verify-desktop-release-artifacts:
+  verify-linux-desktop-release-artifacts:
+    needs: build-tauri
+    runs-on: ubuntu-latest-8-cores
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Download release artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          mkdir -p artifacts
+          gh release download "${RELEASE_TAG}" -D artifacts
+
+      - name: Verify Linux desktop release artifact reproducibility proofs
+        run: nix develop .#desktop-linux -c ./scripts/ci/verify-release-artifacts.sh artifacts linux
+
+  verify-macos-desktop-release-artifacts:
     needs: build-tauri
     runs-on: macos-26-xlarge
     permissions:
@@ -490,8 +516,17 @@ jobs:
           mkdir -p artifacts
           gh release download "${RELEASE_TAG}" -D artifacts
 
-      - name: Verify desktop release artifact reproducibility proofs
-        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos
+      - name: Verify macOS desktop release artifact reproducibility proofs
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts macos
+
+  verify-desktop-release-artifacts:
+    needs:
+      - verify-linux-desktop-release-artifacts
+      - verify-macos-desktop-release-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify desktop release artifact checks completed
+        run: echo "Desktop release artifact verification completed for Linux and macOS."
 
   update-latest-json:
     needs: verify-desktop-release-artifacts
@@ -597,6 +632,6 @@ jobs:
           gh release download "${RELEASE_TAG}" -D artifacts
 
       - name: Verify release artifact reproducibility proofs
-        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos ios web latest-json
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts macos ios web latest-json
         env:
           MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: "1"

scripts/ci/verify-release-artifacts.sh

@@ -351,11 +351,18 @@ verify_linux_present() {
 verify_windows() {
   local final_manifest runtime_manifest
 
-  final_manifest="$(proof_file_required desktop-pr-windows-final.sha256)"
-  runtime_manifest="$(proof_file_required desktop-pr-windows-runtime-dlls.sha256)"
+  final_manifest="$(proof_file_optional desktop-release-windows-final.sha256)"
+  runtime_manifest="$(proof_file_optional desktop-release-windows-runtime-dlls.sha256)"
+  if [ -z "${final_manifest}" ]; then
+    final_manifest="$(proof_file_required desktop-pr-windows-final.sha256)"
+    runtime_manifest="$(proof_file_required desktop-pr-windows-runtime-dlls.sha256)"
+  fi
 
   verify_file_manifest "${final_manifest}"
-  verify_file_manifest "${runtime_manifest}"
+  if [ -n "${runtime_manifest}" ]; then
+    verify_file_manifest "${runtime_manifest}"
+  fi
+  verify_tauri_signatures_in_artifacts
 }
 
 verify_canonical_apple_manifest() {
@@ -647,7 +654,9 @@ verify_present() {
     verify_linux_present
   fi
   target_present desktop-release-macos-final.sha256 && verify_macos
-  target_present desktop-pr-windows-final.sha256 && verify_windows
+  if target_present desktop-release-windows-final.sha256 || target_present desktop-pr-windows-final.sha256; then
+    verify_windows
+  fi
   target_present android-release-final.sha256 && verify_android
   target_present ios-release-final.sha256 && verify_ios
   target_present web-final.sha256 && verify_web