Observed on the operator's machine 2026-10-30 while reinstalling to put the app
to use. Four months after the package was purged, a fresh install found
~/.config/Signal/sql/db.sqlite (54,214,656 bytes, mtime 2026-06-21), tried to
open it, and aborted before the linking screen:
MainSQL: sqlite(SQLITE_NOTADB): file is not a database in PRAGMA journal_mode = WAL
MainSQL: migrateDatabase: Migration without cipher change failed
sql.initialize was unsuccessful; returning early
The SQLCipher key in config.json no longer resolved. The UI named nothing and
offered only 'Delete data and restart', which discards the history. Moving the
config directory aside fixes it; nothing in the product says so.
Recorded as a medium finding, status open. The score does not move: 76.4 / B.
local_data_exposure was already 5 for exactly this behaviour, and a finding is
evidence, not a point. What changes is that the number now has a receipt instead
of a rationale.
Artifact: Servetus/00-Artifacts/2026/10-Oct/30/clu-signal-startup-failure/
main.log.excerpt - the failing run, verbatim
00-provenance.txt - package version, file sizes, sha256 of the retained db
Retained state moved to ~/Signal-backup-2026-10-30-0026, not deleted.
Christian: 'I want them to put the BigTech.Sucks rating badge on their site.
It should be marketing for them.'
A sticker anyone can copy is worthless, so it is not a sticker.
- badge/<product>.svg is generated from the assessment row on every build.
Score, grade and date are never typed by a human.
- Served from bigtech.sucks. A copy pasted onto a vendor's own server is not a
badge and its link will not resolve. The domain is the signature.
- Regenerated every build, so improving earns a better badge without asking and
regressing loses it without warning.
- The SVG carries the record id, version and method in a comment, so a real
badge can be traced back to one assessment.
badges.html publishes the rules: free forever, only rated products, no badge as
a favour, and misuse called out publicly. Free matters, because charging for it
would make it worthless to both sides: marketing for the vendor, receipts for
their customer.
Also rewrote the write pass to emit report + badge per assessment in one loop, so
they can never drift apart.
