From d5b58a109bf8f0195cc240dcb159c9f15d05146e Mon Sep 17 00:00:00 2001 From: Local Dev Date: Sat, 24 Oct 2026 04:07:13 +0300 Subject: [PATCH] releases: deterministic newest-first order per product; /latest/ skips files not yet on disk Consumers take the first manifest entry per product id, so the previous non-transitive sort could leave Hermes 0.3.0 ahead of 0.3.1. dl-latest.sh now picks the first matching file that exists, since an entry can be published minutes before its binary lands. --- releases-manifest.json | 118 ++++++++++++++++++++--------------------- 1 file changed, 59 insertions(+), 59 deletions(-) diff --git a/releases-manifest.json b/releases-manifest.json index 51d48ea..168e17b 100644 --- a/releases-manifest.json +++ b/releases-manifest.json @@ -105,6 +105,65 @@ "ariadne-v0.51.apk": "8e5b091bf48ffe17047f91e517e9ca66e8ff4c4cdcb1a074f7b928654eae2b45" } }, + { + "id": "hermes-desktop", + "product": "Hermes for Windows", + "version": "0.1.0", + "date": "2026-10-23", + "platform": "win-x64", + "signed": false, + "signingAuthority": null, + "changes": "First desktop build: the Hermes messenger as a stand-alone Windows app (Tauri), byte-equal with the Theseus panel and the hermes.x web messenger. Sign in with a recovery phrase or create a new identity; same inbox on every surface.", + "files": { + "Hermes-0.1.0-setup.exe": "0adc742d54daaee2b62e7fdcbff2f0203bd50f995444487ff93233ccc6328552", + "Hermes-0.1.0.msi": "fa81948bba8c3d6e9306a5aa218424fd2a4bc692891f3d2543c2782207f86b3f" + } + }, + { + "id": "hermes-android", + "product": "Hermes for Android", + "version": "0.3.1", + "date": "2026-10-24", + "platform": "android", + "minSdk": 26, + "signed": true, + "signingAuthority": null, + "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", + "changes": "Fix: phone verify over Telegram no longer gets stuck. Two live bugs. First, Android 11+ package visibility was blocking the tg:// deep link — the OS silently fell through to a browser (or threw) even with Telegram installed, so our startActivity could never actually dispatch /start to the bot; fixed by declaring the tg:// and https://t.me intents in the manifest block. Second, the https://t.me/?start= URL only auto-sends /start on a brand-new chat with the bot — once you had opened the bot even once (common after a first verify attempt), the chat reopened with no Share-Phone button and no retry path; Hermes now prefers tg://resolve, which fires /start regardless of chat state. Polling also starts the moment a nonce is minted (not only on return from Telegram), honours the server's 10-minute nonce TTL instead of giving up at three, and the pane now carries Check-status-now / Reopen-Telegram-chat / Cancel-and-start-over controls so a stale verify can be unstuck without leaving the screen.", + "files": { + "hermes-v0.3.1.apk": "f3ebaea886cc363e131027514dd038343e522d31296b8dfdd46af1889c095637" + } + }, + { + "id": "hermes-android", + "product": "Hermes for Android", + "version": "0.3.0", + "date": "2026-10-24", + "platform": "android", + "minSdk": 26, + "signed": true, + "signingAuthority": null, + "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", + "changes": "In-app auto-update. Hermes now polls dl.silentmode.st/releases-manifest.json on launch and on resume, and shows an update banner at the top of the chat list when a newer version is live. Tap Update → downloads the APK via the pinned client, SHA-256-verifies against the manifest field, then launches Android's package installer. Android refuses to install an APK signed by a different key than the running app, so a tampered manifest can at worst waste bandwidth. Same signing key as 0.2.2; installs over it. Requires the one-time Install-unknown-apps grant on first update, which Android shims via Settings.", + "files": { + "hermes-v0.3.0.apk": "77d16184ba2c26fb81b79d9e4c5f98f8bfb434690c1e6acd9b7fd5f16651a6cb" + } + }, + { + "id": "hermes-android", + "product": "Hermes for Android", + "version": "0.2.2", + "date": "2026-10-24", + "platform": "android", + "minSdk": 26, + "signed": true, + "signingAuthority": null, + "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", + "changes": "Find People now accepts a phone number alongside BNS names, labels, npubs and hex pubkeys. Type +15551234567 (or 0015551234567) and Hermes hashes it locally and asks the relays for the matching kind:30078 phone-claim event — the raw number never leaves the device. Shows the Hermes identity with a verified ✓ when the owner's phone-claim carries a valid Telegram attestation, same shape as the Address Book contact matches. The input also switches to a numeric phone keyboard the moment it looks like a phone number. Same signing key as 0.2.1; installs over it.", + "files": { + "hermes-v0.2.2.apk": "b46da998caa57a6923bb4ab305c5ab1cff88fbf38f4028eb2cecceb77140f1a6" + } + }, { "id": "pithos-desktop", "product": "Pithos", @@ -162,65 +221,6 @@ "Pithos-0.3.25-amd64.deb": "04e36e9451ab1addcc6a179dbf527fb2689e019beb7d7edb02fd0d85501c626b", "Pithos-0.3.25-linux-x64.tar.gz": "1aea475630e8722c563e132ffa922190da08aec1ab09bedece0fbfbdfecfc307" } - }, - { - "id": "hermes-android", - "product": "Hermes for Android", - "version": "0.3.0", - "date": "2026-10-24", - "platform": "android", - "minSdk": 26, - "signed": true, - "signingAuthority": null, - "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", - "changes": "In-app auto-update. Hermes now polls dl.silentmode.st/releases-manifest.json on launch and on resume, and shows an update banner at the top of the chat list when a newer version is live. Tap Update → downloads the APK via the pinned client, SHA-256-verifies against the manifest field, then launches Android's package installer. Android refuses to install an APK signed by a different key than the running app, so a tampered manifest can at worst waste bandwidth. Same signing key as 0.2.2; installs over it. Requires the one-time Install-unknown-apps grant on first update, which Android shims via Settings.", - "files": { - "hermes-v0.3.0.apk": "77d16184ba2c26fb81b79d9e4c5f98f8bfb434690c1e6acd9b7fd5f16651a6cb" - } - }, - { - "id": "hermes-android", - "product": "Hermes for Android", - "version": "0.2.2", - "date": "2026-10-24", - "platform": "android", - "minSdk": 26, - "signed": true, - "signingAuthority": null, - "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", - "changes": "Find People now accepts a phone number alongside BNS names, labels, npubs and hex pubkeys. Type +15551234567 (or 0015551234567) and Hermes hashes it locally and asks the relays for the matching kind:30078 phone-claim event — the raw number never leaves the device. Shows the Hermes identity with a verified ✓ when the owner's phone-claim carries a valid Telegram attestation, same shape as the Address Book contact matches. The input also switches to a numeric phone keyboard the moment it looks like a phone number. Same signing key as 0.2.1; installs over it.", - "files": { - "hermes-v0.2.2.apk": "b46da998caa57a6923bb4ab305c5ab1cff88fbf38f4028eb2cecceb77140f1a6" - } - }, - { - "id": "hermes-desktop", - "product": "Hermes for Windows", - "version": "0.1.0", - "date": "2026-10-23", - "platform": "win-x64", - "signed": false, - "signingAuthority": null, - "changes": "First desktop build: the Hermes messenger as a stand-alone Windows app (Tauri), byte-equal with the Theseus panel and the hermes.x web messenger. Sign in with a recovery phrase or create a new identity; same inbox on every surface.", - "files": { - "Hermes-0.1.0-setup.exe": "0adc742d54daaee2b62e7fdcbff2f0203bd50f995444487ff93233ccc6328552", - "Hermes-0.1.0.msi": "fa81948bba8c3d6e9306a5aa218424fd2a4bc692891f3d2543c2782207f86b3f" - } - }, - { - "id": "hermes-android", - "product": "Hermes for Android", - "version": "0.3.1", - "date": "2026-10-24", - "platform": "android", - "minSdk": 26, - "signed": true, - "signingAuthority": null, - "signingCertSha256": "b1e4685a7476fcbb3b53d807e298dea2ef2c7375f240cf04847d3d712cab95b7", - "changes": "Fix: phone verify over Telegram no longer gets stuck. Two live bugs. First, Android 11+ package visibility was blocking the tg:// deep link — the OS silently fell through to a browser (or threw) even with Telegram installed, so our startActivity could never actually dispatch /start to the bot; fixed by declaring the tg:// and https://t.me intents in the manifest block. Second, the https://t.me/?start= URL only auto-sends /start on a brand-new chat with the bot — once you had opened the bot even once (common after a first verify attempt), the chat reopened with no Share-Phone button and no retry path; Hermes now prefers tg://resolve, which fires /start regardless of chat state. Polling also starts the moment a nonce is minted (not only on return from Telegram), honours the server's 10-minute nonce TTL instead of giving up at three, and the pane now carries Check-status-now / Reopen-Telegram-chat / Cancel-and-start-over controls so a stale verify can be unstuck without leaving the screen.", - "files": { - "hermes-v0.3.1.apk": "f3ebaea886cc363e131027514dd038343e522d31296b8dfdd46af1889c095637" - } } ] }