5c9fd6ca2f
Symptom: on any machine that had been through a series of installs, one or more older "BNS Local Root CA" certs from earlier builds could accumulate in LocalMachine\Root -- an unconstrained root from before 2026-07, or a rotated one -- and every install added the current constrained root ALONGSIDE the stale ones. Two certs with the same Subject-DN defeat browser chain-builders: Chromium/Edge/Firefox pick one candidate and refuse to try the others, so every .bch site failed with ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_BAD_SIGNATURE in every browser EXCEPT Theseus (which trusts the on-chain tls fingerprint directly, not the machine store). Reproduced on the dev box: two BNS Local Root CAs present (thumbprints EB5DBE98... constrained + 23538FD7... unconstrained), DNS answered correctly, strict Invoke-WebRequest to https://coinspectrum.bch/ failed. Removing the stale one and re-running the chain-build restored HTTPS 200. Fix (install.ps1): - Before Add(imported), enumerate the store and $store.Remove() every "BNS Local Root CA" whose thumbprint differs from the one we're about to trust. Post-condition: exactly one BNS root remains after install. Fix (uninstall.ps1): - Switched from `Get-ChildItem Cert:\LocalMachine\Root` to X509Store direct. The Cert: PSDrive is not always loaded in Inno's [UninstallRun] -NoProfile context, so uninstall could silently leave the CA behind on the store side even while it removed everything else. Verified end-to-end on this box: 0.1.4 upgrade over 0.1.3 finished cleanly, BNS Resolver Daemon Running, 127.0.0.1:53 open, exactly one BNS Local Root CA in the machine store, strict HTTPS to https://coinspectrum.bch/ returned 200 (506,997 bytes) with X509Chain.Build ok=true leaf -> BNS root. Deployed - dl.silentmode.st/AriadneResolver-Setup-0.1.4.exe - s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.4.exe - silentmode.st manifest advertises 0.1.4 - sha256 30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17
65 lines
5.3 KiB
JSON
65 lines
5.3 KiB
JSON
{
|
||
"schema": "silentmode-releases/2",
|
||
"updated": "2026-09-27",
|
||
"mirrors": [
|
||
"https://dl.silentmode.st/"
|
||
],
|
||
"releases": [
|
||
{
|
||
"id": "theseus-navigator",
|
||
"product": "Theseus Navigator",
|
||
"version": "0.3.58",
|
||
"date": "2026-09-27",
|
||
"platform": "win-x64",
|
||
"signed": false,
|
||
"signingAuthority": null,
|
||
"changes": "Two new protections, both on by default and managed under Settings › Performance: Shield blocks requests to known tracking and advertising hosts on every site (EasyList and EasyPrivacy, rules refreshed daily, one-click allow per site), and Cookie Pop-ups answers consent banners for you, rejecting all but the essentials (built on DuckDuckGo's autoconsent rules, one-click exclude per site). Page dialogs (alert, confirm, prompt) and Theseus's own prompts (install app or extension, remove, restart) are now drawn by Theseus in a sheet under the toolbar that names who is asking, instead of the bare system box titled theseus-navigator. Favorites chips share the row instead of running out of it. Settings pages have addresses (theseus://settings/privacy). Includes 0.3.57 (install any site as an app; two main-process crash fixes).",
|
||
"files": {
|
||
"TheseusNavigator-0.3.58-portable.exe": "03efa9389e69b660e72b175bdad26e4549fd78b42d5efd4d9509e1aa1e71e9cb",
|
||
"TheseusNavigator-Setup-0.3.58.exe": "2e09be3eca7fa7929926e4fffbf14599eb23be2cbd1bb42ee48db61578d7a0c7"
|
||
}
|
||
},
|
||
{
|
||
"id": "ariadne-resolver",
|
||
"product": "Ariadne Resolver (Windows)",
|
||
"version": "0.1.4",
|
||
"date": "2026-09-27",
|
||
"platform": "win-x64",
|
||
"signed": false,
|
||
"signingAuthority": null,
|
||
"changes": "Fixes \"resolver is installed and DNS answers, but every .bch site fails in every browser except Theseus\": if the machine had a stale \"BNS Local Root CA\" left over from an earlier install (e.g. an unconstrained root from before 2026-07), the new install used to add its own root alongside instead of replacing it, and Chromium/Edge/Firefox chain-builders would refuse to try both candidates. install.ps1 now sweeps every prior BNS root whose thumbprint differs from the one being trusted, so exactly one BNS Local Root CA remains after install. uninstall.ps1 switched to X509Store direct (Cert: PSDrive is not always loaded in Inno's UninstallRun context). Same daemon, same NRPT, upgrades in place.",
|
||
"files": {
|
||
"AriadneResolver-Setup-0.1.4.exe": "30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17"
|
||
}
|
||
},
|
||
{
|
||
"id": "ariadne-android",
|
||
"product": "Ariadne for Android",
|
||
"version": "0.19",
|
||
"date": "2026-09-19",
|
||
"platform": "android",
|
||
"minSdk": 21,
|
||
"signed": true,
|
||
"signingAuthority": null,
|
||
"signingCertSha256": "46ebbbe5dc73148d66410fd0337b1e6683472128c983e8e2578200b9e3ca548c",
|
||
"changes": "Consensus fix: the on-device index now applies the TLD co-sign rule. A name registered under a TLD whose owner set policy \"cosign\" or switched the TLD off (hidden) only counts when the registration transaction also carries the TLD's own certificate, exactly as the gateway, Theseus and the desktop resolver decide it, so every client agrees on which names exist. The index reads the per-TLD certificate registry and its policy history from the TLD beacon at build time; if that beacon cannot be reached it keeps the previous behaviour instead of returning an empty index. No UI changes.",
|
||
"files": {
|
||
"ariadne-v0.19.apk": "d2f4ad359e7ac36c1d0729100aef613be968cd17b153e94e124f8500fcbfc711"
|
||
}
|
||
},
|
||
{
|
||
"id": "theseus-navigator",
|
||
"product": "Theseus Navigator",
|
||
"version": "0.3.49",
|
||
"date": "2026-09-20",
|
||
"platform": "win-x64",
|
||
"signed": false,
|
||
"signingAuthority": null,
|
||
"changes": "Engine: Electron 44 / Chromium 152 (from 130) — a year-old engine had become a bot signal (DataDome-fronted shops served a block page), and the identity Theseus presents is now consistent on both sides (client-hint brands computed like Chromium, matching navigator.userAgentData, well-formed Accept-Language). Extensions: anyone who holds a BCDN name can publish an extension from theseus.x/extensions; Settings › Extensions › Community lists the catalog and installs with the publisher's signature verified against the name's owner in Theseus's own index. Settings › Plug-ins and › Extensions link to the new theseus.x/plug-ins and /extensions pages. Tabs: the tab strip lives in the title bar (Windows), a tab opened from a link lands next to its opener, the selected tab has an accent, the strip no longer blinks when another tab loads, the address bar follows the page even after you clicked into it, and holding or right-clicking Back/Forward lists the history. Also: HTTP sign-in prompt for sites behind Basic/Digest auth instead of a bare 401; local paths and file:// URLs open from the address bar; owner-signed DNS records (A/AAAA/MX/TXT via /api/dns) are fetched alongside on-chain records; the Ariadne's Thread card finds the installed resolver and answers in about 2 s. Includes everything from 0.3.47 and 0.3.48.",
|
||
"files": {
|
||
"TheseusNavigator-0.3.49-portable.exe": "1e44162b3dddb79dff7609374e0f02153a38255d5a94847dd95d99d29c7f582a",
|
||
"TheseusNavigator-Setup-0.3.49.exe": "0f1c34063963cd72e051662617aea51642a01c3a3c4a2a0a03f831131fa83cc5"
|
||
}
|
||
}
|
||
]
|
||
}
|