5c9fd6ca2f
Symptom: on any machine that had been through a series of installs, one or more older "BNS Local Root CA" certs from earlier builds could accumulate in LocalMachine\Root -- an unconstrained root from before 2026-07, or a rotated one -- and every install added the current constrained root ALONGSIDE the stale ones. Two certs with the same Subject-DN defeat browser chain-builders: Chromium/Edge/Firefox pick one candidate and refuse to try the others, so every .bch site failed with ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_BAD_SIGNATURE in every browser EXCEPT Theseus (which trusts the on-chain tls fingerprint directly, not the machine store). Reproduced on the dev box: two BNS Local Root CAs present (thumbprints EB5DBE98... constrained + 23538FD7... unconstrained), DNS answered correctly, strict Invoke-WebRequest to https://coinspectrum.bch/ failed. Removing the stale one and re-running the chain-build restored HTTPS 200. Fix (install.ps1): - Before Add(imported), enumerate the store and $store.Remove() every "BNS Local Root CA" whose thumbprint differs from the one we're about to trust. Post-condition: exactly one BNS root remains after install. Fix (uninstall.ps1): - Switched from `Get-ChildItem Cert:\LocalMachine\Root` to X509Store direct. The Cert: PSDrive is not always loaded in Inno's [UninstallRun] -NoProfile context, so uninstall could silently leave the CA behind on the store side even while it removed everything else. Verified end-to-end on this box: 0.1.4 upgrade over 0.1.3 finished cleanly, BNS Resolver Daemon Running, 127.0.0.1:53 open, exactly one BNS Local Root CA in the machine store, strict HTTPS to https://coinspectrum.bch/ returned 200 (506,997 bytes) with X509Chain.Build ok=true leaf -> BNS root. Deployed - dl.silentmode.st/AriadneResolver-Setup-0.1.4.exe - s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.4.exe - silentmode.st manifest advertises 0.1.4 - sha256 30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17
109 lines
8.2 KiB
HTML
109 lines
8.2 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<meta property="og:type" content="website">
|
||
<meta property="og:site_name" content="Silent Mode">
|
||
<meta property="og:title" content="Silent Mode — releases &amp; checksums">
|
||
<meta property="og:url" content="https://silentmode.st/releases">
|
||
<meta property="og:image" content="https://silentmode.st/brand/og.png">
|
||
<meta property="og:image:width" content="1200">
|
||
<meta property="og:image:height" content="630">
|
||
<meta name="twitter:card" content="summary_large_image">
|
||
<title>Silent Mode — releases & checksums</title>
|
||
<style>
|
||
:root{--bg:#0b0e14;--panel:#141a24;--line:rgba(255,255,255,.09);--ink:#e7eaf1;--mut:#8b98a9;--dim:#5e6678;--acid:#d6ff3d}
|
||
*{box-sizing:border-box}
|
||
body{margin:0;background:radial-gradient(1100px 560px at 50% -12%,#16202e,var(--bg));
|
||
color:var(--ink);font:16px/1.65 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
|
||
.wrap{max-width:820px;margin:0 auto;padding:3.5rem 1.2rem 4rem}
|
||
a{color:var(--acid)}
|
||
h1{font-size:1.8rem;margin:0 0 .3rem}
|
||
h1 .g{color:var(--acid)}
|
||
.lede{color:var(--mut);margin:.2rem 0 2rem}
|
||
.rel{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:20px 22px;margin-bottom:16px}
|
||
.rel h2{font-size:1.15rem;margin:0 0 .2rem}
|
||
.rel .meta{color:var(--dim);font-size:12.5px;margin-bottom:1rem}
|
||
.file{border-top:1px solid var(--line);padding-top:12px;margin-top:12px}
|
||
.file .n{font-size:14px;color:var(--ink)}
|
||
.file .n a{text-decoration:none}
|
||
.file code{display:block;font-family:ui-monospace,monospace;font-size:11.5px;color:#c9d4e3;
|
||
word-break:break-all;margin-top:4px}
|
||
.note{background:var(--panel);border:1px solid var(--line);border-left:3px solid var(--acid);
|
||
border-radius:10px;padding:14px 18px;color:var(--mut);font-size:13.5px;margin-top:1.6rem}
|
||
.note b{color:var(--ink)}
|
||
footer{color:var(--dim);font-size:12.5px;margin-top:2.5rem;text-align:center}
|
||
</style>
|
||
<link rel="stylesheet" href="shared.css?v=20260910">
|
||
<link rel="icon" type="image/svg+xml" href="favicon.svg">
|
||
</head>
|
||
<body>
|
||
|
||
<nav class="topnav">
|
||
<a class="brand" href="./"><svg class="logo" viewBox="0 0 32 20" aria-hidden="true"><rect class="l1" x="1.5" y="3.5" width="17" height="13" rx="6.5" ry="6.5" fill="none" stroke-width="2.6"/><rect class="l2" x="13.5" y="3.5" width="17" height="13" rx="6.5" ry="6.5" fill="none" stroke-width="2.6"/></svg>Silent <span class="g">Mode</span></a>
|
||
<a href="theseus">Theseus</a>
|
||
<a href="prometheus">Prometheus</a>
|
||
<a href="sirius">Sirius</a>
|
||
<a href="hephaestus">Hephaestus</a>
|
||
<a href="helios">Helios</a>
|
||
<a href="hermes">Hermes</a>
|
||
<a href="tools">Tools</a>
|
||
</nav>
|
||
|
||
<div class="wrap">
|
||
<h1>Silent <span class="g">Mode</span> — releases</h1>
|
||
<p class="lede">Canonical SHA-256 checksums for every published build. This page lives at the on-chain
|
||
name <code>releases.silentmode.bch</code>; the name pins where it is served from, so a tampered
|
||
mirror cannot change what you check against here.</p>
|
||
|
||
<div class="rel">
|
||
<h2>Theseus Navigator <span style="color:var(--acid)">0.3.58</span></h2>
|
||
<div class="meta">Windows 64-bit · unsigned · 2026-09-27 · <b>0.3.58 — Shield, Cookie Pop-ups, and dialogs that look like Theseus</b> — Two new protections, both on by default and managed under Settings › Performance: Shield blocks requests to known tracking and advertising hosts on every site (EasyList and EasyPrivacy, rules refreshed daily, one-click allow per site), and Cookie Pop-ups answers consent banners for you, rejecting all but the essentials (built on DuckDuckGo's autoconsent rules, one-click exclude per site). Page dialogs (alert, confirm, prompt) and Theseus's own prompts (install app or extension, remove, restart) are now drawn by Theseus in a sheet under the toolbar that names who is asking, instead of the bare system box titled theseus-navigator. Favorites chips share the row instead of running out of it. Settings pages have addresses (theseus://settings/privacy). Includes 0.3.57 (install any site as an app; two main-process crash fixes).</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.58.exe">TheseusNavigator-Setup-0.3.58.exe</a> — installer</div>
|
||
<code>2e09be3eca7fa7929926e4fffbf14599eb23be2cbd1bb42ee48db61578d7a0c7</code>
|
||
</div>
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-0.3.58-portable.exe">TheseusNavigator-0.3.58-portable.exe</a> — portable</div>
|
||
<code>03efa9389e69b660e72b175bdad26e4549fd78b42d5efd4d9509e1aa1e71e9cb</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="rel">
|
||
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.4</span></h2>
|
||
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-27 · <b>Stale-root sweep</b> — fixes the "resolver is installed, DNS answers, but every .bch site fails in every browser except Theseus" state. If the machine had a stale <code style="display:inline">BNS Local Root CA</code> left over from an earlier install (an unconstrained root from before 2026-07, or a rotated one), the new install used to add its own root alongside instead of replacing it, and Chromium/Edge/Firefox chain-builders would refuse to try both candidates and fail with <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_BAD_SIGNATURE</code>. install.ps1 now sweeps every prior BNS root whose thumbprint differs from the one being trusted, so exactly one <code style="display:inline">BNS Local Root CA</code> remains after install. uninstall.ps1 switched to <code style="display:inline">X509Store</code> direct (the <code style="display:inline">Cert:</code> PSDrive is not always loaded in Inno's <code style="display:inline">UninstallRun</code> context). Same daemon, same NRPT rules, upgrades in place.</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.4.exe">AriadneResolver-Setup-0.1.4.exe</a> — ~24 MB</div>
|
||
<code>30ed5e3bb6d6da5325f854c97976410b4fc63067ed52c810a55e9d2e1bdc4e17</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="rel">
|
||
<h2>Ariadne for Android <span style="color:var(--acid)">0.19</span></h2>
|
||
<div class="meta">Android 5.0+ (API 21) · self-signed release key · 2026-09-19 · <b>0.19 — co-sign rule</b> — Consensus fix: the on-device index now applies the TLD co-sign rule. A name registered under a TLD whose owner set policy "cosign" or switched the TLD off (hidden) only counts when the registration transaction also carries the TLD's own certificate, exactly as the gateway, Theseus and the desktop resolver decide it, so every client agrees on which names exist. The index reads the per-TLD certificate registry and its policy history from the TLD beacon at build time; if that beacon cannot be reached it keeps the previous behaviour instead of returning an empty index. No UI changes.</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/ariadne-v0.19.apk">ariadne-v0.19.apk</a> — 146 KB</div>
|
||
<code>d2f4ad359e7ac36c1d0729100aef613be968cd17b153e94e124f8500fcbfc711</code>
|
||
</div>
|
||
<div class="file">
|
||
<div class="n">Signing certificate — SHA-256 (the same key signs every future release)</div>
|
||
<code>46ebbbe5dc73148d66410fd0337b1e6683472128c983e8e2578200b9e3ca548c</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="note"><b>How to verify.</b> After downloading, compute the file's SHA-256 and compare it to
|
||
the value above — on Windows: <code style="display:inline">certutil -hashfile <file> SHA256</code>;
|
||
on Android, hash the downloaded <code style="display:inline">.apk</code> on a computer before you move
|
||
it to the phone, or use any file-hashing app. Nothing here is signed by an authority your device
|
||
already trusts — <b>by design</b> — so it will warn about an unrecognized app; the checksum is the
|
||
real check. The machine-readable manifest is at
|
||
<a href="https://dl.silentmode.st/releases-manifest.json">releases-manifest.json</a>.</div>
|
||
|
||
<footer>Silent Mode — a Deviant project. Alpha software on a test network.</footer>
|
||
</div>
|
||
</body>
|
||
</html>
|