94 lines
4.6 KiB
Markdown
94 lines
4.6 KiB
Markdown
|
# Theseus Navigator v0.0.1 — release handoff
|
||
|
|
|
||
|
|
Built 2026-07-25 from `D:\Dev\SilentMode\TheseusNavigator`. The code changes
|
||
|
|
(multi-TLD, registry badge, secret-free Sia-via-gateway) and packaging are done.
|
||
|
|
The steps below are the ones this session must NOT do for you — they spend
|
||
|
|
on-chain and touch the VPS. Run them yourself; exact commands are given.
|
||
|
|
|
||
|
|
## Artifacts (in `dist-public/`)
|
||
|
|
|
||
|
|
| File | Size | SHA-256 |
|
||
|
|
|---|---|---|
|
||
|
|
| `TheseusNavigator-Setup-0.0.1.exe` (NSIS installer) | ~92 MB | `55d6d23d950952e5dae22474e1abd4420e8d4081a17ee7be21fbcffc2141189c` |
|
||
|
|
| `TheseusNavigator-0.0.1-portable.exe` (portable) | ~92 MB | `9832d8cef5c1c1b8d7025cbdf4a70ef82e1e10255f83bc700da2014f9849330f` |
|
||
|
|
|
||
|
|
> **The binaries have been rebuilt more than once and the hashes changed each
|
||
|
|
> time** (`41df5809…` → `77e836ac…` → `f39132bc…`). The values above were
|
||
|
|
> re-computed from `dist-public/` on 2026-07-26 and match what `site/` and
|
||
|
|
> `site/releases-manifest.json` publish. **Always re-hash immediately before the
|
||
|
|
> Step 2 on-chain publish** — a rebuild between writing a doc and spending the
|
||
|
|
> transaction silently invalidates it, and that step cannot be undone.
|
||
|
|
|
||
|
|
Verified clean: no `sia-s3`/`accessKey`/`secretKey`/`aws4fetch` and no
|
||
|
|
`C:\Users\valer` / username strings in `app.asar` or bundled resources.
|
||
|
|
|
||
|
|
Re-verify the hashes any time:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd D:\Dev\SilentMode\TheseusNavigator\dist-public && sha256sum *.exe
|
||
|
|
```
|
||
|
|
|
||
|
|
## Step 1 — Deploy to `dl.silentmode.st` (your VPS)
|
||
|
|
|
||
|
|
nginx already serves `/opt/silent-mode/dl/` on the `dl` / `silentmode-st` vhost.
|
||
|
|
Upload both installers + the manifest (run over the anonymous VPN/Tor per
|
||
|
|
SECURITY.md §4):
|
||
|
|
|
||
|
|
```bash
|
||
|
|
scp dist-public/TheseusNavigator-Setup-0.0.1.exe dist-public/TheseusNavigator-0.0.1-portable.exe site/releases-manifest.json <vps>:/opt/silent-mode/dl/
|
||
|
|
```
|
||
|
|
|
||
|
|
**Manifest moved (2026-07-26).** `releases-manifest.json` is now multi-product
|
||
|
|
(Theseus + Ariadne Android) and lives at `site/releases-manifest.json` — note
|
||
|
|
the `scp` line above copies it from `site/`, not from `dist-public/`. The old
|
||
|
|
Theseus-only copy in `dist-public/` was deleted the same day: uploading it would
|
||
|
|
have wiped the Android APK's checksum off the live manifest. Do not re-create
|
||
|
|
one there — that is electron-builder's output directory, and hand-placed files
|
||
|
|
are lost on the next `npm run dist`.
|
||
|
|
|
||
|
|
The download page (`site/index.html`) already links these exact filenames at
|
||
|
|
`https://dl.silentmode.st/…`, so no page edit is needed once they land.
|
||
|
|
|
||
|
|
## Step 2 — Publish the hash on-chain (`releases.silentmode.bch`)
|
||
|
|
|
||
|
|
This spends chipnet funds and uses the wallet seed — your action, not the
|
||
|
|
session's. The engine tool is `Argus/src/update.js`. Publish the manifest as an
|
||
|
|
inline `h` record so `releases.silentmode.bch` itself serves the hash list
|
||
|
|
(same mechanism as `hello.bch`):
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd D:\Dev\SilentMode\Argus
|
||
|
|
node src/update.js releases.silentmode "{\"h\":\"<html><body><pre>Theseus 0.0.1\nSetup 55d6d23d950952e5dae22474e1abd4420e8d4081a17ee7be21fbcffc2141189c\nPortable 9832d8cef5c1c1b8d7025cbdf4a70ef82e1e10255f83bc700da2014f9849330f\nAriadne Android 0.2\nAPK 635c8f04d44ef855a8390b9eeddb8cd2d50622e81cc4e5004e8daffc1bb0425c</pre></body></html>\"}"
|
||
|
|
```
|
||
|
|
|
||
|
|
- If `releases.silentmode` is not yet registered, register it first with
|
||
|
|
`node src/register.js releases.silentmode "{...}"`.
|
||
|
|
- If the full HTML exceeds the OP_RETURN size your relay policy accepts, store a
|
||
|
|
compact record instead — e.g. `{"u":"https://dl.silentmode.st/releases-manifest.json"}`
|
||
|
|
— but the trustless ideal is the hashes themselves on-chain.
|
||
|
|
- **Do this from `D:\Dev\SilentMode\Argus`, never `D:\Dev\NameCoin` (live).**
|
||
|
|
|
||
|
|
## Step 3 — Optional per SECURITY.md §5 (multi-channel)
|
||
|
|
|
||
|
|
- Create a torrent/magnet of each installer; add the magnet to the manifest +
|
||
|
|
download page.
|
||
|
|
- Mirror to IPFS (`ipfs add`) and Sia; list all mirrors, all verified against
|
||
|
|
the on-chain hash.
|
||
|
|
- Sign `releases-manifest.json` with your pseudonymous minisign key.
|
||
|
|
|
||
|
|
## Build reproducibility note (for whoever rebuilds)
|
||
|
|
|
||
|
|
`npm run dist` fetches electron-builder's `winCodeSign` package, whose macOS
|
||
|
|
symlinks fail to extract on Windows without admin/Developer Mode. Since builds
|
||
|
|
are **unsigned by choice** (SECURITY.md §2), pre-extract it once without the
|
||
|
|
`darwin` folder, then the build runs clean:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
CACHE="$LOCALAPPDATA/electron-builder/Cache/winCodeSign"
|
||
|
|
node_modules/7zip-bin/win/x64/7za.exe x "$CACHE"/<downloaded>.7z -o"$CACHE/winCodeSign-2.6.0" -xr!darwin -y
|
||
|
|
```
|
||
|
|
|
||
|
|
Build with a fixed `SOURCE_DATE_EPOCH` (set to 2026-07-25 for this release) and
|
||
|
|
`CSC_IDENTITY_AUTO_DISCOVERY=false` so timestamps don't fingerprint the build
|
||
|
|
and no signing identity is sought.
|