silentmode/theseus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
theseus/RELEASE-HANDOFF.md
Local Dev 3803202df6 Ship Theseus 0.0.2 (SameSite cookie shim) 
Bump to 0.0.2; publish new installer/portable hashes across the download
site (tools + releases pages), releases-manifest.json (Theseus entry only —
Ariadne Resolver/Android entries preserved), and RELEASE-HANDOFF.md.
Artifacts rebuilt reproducibly (SOURCE_DATE_EPOCH=1785888000, unsigned).

  Setup    b3a810472b06273c1cc846adcb84366ad9114276a984bed7347c26f019497c56
  Portable 37679d293715b9e1881d38ee7e92a5a7448f3c523a14919637afe732e2478ce1
2026-08-05 18:51:16 +02:00

4.7 KiB
Raw Blame History

Theseus Navigator v0.0.2 — release handoff

Built 2026-08-05 from D:\Dev\SilentMode\TheseusNavigator. This release adds the cross-site embed cookie shim (applyEmbedCookieShim() — SameSite=None; Secure on an allowlist so captcha-gated faucet iframes work); packaging is done. The steps below are the ones this session must NOT do for you — they spend on-chain and touch the VPS. Run them yourself; exact commands are given.

Artifacts (in dist-public/)

File Size SHA-256
TheseusNavigator-Setup-0.0.2.exe (NSIS installer) ~92 MB b3a810472b06273c1cc846adcb84366ad9114276a984bed7347c26f019497c56
TheseusNavigator-0.0.2-portable.exe (portable) ~92 MB 37679d293715b9e1881d38ee7e92a5a7448f3c523a14919637afe732e2478ce1

The binaries have been rebuilt more than once and the hashes changed each time (unsigned reproducible builds still differ if the toolchain changes). The values above were computed from dist-public/ on 2026-08-05 and match what site/ and site/releases-manifest.json publish. Always re-hash immediately before the Step 2 on-chain publish — a rebuild between writing a doc and spending the transaction silently invalidates it, and that step cannot be undone.

Verified clean: no sia-s3/accessKey/secretKey/aws4fetch and no C:\Users\valer / username strings in app.asar or bundled resources.

Re-verify the hashes any time:

cd D:\Dev\SilentMode\TheseusNavigator\dist-public && sha256sum *.exe

Step 1 — Deploy to dl.silentmode.st (your VPS)

nginx already serves /opt/silent-mode/dl/ on the dl / silentmode-st vhost. Upload both installers + the manifest (run over the anonymous VPN/Tor per SECURITY.md §4):

scp dist-public/TheseusNavigator-Setup-0.0.2.exe dist-public/TheseusNavigator-0.0.2-portable.exe site/releases-manifest.json <vps>:/opt/silent-mode/dl/

Manifest moved (2026-07-26). releases-manifest.json is now multi-product (Theseus + Ariadne Android) and lives at site/releases-manifest.json — note the scp line above copies it from site/, not from dist-public/. The old Theseus-only copy in dist-public/ was deleted the same day: uploading it would have wiped the Android APK's checksum off the live manifest. Do not re-create one there — that is electron-builder's output directory, and hand-placed files are lost on the next npm run dist.

The download page (site/index.html) already links these exact filenames at https://dl.silentmode.st/…, so no page edit is needed once they land.

Step 2 — Publish the hash on-chain (releases.silentmode.bch)

This spends chipnet funds and uses the wallet seed — your action, not the session's. The engine tool is Argus/src/update.js. Publish the manifest as an inline h record so releases.silentmode.bch itself serves the hash list (same mechanism as hello.bch):

cd D:\Dev\SilentMode\Argus
node src/update.js releases.silentmode "{\"h\":\"<html><body><pre>Theseus 0.0.2\nSetup    b3a810472b06273c1cc846adcb84366ad9114276a984bed7347c26f019497c56\nPortable 37679d293715b9e1881d38ee7e92a5a7448f3c523a14919637afe732e2478ce1\nAriadne Android 0.2\nAPK      635c8f04d44ef855a8390b9eeddb8cd2d50622e81cc4e5004e8daffc1bb0425c</pre></body></html>\"}"
  • If releases.silentmode is not yet registered, register it first with node src/register.js releases.silentmode "{...}".
  • If the full HTML exceeds the OP_RETURN size your relay policy accepts, store a compact record instead — e.g. {"u":"https://dl.silentmode.st/releases-manifest.json"} — but the trustless ideal is the hashes themselves on-chain.
  • Do this from D:\Dev\SilentMode\Argus, never D:\Dev\NameCoin (live).

Step 3 — Optional per SECURITY.md §5 (multi-channel)

  • Create a torrent/magnet of each installer; add the magnet to the manifest + download page.
  • Mirror to IPFS (ipfs add) and Sia; list all mirrors, all verified against the on-chain hash.
  • Sign releases-manifest.json with your pseudonymous minisign key.

Build reproducibility note (for whoever rebuilds)

npm run dist fetches electron-builder's winCodeSign package, whose macOS symlinks fail to extract on Windows without admin/Developer Mode. Since builds are unsigned by choice (SECURITY.md §2), pre-extract it once without the darwin folder, then the build runs clean:

CACHE="$LOCALAPPDATA/electron-builder/Cache/winCodeSign"
node_modules/7zip-bin/win/x64/7za.exe x "$CACHE"/<downloaded>.7z -o"$CACHE/winCodeSign-2.6.0" -xr!darwin -y

Build with a fixed SOURCE_DATE_EPOCH (set to 2026-08-05 / 1785888000 for this release) and CSC_IDENTITY_AUTO_DISCOVERY=false so timestamps don't fingerprint the build and no signing identity is sought.