Repository navigation
Релиз BYDLO 0.4.3 - #491
Merged
Merged
Conversation
Show download progress, the last check time and the reason updates are unavailable, and add an explicit download that ignores the daily window. A cancelled download no longer consumes the 24-hour window, so closing the window mid-download does not block the next attempt. Closes #456
The switch stores a preference that applies once the Setup.exe build is installed, so disabling it removed keyboard coverage from the headless verification harness without helping the user. The hint and the disabled download button already state that this copy cannot update itself. A capability probe now answers false on any failure instead of letting an unexpected exception break the settings page.
Add a pull_request_target workflow that closes issues linked from the pull request body as soon as the base is exactly `developer`, so the tracker reflects work in flight instead of waiting for a merge that GitHub's bot merge never applies closing keywords to. The parser is a pure script fetched from the default branch through the API; the job has no actions, never checks out pull request code and never interpolates pull request text into the shell. Only the current author with write, maintain or admin rights can close anything, and pull requests, closed issues and foreign references are skipped. Closes #449
Сделать автообновления видимыми: прогресс, состояние и ручная установка
Закрывать связанные issues при создании PR в developer
Audit of the resolved developer graph found no reachable vulnerability, but golang.org/x/crypto 0.42.0 and golang.org/x/net 0.44.0 matched 20 and 17 advisories at package level. None of them touch a package that is compiled into the host, yet the bump is cheap and removes 52 of the 53 matches. x/crypto 0.42.0 -> 0.58.0, x/net 0.44.0 -> 0.62.0. The compiled package set is unchanged (147 packages), go mod verify and go vet are clean, and all five target RIDs build. The remaining match, GO-2026-5932, concerns the unmaintained openpgp package and cannot be fixed by a version bump. Refs #430
buildGoModule pins a fixed-output hash of the vendored module set, so the x/crypto and x/net bump invalidated it. The new value is the hash Nix reported for the regenerated vendor tree. Refs #430
Bump AmneziaWG Go dependencies past advisory ranges
# Conflicts: # src/Bydlo.Core/Diagnostics/AutomaticAppUpdater.cs # tests/Bydlo.Tests/AutomaticAppUpdaterTests.cs
Pick up releases published soon after an empty update check
docs: направить изменения в developer и описать выпуск релизов
Repin the sing-box release archives and the source tarball to v1.14.4 for all five desktop RIDs. Digests were recomputed from the downloaded assets and match the SHA-256 values published by GitHub; archive layout and the GPL-3.0-or-later license text are unchanged. sing-box 1.14.4 now rejects duplicate member tags in selector and urltest groups. Generated group configs already cannot contain them, but imported user JSON could, so the importer rejects duplicates before the profile is saved instead of failing at engine start. The removed `direct` rule action is not used: BYDLO routes through `outbound`. Upstream GUI, Android and server-only additions are not claimed.
Update pinned sing-box to 1.14.4
sing-box 1.14.4 dropped the unimplemented `direct` rule action, so a custom config with `route.rules[].action: "direct"` now fails to parse with "unknown rule action: direct". BYDLO accepted it at import time and kept the rule in the generated config, so the profile was saved and the engine failed only on start. The importer now rejects that value for sing-box configs. The same check runs when a stored config is rebuilt, because SingBoxConfigBuilder calls the same reader, so a previously saved profile fails with the existing `import.json.unsafe` error before the engine starts. The `direct` outbound type and routing through `outbound: "direct"` are untouched, and the check is skipped for Xray configs.
…ction Reject the removed direct rule action in custom sing-box JSON
…private Move sing-box FakeIP IPv6 range out of ULA
Update setup-dotnet to v6.1.0
Fix AmneziaWG helper DNS verification (#466)
…pdates Update MVVM, QR and Windows dependencies (#426)
Migrate Azure/login to pinned v3.1.0 (#428)
Support pinned AmneziaWG v3 fields safely (#467)
Обновить лицензии компонентов и упростить слоган
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.49.0 to 0.50.0. - [Commits](golang/sys@v0.49.0...v0.50.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 8beda2b7ed98355c0e97c0a63bec38ae472e66c4 to 4d101475d8b20a2381f78447822ac1eab6504dd8. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@8beda2b...4d10147) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4d101475d8b20a2381f78447822ac1eab6504dd8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
A one-shot ready line printed before IProcessRunner.Start returned was raised with no subscriber and lost, so AmneziaWG failed its readiness timeout. IManagedProcess.BeginEventDelivery now starts stdout/stderr reading and exit reporting only after ProcessEngineBase subscribes. Adds deterministic regressions for early READY, fatal, exit and duplicate delivery.
…amneziawg/developer/golang.org/x/sys-0.50.0 Bump golang.org/x/sys from 0.49.0 to 0.50.0 in /tools/amneziawg
…veloper/actions/attest-build-provenance-4d101475d8b20a2381f78447822ac1eab6504dd8 Bump actions/attest-build-provenance from 8beda2b7ed98355c0e97c0a63bec38ae472e66c4 to 4d101475d8b20a2381f78447822ac1eab6504dd8
Fix lost AmneziaWG ready line on early stdout (#468)
The client downloads releases-catalog.json, verifies its ECDSA P-256 signature against compiled-in trust roots, checks expiry, channel, RID and that the version is newer, and requires Velopack's asset to match the signed name, size and SHA-256 before DownloadUpdatesAsync and again before applying. The release job signs the catalog from the final packages with the BYDLO_UPDATE_SIGNING_KEY secret and fails without it; manual rehearsals use a throwaway key. CI checks that a catalog signed by the release script verifies in Bydlo.Core.
Pins the official 2.7.9-I001 amd64/arm64 MSIs and the 2.7.9 source tarball after checking Authenticode, GPG signatures and SHA-256. The shipped file set is unchanged (OpenSSL 3.6.5, ovpn-dco 2.8.14). Documents which 2.7.9 security fixes reach the console engine and adds fake-runner tests for argument passing, auth-user-pass cleanup and --service.
A fresh profile starts with all three GitHub-backed features off; the first-run screen offers three unticked checkboxes with links to the exact GitHub sources. Each consent gates only its own requests, revoking one stops future requests and blocks a staged update, and upgraded profiles keep the access they already had.
LogHub keeps one shared FileStream written by a background task over a bounded channel with rotation, and raises coalesced EntriesAdded batches every 150 ms instead of one UI post per line. Engine lines stay redacted at the source (helper-hosted secrets are unknown to the UI process) and are stored via WriteRedacted without a second pass. Adds LogHub tests and a Windows benchmark against the old per-line append path.
AppInstallLocator classifies the copy from package markers (Velopack, portable/old ZIP, deb, Arch, Nix, unknown) instead of a writable path. Only Velopack installs get the built-in updater, behind the existing opt-in, with one state model: available, downloading, ready on exit, failed/deferred. Package-manager installs get manager-specific manual guidance and never write managed files; portable copies get replace- the-folder instructions.
Settings navigation looks the Desktop section up by tag now that the GitHub consents section precedes it, and the auto-update check first proves the opt-in is disabled without the update consent.
Verify a signed update catalog before Velopack (#411)
Update bundled OpenVPN to 2.7.9-I001 (#420)
LogRedactor keeps a length-sorted snapshot of known secrets rebuilt on registration instead of copying and sorting it on every call, and skips each pattern when the text lacks a literal every match must contain. The wall-clock speedup benchmark depends on the machine's disk (a CI runner measured 9.8x), so it now runs only with BYDLO_RUN_BENCHMARKS=1.
Separate first-run consents for updates, notifications and themes (#438)
Speed up the log pipeline: background file writer and batched UI (#357)
Resolves conflicts with the signed catalog (#411) and first-run consents (#438): the update state model keeps the consent gate and shows the catalog's refusal reason in the Failed state, and the merged tests grant consent and the Velopack install kind explicitly. sign-update-catalog.ps1 now signs as UpdateTrustRoots.CurrentKeyId by default and refuses a secret that does not match CurrentPublicKeySpki, so a missed secret swap after rotation stops the release instead of publishing a catalog clients reject. The update-key-rotation skill documents planned rotation, compromise and a lost secret.
The signing script now defaults to UpdateTrustRoots.CurrentKeyId and refuses keys that do not match it, so the staging regression's throwaway key must name its own key id.
Detect update ownership and unify update states (#413)
Bumps the version to 0.4.3, allows unsigned Windows/macOS packaging for the exact tag refs/tags/v0.4.3, adds the 0.4.3 release notes and brings README, BUILD, CODE-SIGNING and the bug template to 0.4.3.
Подготовить неподписанный релиз BYDLO 0.4.3
endercodezz
enabled auto-merge
November 11, 2026 19:58
endercodezz
disabled auto-merge
November 11, 2026 20:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Выпуск 0.4.3. Неподписанный по решению сопровождающего: сертификатов нет, постоянная подпись Windows/macOS остаётся в #392.
developerсодержитmainцеликом, поэтому вливание — fast-forward без конфликтов.Основное:
releases-catalog.json(Проверять подлинность метаданных и пакетов до передачи обновления в Velopack #411). Его подпись сверяется с ключом, вшитым в приложение. Также проверяются версия, канал, платформа, имя, размер и SHA-256 пакета — до того, как Velopack что-либо скачает, и повторно перед установкой. Каталог подписывается в release-job секретомBYDLO_UPDATE_SIGNING_KEY; если секрет не совпадает с вшитым ключом, релиз останавливается..deb, Arch, Nix) и показывает для неё правильный способ обновления; состояния обновления едины (Объединить состояния обновления и учитывать владельца установки #413, Сделать автообновления видимыми: прогресс, состояние и ручная установка #457, Pick up releases published soon after an empty update check #460).Directory.Build.props.Подпись Windows/macOS для тега
v0.4.3пропускается явным исключением вsigning-policy. Возможны предупреждения SmartScreen, UAC и Gatekeeper; SHA-256 и GitHub attestations публикуются вместе с файлами.После вливания: тег
v0.4.3наmainзапускает сборку черновика релиза. Затем отдельно обновляетсяpackaging/arch/bydlo-bin(pkgver,updpkgsums,.SRCINFO).