wai-quantum-desktop: installers on a tag for macOS, Linux and Windows, signed updates, the cask and the Scoop manifest #549

Merged

dcharlot merged 6 commits from wai/quantum-desktop-release into main 2026-10-30 12:04:28 -04:00

Conversation 0 Commits 6 Files changed 28 +1943 -41

2026-10-30

Transaction Science

wai-quantum-desktop: the update manifest served by the website, not a standing pre-release ...

The app asked latest.json on a pre-release, wai-quantum-desktop-latest, which
each signed release replaced. That release would have sat in the repository's
release list beside the versioned ones. Now:

- the app asks https://wai.transaction.science/quantum-studio-desktop/latest.json;
- each signed release attaches its own latest.json and nothing else;
- the website takes it from that release when it is next deployed, with
  scripts/sync-desktop-update.sh <version> in its repository. That script
  refuses a manifest for another version, an update not on that release, a
  signature not made for that version, or a version older than the one the
  site serves.

manifests.py loses its pointer file and the check for a newer manifest, which
moves to the website's script. publish.sh loses RELEASE_PRERELEASE and
RELEASE_BODY, which only that release used.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

6073a83fdc

• View at this point in history

2026-10-30 10:49:03 -04:00

Transaction Science

wai-quantum views: the page rebuilt in the image CI rebuilds it in ...

The views workflow rebuilds the page on its Linux image and compares
the engine inside it by bytes. The page from the previous commit was
built on macOS: its script and styles are the same bytes as the Linux
build's, its engine is not. Built now in catthehacker/ubuntu:act-22.04,
so the workflow's rebuild matches it in every part.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

d574c08811

• View at this point in history

2026-10-30 10:36:42 -04:00

Transaction Science

wai-quantum-desktop release: the header names update-status among what each build runs ...

Co-Authored-By: Claude Opus 5.5 <[email protected]>

c8ccd3dd83

• View at this point in history

2026-10-30 10:28:48 -04:00

Transaction Science

wai-quantum-desktop: the cask without a run of blank lines ...

A release whose updates are not signed wrote two blank lines where
`auto_updates true` would go. The test now holds every cask it writes to
no run of blank lines, and to how it ends, and parses it as Ruby where
ruby is installed (18 checks).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

90c57562eb

• View at this point in history

2026-10-30 10:27:39 -04:00

Transaction Science

wai-quantum-desktop: installers on a tag, the cask, the Scoop manifest and CI on three platforms ...

- .github/workflows/wai-quantum-desktop-release.yml, on a tag
  wai-quantum-desktop-v<version> equal to Cargo.toml's and
  tauri.conf.json's: a disk image for macOS (aarch64 and x86_64, with the
  GPU state vector); an AppImage, a Debian and an RPM package for Linux
  (x86_64 and arm64); an installer and a portable archive for Windows.
  Each build runs what it made (check, update-status, the code signature,
  the disk image's checksums, the AppImage, the Debian package unpacked),
  then attaches it with its SHA-256 over the private network.
- Signing is skipped, and the log says so, while its secrets are absent:
  WAI_QUANTUM_DESKTOP_UPDATER_KEY (and its password) signs updates, and
  the built app's verify-update checks every one before it is attached;
  the APPLE_* secrets sign and notarise the macOS app.
- release/manifests.py writes the Homebrew cask, the Scoop manifest and
  latest.json from the release's assets, from templates beside it, and
  the last job attaches them and puts latest.json on the pre-release the
  app asks unless that one names a newer version. Nothing is pushed to the
  tap or the bucket. release/manifests_test.py holds it to releases made
  up here.
- wai-quantum-studio.yml: the desktop app's tests, clippy, check and
  update-status on Linux (act-22.04 with the web view's libraries) and on
  Windows as well as macOS, the update tests required by name; the Linux
  leg runs the manifests test, and the Studio job test/update.test.mjs.
- The desktop README: the installers, which copies update themselves,
  the command that makes the update key and every secret's name. The
  changelog entry.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ff8cde2371

• View at this point in history

2026-10-30 10:26:02 -04:00

Transaction Science

wai-quantum-desktop: signed updates, offered in the Studio ...

A copy installed by its own installer (the macOS app, the AppImage, the
Debian or RPM package, the Windows installer) asks latest.json on the
pre-release wai-quantum-desktop-latest for a newer version as it opens.
The Studio offers it in a bar above the frame (src/update.js, its words
in English and Chinese); nothing installs until the person says so, and
then only an update whose signature verifies with the public key in
tauri.conf.json and names the version announced (requireSignedVersion),
after which the app restarts into it.

- The updater plugin 2.14.0 registered; commands update_check and
  update_install. A copy built from source or unpacked by a package
  manager does not update itself, and the check answers why
  (installed_by / updates_itself).
- verify-update FILE SIG VERSION: the same signature and version check
  from the command line, for the release to run on every update it signs.
- update-status: the installer this copy came from, as JSON, for the
  release to ask of each installer's copy.
- tauri.conf.json: the updater's one https endpoint, an empty public key
  until the owner makes the release key, update artifacts off unless a
  release turns them on, the macOS app signed ad hoc unless a Developer ID
  is given, and the publisher and homepage the packages carry.
- icons/icon.ico and icons/icon.icns, made from icons/icon.png by the
  bundler's icon command: a Windows build needs the .ico for its resource
  file (the app had not been built on Windows before), and the macOS app
  takes the .icns.
- Tests: the published test vectors held to the key and the signed
  version (tampered bytes, another key, another version, no version, no
  key, bad base64 all refused); which copies update themselves; the
  configuration's endpoint and flags; test/update.test.mjs for the bar.
- New crates in the lockfile at versions at least two weeks old, except
  webpki-root-certs at 1.0.10, the first release with RUSTSEC-2026-0383
  fixed.
- The Studio's README and its translation say what the bar does.
- The views page rebuilt (bash wai/wai-quantum-views/build.sh), since it
  is built from the Studio's English words and styles.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

97935030d3

• View at this point in history

2026-10-30 10:23:52 -04:00