Skip to content

v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jul 11:17
v0.4.0
c1c5400

Korvun v0.4.0

The fourth release. Korvun ships as Korvun Desktop — the same in-process core
behind a native window — alongside the unchanged headless binary. No breaking
changes: every existing headless setup runs exactly as before.

Highlights

Korvun Desktop — the same core, in a native window (ADR-0035, ADR-0036)

The full Go gateway now runs in-process behind a native desktop window: one
binary, one version, one release. Double-click, no terminal. What the app adds
over the headless binary:

  • First-run onboarding. A fresh launch writes a valid starting config and
    walks you through the first channel and brain — no hand-edited JSON.
  • Secrets in the OS keychain. A three-step assistant stores every bot token in
    the system keychain (Keychain on macOS, Credential Manager on Windows, Secret
    Service on Linux); the config only ever holds the variable name, never a
    value — the env-only secret contract is preserved exactly.
  • The visual builder, embedded. The same no-code builder runs same-origin
    inside the window, so brains, models, and routes are editable without a browser.
  • Live Inicio / Actividad. The dashboard shows the gateway status, per-window
    message counters, channel health and brains, and an Activity feed where each
    routing decision is explained where it happens.

Built with Wails on the system WebView, so there is no bundled browser.
The headless binary is byte-for-byte unchanged and is still the way to run
Korvun on a server.

Validated end to end on real hardware (2026-07-26, Intel iMac, macOS 13): the
universal Korvun.app from CI — double-clicked, token from the keychain, zero
terminal — completed a full Telegram round-trip through a local llama3.2:1b
brain.

Unsigned builds — clear the first-launch warning once

There is no paid platform signing (no Apple notarization, no Windows
Authenticode — a deliberate, cost-free decision, ADR-0035 §7). Integrity and
transparency are fully covered by cosign + the Rekor tlog; platform identity is
not, so each OS shows a first-launch warning you clear once:

  • macOS: System Settings → Privacy & Security → Open Anyway (or, on older
    macOS, right-click → Open → Open).
  • Windows: SmartScreen → More info → Run anyway.
  • Linux: no gate; needs a WebKitGTK runtime present.

Full per-OS walkthrough: docs/packaging/INSTALL.md.

Artifacts

Two families in one release. The headless six are unchanged; the desktop three are
new, built on native runners (cgo needs the host toolchain, so no ARM64 desktop
yet). <ver> is the version without the leading v (e.g. 0.4.0).

Family Artifact Target
Headless korvun_<ver>_{linux,darwin}_{amd64,arm64}.tar.gz, korvun_<ver>_windows_{amd64,arm64}.zip server / CLI, six OS·arch
Headless checksums.txt + .sig + .pem, per-archive *.sbom.json signed manifest + SBOMs
Desktop korvun-desktop_<ver>_darwin_universal.dmg macOS universal app
Desktop korvun-desktop_<ver>_windows_amd64-installer.exe Windows NSIS installer
Desktop korvun-desktop_<ver>_linux_amd64.tar.gz Linux binary + .desktop
Desktop checksums-desktop.txt + .sig + .pem signed desktop manifest

Draft-until-complete: the release is born a draft and is published only once
both families and their signatures are present, so a broken desktop build can
never expose a half-populated public release (ADR-0035 §8; SP7 §1e).

Compatibility

No breaking changes. The headless binary, its config schema, and the env-only
secret contract are unchanged. Korvun Desktop is a new way to run the same
core, not a change to it.

Verifying this release

Both families are signed keyless with cosign
(Sigstore) on the same free chain, each with its own manifest. Verify the manifest
signature you need, then check your download against it.

Headless:

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Desktop:

cosign verify-blob checksums-desktop.txt \
  --signature checksums-desktop.txt.sig \
  --certificate checksums-desktop.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full install and verification walkthrough: docs/packaging/INSTALL.md.

Assets 23
Loading