TinyPiRelay 0.5.17-dev — browser-first setup

TinyPiRelay 0.5.17-dev — browser-first setup

MIT-licensed development prerelease for controlled Raspberry Pi evaluation,
not a stable/general release. Source commit: 215787dd96e0c551522c4ef0fb7320bcb770ea5c.

Fresh installation now installs prerequisites automatically, permits no microphone
or prepared configuration, and serves the web GUI on trusted-LAN IPv4 port 80.
First access creates the administrator account, then normal login is required.
Existing accounts, recordings, settings and legacy localhost access are preserved.

Install on a fresh device

Use Raspberry Pi OS Bookworm or Trixie; Trixie 64-bit is the current Pi 4 evaluation
target. Configure SSH, networking, a unique hostname and an OS administrator in
Imager. Run the following on the Pi after SSH, not in Windows PowerShell.
It prepares the HTTPS downloader only if missing, verifies the pinned installer,
and runs it. No Git checkout, microphone, local config file or initial SSH password
creation for TinyPiRelay is required.

Review the installer and trust this repository before granting it root access.
Checksums and HTTPS verify the expected download; they are not an independent
publisher signature. HTTP passwords/sessions are unencrypted, and the first LAN
client reaching an unconfigured device can create its account. Set up promptly on
a trusted network. Do not expose the service to the Internet.

(
    set -eu
    PATH=/usr/sbin:/usr/bin:/sbin:/bin
    export PATH
    tpr_sudo=sudo
    [ "$(id -u)" -ne 0 ] || tpr_sudo=
    if ! command -v curl >/dev/null 2>&1 || [ ! -s /etc/ssl/certs/ca-certificates.crt ]; then
        $tpr_sudo apt-get -o APT::Update::Error-Mode=any -o Acquire::Retries=2 \
            -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 update
        $tpr_sudo apt-get --yes --no-remove --no-upgrade --no-install-recommends install curl ca-certificates
    fi
    umask 077
    tpr_download_dir=$(mktemp -d /tmp/tinypirelay-download.XXXXXX)
    cd "$tpr_download_dir"
    curl --disable --fail --silent --show-error --location \
        --proto '=https' --proto-redir '=https' --connect-timeout 20 --max-time 300 \
        --max-filesize 1048576 --output install-tinypirelay-0.5.17-dev.sh \
        https://github.com/gall-levi-code/TinyPiRelay/releases/download/v0.5.17-dev/install-tinypirelay-0.5.17-dev.sh
    printf '%s  %s\n' 'cf46521af88aad8d9496185b89ffc9e91d97ccdc896edfdfa38955e3f2001fb7' 'install-tinypirelay-0.5.17-dev.sh' | sha256sum --check --status
    $tpr_sudo /bin/sh ./install-tinypirelay-0.5.17-dev.sh
)

Open http://<hostname>.local/ or http://<device-ip>/, create your username
and password (at least 12 characters), then sign in. Attach and configure audio
later from Audio → Refresh audio inputs; discovery does not certify new modes.

Full installation, SSH-only access, upgrades and rollback guide.
For an existing install, use the guide's explicit upgrade procedure; no account
reset or automatic LAN migration is needed.

Artifact identity

Installer SHA-256:
cf46521af88aad8d9496185b89ffc9e91d97ccdc896edfdfa38955e3f2001fb7

Archive SHA-256 (tinypirelay-0.5.17-dev.tar.gz):
b8b01f69640ffc73d84366f8340bfa1639ce45addde0b05c47cfb5279b787392

Use the three attached installation assets, not GitHub's automatic Source code
archives. The launcher embeds the archive URL and digest and checks bounded,
safe extraction. The custom archive contains the required tinypirelay-0.5.17-dev/
root. The release is built from the tagged source; raw checksum-linked evidence
bytes are retained while source text uses LF. Private paths/endpoints were removed
from the public evidence copies and explicitly labeled; originals stay private.

Validation and limits

The public-source checkout passed 501 tests on each platform: Windows in 87.412 s
(52 environment skips), isolated network-disabled Linux in 105.570 s (four skips).
Offline dashboard checks and linked evidence-checksum checks also passed.
Independent Windows/Linux builds produced identical archive bytes. The final
archive passed its checksum and 21 packaging, bootstrap and evidence tests after
extraction in isolated Linux; shell syntax checks passed as well.
Earlier Chromium first-account/login and idle-audio checks passed. No application
runtime code changed during publication. Fresh physical installation, APT/port-80/
mDNS checks, Firefox onboarding verification, and broader hardware/endurance
acceptance remain pending. Publishing this release did not modify the working Pi,
which remains on 0.5.16-dev. No release signing key or CI acceptance is claimed.

Release-readiness boundaries.