Vega 1.0.0

A packaging and distribution release. The protocol, crypto and transport code
are unchanged from 0.1.0; what changed is that there is now something to
download and instructions for using it.

Nothing here has been audited. That was true at 0.1.0 and it is still true —
read SECURITY.md and the
threat model before trusting this with
anything that matters. A 1.0 version number is not a review.

Added

• Installers for Linux, macOS and Windows, attached to every tagged release
  under names that do not change between versions, so a download link written
  once keeps working: Vega-linux-x86_64.AppImage, Vega-linux-amd64.deb,
  Vega-macos-universal.dmg, Vega-windows-x86_64-setup.exe. The macOS build
  is universal, so there is one download for Intel and Apple silicon.
• SHA256SUMS.txt on each release, covering every artifact. Neither the
  macOS nor the Windows build is signed, so a checksum you check against a
  second source is worth more than the warning the operating system shows.
• Installation instructions — per-platform
  steps, how to get past the Gatekeeper and SmartScreen warnings, where the
  account data lives, and the fact that deleting that directory destroys the
  account with no recovery.
• A complete icon set. Only a single PNG was present, so the Windows and
  macOS bundles could not have been built at all — those bundlers require
  .ico and .icns respectively.
• Bundle metadata: category, publisher, homepage, licence and descriptions,
  which is what makes the .deb declare its WebKit and GTK dependencies so
  apt resolves them.

Changed

• ./make dist stages what it builds into release/, under the same names
  the release workflow uploads and with a SHA256SUMS.txt beside them, so a
  locally built installer and a released one are interchangeable.
• The release workflow creates its draft release once, in a job of its own,
  before any platform build starts. Previously all three build jobs raced to
  create it, which duplicates the release or fails two of the three. It also now
  verifies the tag against every file carrying the version before spending three
  runners on a build whose file names would contradict it.

Fixed

• A development build launched on its own now says so. Running
  cargo run, or the binary in target/debug/, starts the Rust half correctly
  and then opens a window on "Could not connect to localhost", because a dev
  build loads its frontend from the vite dev server rather than containing it.
  The port is now checked at startup and the reason printed, with the two
  commands that do work. Release builds embed the frontend and are unaffected.
• The nightly rustdoc and unused-deps jobs never ran: both compile the
  desktop crate, which links against the system webview, and neither installed
  it. They failed in pkg-config before reaching the thing they were meant to
  check.

---

Downloads

Platform	File
Linux (any distribution)	Vega-linux-x86_64.AppImage
Debian, Ubuntu	Vega-linux-amd64.deb
macOS (Intel and Apple silicon)	Vega-macos-universal.dmg
Windows	Vega-windows-x86_64-setup.exe

Neither the macOS nor the Windows build is signed, so the first open
will show a warning from the operating system.

SHA256SUMS.txt lists the checksum of each file above.

Nothing here has been audited. Read
SECURITY.md
before trusting it with anything that matters.