Decksmith v0.1.0-preview.3

Early preview for Fedora Workstation 44, GNOME/Wayland, x86_64 and Stream Deck +.

Changes:

• Fix compact key/dial forms shifting sideways and clipping labels.
• Update installation, recovery and accessibility guidance.
• Keep saved assignments, artwork and running controls intact during installation.

Validation: 121 Rust tests passed (one hardware test ignored), strict Clippy and formatting, 142 editor tests, 15 installer/companion tests, dependency audit and GitHub CI. The exact package passed Fedora 44 VM installation, VirtualDeck and native compact-editor checks.

Install as your normal desktop user:

curl -fsSL https://raw.githubusercontent.com/infamous-pattern/decksmith/v0.1.0-preview.3/scripts/install.sh | sh

Save edits, then close and reopen Decksmith after updating. Background controls and startup preferences are preserved; the installer does not enable startup or restart controls automatically.

This remains an early preview. Full screen-reader certification, automatic spoken validation errors and broad hardware coverage remain open. Review SECURITY-REVIEW.md and the installation guide. Checksums detect corruption; assets are not independently signed. Preview.2 and its interface walkthrough remain available.

Decksmith v0.1.0-preview.2 — security hardening

Security-hardened follow-up to the first public preview. Preview.1 remains available for traceability; new installations should use preview.2.

Fixes

• Require complete checksum coverage before executing downloaded installer files; reject incomplete, duplicate and malformed manifests.
• Reject SVG document types at the XML parser level, including UTF-16 encodings.
• Restrict website-icon redirects to anonymous HTTP(S) requests.
• Require authorization for the optional Homebridge panel entry page and state endpoint.
• Remove private build-machine paths from release executables; enforce this during packaging.

Install (Fedora x86_64)

curl -fsSL https://raw.githubusercontent.com/infamous-pattern/decksmith/v0.1.0-preview.2/scripts/install.sh | sh

The installer preserves layouts and leaves login startup unchanged. It asks DNF to install missing dependencies. Review the script or use the manual INSTALL.md instructions if preferred.

Review evidence

The release includes SECURITY-REVIEW.md and dependency-inventory.json. Main Rust dependency auditing, the optional companion's retained Rust source audit, and its pinned WebSocket dependency audit reported no known vulnerabilities. Native tests cover malformed downloads, XML encodings, redirect restrictions and real loopback HTTP authorization. Published binaries have PIE, full RELRO and non-executable stacks. The rebuilt runtime passed Fedora 44 installation and resource checks.

The experimental Homebridge companion is installed and updated separately. Updating the main app does not update an existing companion; its authorization fix must be included in a companion rebuild. General plugin support remains planned for V1.5.

This engineering review is not an independent penetration-test certification. Releases remain unsigned, Fedora manages system libraries, and plugins run with desktop-user permissions. See the full review for scope and remaining boundaries.

Report a vulnerability privately · Support Decksmith

Decksmith v0.1.0-preview.1

Decksmith’s first public preview brings native Stream Deck + controls to Fedora/GNOME.

This is v0.1.0-preview.1, intended for testing and feedback—not V1 stability.

Included

• Integrated Home, Pages, Keys & Dials, Plugins and About workspace.
• Page themes, custom artwork, 14 font choices, keyboard navigation and clear save feedback.
• Application audio, system sounds, media and GNOME system actions.
• Touch-strip feedback, startup controls, Auto-Lock and device recovery.
• Optional experimental Homebridge companion; general plugins are planned for V1.5.

Install on Fedora 44 x86_64

Quick install as your normal desktop user:

curl -fsSL https://raw.githubusercontent.com/infamous-pattern/decksmith/v0.1.0-preview.1/scripts/install.sh | sh

The script verifies downloads and asks DNF to install missing dependencies. You can inspect it first.

For manual installation, download the .tar.gz bundle, decksmith-install.py, package_io.py, INSTALL.md and SHA256SUMS into one folder. Follow INSTALL.md for dependencies, installation and recovery. Check downloads with sha256sum -c SHA256SUMS after downloading every listed file.

Installation preserves existing layouts and does not enable login startup. Close other Stream Deck controllers before starting background controls. This is an unsigned runtime bundle, not an RPM.

Validation and limits

120 Rust tests, 140 editor tests, 13 installer tests, strict compiler checks and dependency auditing passed. Native compact-window checks passed in light/dark mode. Fedora 44 VM installation, dependency checks, integrity and VirtualDeck passed.

Reference hardware: one Stream Deck +. English only; localization is planned for V2. Other models, distributions and full fractional-scaling/accessibility certification remain unverified. Homebridge is experimental and uses a separately installed companion.

Please read the reviewer guide and report issues with reproduction steps and your environment. Remove credentials and private information from logs and screenshots.

Support Decksmith