Skip to content

v0.3.4

Choose a tag to compare

View all tags
@steipete steipete released this 18 Jul 08:50
v0.3.4
This tag was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: WmI9lVtd7F2c5XyRHbZVO3yYYJzwsSNzcZQMPT147HI
Verified
Learn about vigilant mode.
95275bf
This commit was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: buNEi6/r+uo+ILUkRvDkyyOc+SQ8kjWzo0lh99ci8NM
Verified
Learn about vigilant mode.

Highlights

  • Ship official macOS binaries signed by the OpenClaw Foundation, notarized by Apple, and independently verified on native Apple Silicon and Intel hosts before publication.
  • Preserve older archive history during routine bounded imports by merging new data by default and reserving destructive replacement for explicit --replace restores.
  • Complete Telegram Desktop imports safely when expired or service-style document media has no document payload.
  • Harden release provenance from the signed source tag through verifier-approved, identity- and digest-bound assets and the final Homebrew handoff.

Archive safety

  • Preserve chats and messages outside bounded import windows, pin and verify source identity, and keep full archive replacement behind explicit --replace. (#21)
  • Avoid nil-pointer panics while importing Telegram Desktop document media without a document payload. (#22; thanks @sw1pp3r)

Signed release pipeline

  • Notarize every official macOS binary before GoReleaser archives it, then verify exact Foundation signing metadata, the canonical designated requirement, strict code validity, and online notarization.
  • Create releases as drafts, require independent native Apple Silicon and Intel verification before publication, and require a distinct published-release verifier before Homebrew updates.
  • Pin signed release tags to the repository release key and exact tag object and commit, bind every platform archive to the expected Go main package, toolchain, target, and revision, and reproducibly rebuild non-Darwin payloads.
  • Source release notes from the revalidated tag, preserve the tag and notes through draft publication, and wait for verifier runs before accepting their step-bound proof.
  • Bind publication and Homebrew handoff bytes to the verifier-approved release record and exact asset identities, sizes, and digests, then require tap workflow and commit provenance to match the protected source.
  • Reject ambient Go build controls and executable hooks, pin verifier API reads to Telecrawl, and run native candidates only after frozen static, reproducible-build, and protected-helper proof.

Dependencies

  • Update CrawlKit to v0.14.3, gotd to v0.161.0, modernc SQLite to v1.54.0, and golang.org/x/crypto to v0.54.0, with all direct dependencies on their latest stable releases. (#19, #23)

Full changelog: https://github.com/openclaw/telecrawl/blob/v0.3.4/CHANGELOG.md

Contributors

sw1pp3r
Assets 9
Loading