Prelude
This wasn't an easy release.
The last commit on tag/v0.0.23 was made in paranoid mode, with the utmost effort to properly close the doors on your battlefield—if it comes to that—or to set the table for the next captain: someone with a fierce and generous review process, just as you taught me.
krux-installer v0.0.23
This release marks the shift to an offline-first installer: firmware binaries are now embedded directly in the package instead of being downloaded at runtime, and everything that supported the old online flow has been removed.
Features
- Firmware
.kfpkgpackages are now embedded directly into the installer build (#247), with SHA256 checksums of every package computed and verified before embedding (#285). - Migrated the build tooling from Poetry to UV, including Dependabot fixes for the new setup.
- Added structured logging and build verbosity control to CI builds (#261).
Fixes
Cleanup (Dead code from the old online flow)
- Removed the download screens and their e2e tests (#278), plus the download, selector, and unzip utilities along with their unit tests (#279).
- Removed the runtime signature-verification (signer) dead code (#277).
- Removed the internet-connection check at startup (#276) and orphaned i18n entries (#280).
Docs
- Added contributing guidelines, documented the embedded-binaries approach (#264), and specified the new offline workaround (#282).
Dependencies & CI
- Routine bumps: cryptography 46→49, pyinstaller 6.19→6.21, requests, black, pylint, poethepoet, Python 3.14.3, pysudoer 0.0.3, and GitHub Actions.
Full Changelog: v0.0.22...v0.0.23
Tests
How much are you prepared to trust—or not to trust?
How to Install
Download the proper binary for your OS, along with its signature file.
Then proceed with signature verification. My key can be found here:
gpg --import qlrd.gpg
and then:
gpg --verify <SHA256 file sign>
Canon
If the signature is correctly verified, proceed with integrity verification: read the tag/v0.0.23 commit message carefully and compare the reproducibility hashes shown there (and in the CI logs) against your own.
Note from @qlrddev (no puns, trust me).
I loved this project from the bottom of my heart. My own history as bitcoiner started here. So it's very painful.
Made for someone. And some people in the world got it to install firmware.
Passed it to another dev so it could be properly continued while I was trying to be with some old friends that I never understood.
So I studied, and once again returned to be by my brothers' side. But only for a short time. This was painful too.
Please excuse any grammar mistakes. Every QA step, gpg sign, release upload, and even write this release note hurts in a deeply human way. The people mentioned below were family to me.
So please, I ask once more: read the tag/v0.0.23 commit message carefully.
I would like to thank you all, from a historical point of view: @ghost, @kkdao, @odudex, @tadeubas and @jdlcdl. I will really miss you guys and the order is just a consensus to start to know those devs.
Special thanks to @joaozinhom, who put the most effort into this release and who taught me how to be a better person and a better dev.
Maybe there're another people that helped like @bitcoisas, @vinteumorg and @OpenSats, but i will not remember now others. They was too good to me.
And last but not least, @0xaudron, who provided a fierce review during a sensitive moment.
Let's catch up when we're back — but if not, it was an honor anyway.
Har har mahadev(s)
