Krux-Installer v0.0.1-alpha-6

What's Changed

• Updated from Urgent Security Issue by @qlrd in #29

Critical WebP bug: many apps, not just browsers, under threat.

The heap buffer overflow (CVE-2023-4863) vulnerability in the WebP Codec is being actively exploited in the wild.

Full Changelog: v0.0.1-alpha-5...v0.0.1-alpha-6

Verify integrity/authenticity

The process can change depending of used OS; lets call a general `

Integrity

Download the properly <binary>.sha256.txt:

wget https://github.com/selfcustody/krux-installer/releases/download/v0.0.1-alpha-6/<binary>.sha256.txt

Check sum:

sha256sum --check <binary>.sha256.txt <binary>

Signature

Import the public pgp key:

gpg --keyserver hkps://keys.openpgp.org --recv-keys "B428 1DDD FBBD 207B FA41 1313 8974 C902 9932 6322"

Download signature:

wget https://github.com/selfcustody/krux-installer/releases/download/v0.0.1-alpha-6/<binary>.sig

Verify:

gpg --verify <binary>.sig <binary>

Krux-Installer v0.0.1-alpha5

What's Changed

• New UI by @qlrd in #20
• Bump vite-plugin-electron from 0.13.0-beta.3 to 0.14.1 by @dependabot in #21
• Fixing tests by @qlrd in #27

New Contributors

• @dependabot made their first contribution in #21

Full Changelog

v0.0.1-alpha-4...v0.0.1-alpha-5

Additional changes, but important

• Fixed some duplication of event calls that can lead to 'freeze' device on a 'suspended' state;
• Simplified the way of unzip and flash (unecessary files will not be zipped and user do not need to click a button to unzip, only select device, version, verify and flash);
• added pgp signature to verify the authenticity of files;
• used some updated librarires like electron-vite to build;
• updated to electron 26;
• build and test simplified;
• created MacOS release (Caution: untested in a real machine, can have bugs).

How to verify release with signature

Here are some steps to verify the binary. All steps are in Unix like system, but with windows you can verify with Gpg4Win:

Import the pgp public key:

gpg --keyserver hkps://keys.openpgp.org --recv-key "B428 1DDD FBBD 207B FA41 1313 8974 C902 9932 6322"

Alternatively, you can download public key here and execute:

gpg --keyid-format long --list-options show-keyring B4281DDDFBBD207BFA4113138974C90299326322.asc
gpg --import B4281DDDFBBD207BFA4113138974C90299326322.asc

Download binary

Download the pair of binary/signature:

• Linux: krux-installer-0.0.1-alpha-5.AppImage and krux-installer-0.0.1-alpha-5.AppImage.sig
• Windows: krux-installer_0.0.1-alpha-5.exe and krux-installer_0.0.1-alpha-5.exe.sig
• MacOS: krux-installer_0.0.1-alpha-5.dmg and krux-installer_0.0.1-alpha-5.dmg.sig

Verify:

gpg --verify <binary filename>.sig  <binary filename>

Krux-Installer v0.0.1-alpha-4

Big thanks to @odudex and @tadeubas for suggestions, performing user tests and important UX notes.

Summary of Major updates:

1. Removed oldest firmwares options;
2. firmwares to choose will be only the latest official and odudex/krux_binaries;
3. improved E2E tests;
4. added support to maixpy_dock (by executing ktool with -dan option during flash);
5. using electron 24.1.2

What's Changed

• Linux appimage wdio by @qlrd in #5

Full Changelog: v0.0.1-alpha-3...v0.0.1-alpha-4

Linux Files:

• KruxInstaller-0.0.1-alpha-4.AppImage
• KruxInstaller-0.0.1-alpha-4.AppImage.sha256.txt

Windows Files:

• KruxInstaller Setup 0.0.1-alpha-4.exe
• KruxInstaller Setup 0.0.1-alpha-4.exe.sha256.txt

Krux-Installer v0.0.1-alpha-3

This release has the following characteristics:

Linux

• No major changes;
• Built with AppImage extension.

Windows

This release was made especially for Windows users:

• packaged a known-good version of openssl with the Windows build within Github-Action (see this comment);
• This process was done entirely in Github virtual machines, being fully verifiable and mitigating possible malicious code (see this action);
• Built as NSIS Setup Installer with exe extension;

Big thanks to @odudex for performing user tests and important UX notes and @jreesun for the idea of openssl's packaging approach (and also for a similar historical description of his personal experience in krux development).

Krux-Installer v0.0.1-alpha-2

This release is a first working version for both Linux and Windows OS.

• Linux build is released as Standalone application with an .AppImage extension;
• Windows build is releasead as NSIS Setup Installer with .exe extension.

CHANGELOG:

• Using electron v22.0.0;
• Application size has been reduced to < 100MB;
• For Windows, an openssl's existence check takes place:
  • needed to verify the signature of official krux releases;
  • non-existence will invite the user to download a compatible version of two options first:
    • openssl included in Git-scm; or
    • available versions of OpenSSL For Windows.

TODO:

Request that testers on windows can give their opinion about what's better:

1: Include an openssl binary internally to KruxInstaller

• PROS:
  • Facilitating the user experience
• CONS:
  • Giving up the self-verification of installed programs.

2: Asking to install only one openssl recommendation

• PROS:
  • A compromise between facilitating the user experience and allowing self-checking of installed programs.
• CONS:
  • Requires one or more steps before using KruxInstaller.

3: Asking to install one openssl from many options:

• PROS:
  • Allows freedom of choice between options and self-verification;
  • Opens the possibility of including a user configuration, being able to modify choices.
• CONS:
  • Requires one or more steps before using KruxInstaller;
  • Giving up the user experience, which can lead to confusion.

Krux-Installer v0.0.1-alpha-1

This release is a first working version that does the following:

• Select the maixpy's firmware device (m5stickv, amigo, dock, bit)
• Select between official or test versions
• Flash in a friendly way the selected firmware with the selected version on device

For now, only one Linux version (.AppImage) will be available.

I'll be working to release as soon as possible for Mac and Windows (developers who own these operating systems are welcome if they can help).

For those interested in the binary building process, I recommend checking out this github action job