Three desktop targets, three different states, one destination.
macOS did not build at all. There was no workflow, only Cake's from-source
scripts and an Xcode project. It turns out most of the work was already done:
monero_c ships aarch64-apple-darwin and x86_64-apple-darwin, and
Runner.xcodeproj already references both dylibs with CodeSignOnCopy. So this
fetches the same prebuilt bundle the iOS and Android legs use, lipos the two
slices into universal libraries, and builds. One download serves Apple Silicon
and Intel, because a single-arch build looks correct on the machine that made
it and fails on half of everyone else's.
It signs with a Developer ID Application certificate, which is NOT the Apple
Distribution certificate the TestFlight workflow uses. They are not
interchangeable: an App Store cert on a directly downloaded app is refused by
Gatekeeper. Signing is inside-out by hand rather than --deep, which Apple
deprecated and which skips nested code it does not recognise. Then notarytool
with the App Store Connect key this repository already has, then stapler, so
Gatekeeper clears the app without a network round trip.
Every credential is optional and the preflight says, before spending forty
minutes, exactly which stages the run can reach and what the user will see if
it cannot reach them. Absent secrets downgrade the build loudly; they do not
fail it and they do not pass silently.
Windows and Linux already built. Windows already Authenticode-signs through the
Fleet broker. What both lacked was a way to get the artifact to anybody:
upload-artifact is the only publication and Gitea Actions artifacts here upload
and then list as zero, so the signed Windows zip has never been reachable. Both
now publish to the GitHub release, on the smirk pattern: tag-triggered, the
release must already exist so a half-populated one never goes public, and a
same-named asset from an earlier attempt is replaced rather than duplicated.
Windows does its API work in PowerShell because git-bash there has neither
python nor node guaranteed and ConvertFrom-Json is native.
Tags now build automatically on all three. A tag is the thing a release is cut
from, and the artifact that gets signed should come from it rather than from
whatever was dispatched by hand.
scripts/release/sign-release.sh detach-signs the collected artifacts and signs
SHA256SUMS, which is the signature that matters when a download reaches someone
from a mirror without its .asc. It verifies even immediately after signing: a
signature written but never checked invites trust it has not earned.
Not done here, and both need a human: GH_RELEASE_TOKEN does not exist in this
repository's Gitea secrets, and the release key's user ID still says Smirk.
CI ran tool/generate_new_secrets.dart unpinned, so every release binary
shipped different AES keys/salts for the stored PIN and wallet passwords.
Updating the app then failed to decrypt what the previous build stored:
'Invalid or corrupted pad block' at PIN entry and the 'Corrupted seeds'
dialog, with wallet files fully intact.
- entities/encrypt.dart: legacy-key fallback decode for PIN and wallet
password blobs (candidate sets recovered from the shipped 1.0.1 binary;
output validated to reject PKCS7 false positives)
- key_service/auth_service: on successful legacy decode, re-encrypt under
the pinned key — installs self-heal at first unlock
- all build workflows: inject the eight pinned CRYPTO_* repo secrets after
secret generation and hard-fail if any is missing, so crypto salts can
never silently rotate again (values pinned via
~keys/set-gitea-crypto-secrets.sh)
- bump 1.0.2+12
tool/generate_new_secrets.dart imports app packages (encrypt/convert/intl).
pubspec_gen.sh runs `flutter pub get` without set -e, so a silent hiccup there
surfaced downstream as 'Couldn't resolve the package encrypt' at secrets-gen.
Run `flutter pub get` explicitly (set -e) right before the tool on Android +
Linux, matching what the iOS flow effectively guarantees. The build container
already pins Flutter 3.32.0, so this resolves cleanly.
The previous Linux artifact was a zip of the Flutter bundle/ directory.
That's awkward to distribute — users have to unzip, find the binary,
chmod +x, and figure out the lib/ layout themselves. Replace with a
proper AppImage: single file, double-click to run, no install, no
Flutter knowledge required.
Build steps:
- Stage AppDir with the Flutter bundle under usr/bin/ (the binary's
RPATH=\$ORIGIN/lib already finds plugin libs there).
- Add .desktop file (Hash Bags / Office;Finance;) and 256x256 hash
icon scaled from the iOS marketing PNG.
- Download appimagetool and invoke with --appimage-extract-and-run
so it works inside the build container without FUSE.
Artifact name: hash-wallet-linux-appimage-<sha>.
Empty action-row buttons (Send/Receive/Swap/Scan) and empty bottom
navbar tabs are the same root cause on Linux + Android (+ likely iOS):
the workflows weren't running Cake's compile_graphics.sh, which is
what converts res/pictures/*.svg sources → assets/new-ui/*.svg.vec
precompiled vector assets that CakeImageWidget loads via
AssetBytesLoader.
History: commit 89e07fbba (Cake upstream, March 2026) moved to
precompiled SVGs, added compile_graphics.sh, and added a 'Compile
graphics' workflow step. Then 980c0278b added \*.svg.vec to .gitignore
(so the artifacts are no longer tracked). End result: CI MUST run
compile_graphics.sh to produce the .vec files, or every CakeImageWidget
silently renders nothing.
Fix:
- Add vector_graphics_compiler: ^1.1.16 to dev_dependencies (the script
invokes 'dart run vector_graphics_compiler ...' which needs the
package in the project's deps for 'dart run' to find it).
- Add a 'Compile SVG assets' step to all four workflows, between
generate_localization and the build/pod-install step.
This will populate assets/new-ui/ with ~82 .svg.vec files at build
time, so every CakeImageWidget reference (action row, navbar, top bar,
settings rows, etc.) resolves to its actual icon.
Auto-triggers on push were noisy — every merged PR kicked off the
linux + android + ios-sim builds. Switching to workflow_dispatch only.
Trigger via Gitea Actions UI when you want a build. workflow_dispatch
runs as the authenticated user, so secrets are always present.
Adds the push trigger back when we want pre-merge gating or CI on every
commit (e.g., release-tag automation).
The Android workflow's 'ANDROID_KEYSTORE_BASE64 not set' failure is
secrets-not-reaching-runner, not a missing secret. The secret IS set
in Builds/hash-wallet's repo secrets. The issue: workflows are being
triggered by 'pull_request' events when github-such-software/hash-wallet
is mirrored into Builds/hash-wallet via PR. Gitea (and GitHub) Actions
deliberately strip secrets from workflows triggered by PRs from forks
to prevent rogue PRs from exfiltrating secrets.
Fix: drop the pull_request trigger from all auto-build workflows. Each
workflow now runs exactly once, on push to dev/main (post-merge), in
the destination repo's context, with secrets intact.
Also added a debug step in the Android keystore decode that prints
secret LENGTHS (never values) so future failures of this shape are
diagnosable immediately.
Avoids any confusion / potential trademark friction with HashWallet
(Spanish hardware-wallet company). Hash Bags is a more distinctive
name, harder to collide with, and we can still rank for 'hash wallet'
search via App Store / Play Store subtitle ('Hash Bags - A Wallet
for your Coins').
What changed (all user-visible strings):
- Launcher labels: android/app.properties, scripts/android/app_env.sh,
scripts/ios/app_env.sh, linux window title (CMakeLists +
my_application.cc)
- In-app text: lib/generated/i18n.dart + ARB sources under res/values/
- Brand docs: README.md, CONTRIBUTING.md, PRIVACY.md,
assets/text/Terms_of_Use.txt, assets/text/Release_Notes.txt
- hash.boats website: index.html, og-image.svg + regen og-image.png,
site.webmanifest, styles.css comment, splash/confirm/pulse/mark/
lockup svg titles, report/index.html, server/server.js
- CI workflow display names ("Hash Bags Linux build", etc.)
What did NOT change (deliberate):
- Bundle ID / Package: com.suchsoftware.hashwallet (immutable app
identity on App Store + Play Store — changing == orphaning the app)
- Binary name: hash_wallet (Linux executable)
- Dart import paths: package:hash_wallet/...
- Git repo: hash-wallet (Such-Software/hash-wallet)
- URL scheme: hashwallet:// (internal deep links)
- support@such.software (no domain change yet)
- App Store / Play Store listing names (whatever was registered there
stays; we updated launcher label only)
- hash.boats domain (still the wallet site)
Also kept the '#ash Wallet' wordplay in the nav but updated to
'#ash Bags' so the # mark still serves as the H. Nav reads:
[# mark] #ash Bags
Website hero tagline now matches the App Store sub-title concept:
'A wallet for your coins. Open-source, non-custodial, multi-chain.
Privacy-leaning by default.'
108 files modified, ~674 string replacements.
iOS workflows were broken on the Mac mini runner because Flutter
wasn't installed. Three fixes:
1) Conditional Flutter setup. Check 'flutter --version' first; only
pull subosito/flutter-action@v2 if missing or wrong version. Self-
hosted Mac runner persists SDKs between runs, so steady-state is
zero-cost. First run on the runner triggers a full SDK download
via subosito (with cache: true so subsequent fresh installs are
still fast).
2) wget → curl across all iOS workflow steps. macOS doesn't ship
wget by default; curl is always present and respects -fsSL +
redirect properly.
3) Concurrency groups on all four workflows. A burst of commits no
longer queues N copies of the same build — newer pushes cancel
in-flight runs on the same branch. Groups:
linux-<ref>, android-<ref>, ios-sim-<ref>, ios-testflight-<ref>
This addresses the '6 runs from one merge' issue: each commit in
the merge triggered all 3 push-listening workflows. Concurrency
cancels the earlier 3 the moment the newer commit's runs start.
4) CocoaPods install is also conditional (was already 'if ! command -v
pod' under the hood; just tightened the step name).
These chains were already disabled in availableWalletTypes (none of them
were getting created), but the source dirs and the codegen scaffolding
for them still lived in tree (~20K lines of dead Dart).
Surgery:
- Delete cw_decred/ cw_solana/ cw_tron/ cw_zano/ source trees
- Strip 5 generate*() function bodies from tool/configure.dart
(generateSolana, generateTron, generateZano, generateDecred,
generateZcash) plus their top-level imports, args, calls,
signatures, and conditional pubspec/walletTypes injection blocks.
configure.dart shrinks from 2134 to 1561 lines and dart analyze
is clean.
- Strip solana/tron secrets config + output paths from
tool/import_secrets_config.dart
- Delete scripts/{android,ios,macos}/build_decred.sh,
scripts/ios/build_zano{,_all}.sh
- Patch scripts/{android,ios,macos}/build_all.sh,
scripts/android/copy_monero_deps.sh, scripts/ios/setup.sh,
scripts/ios/gen_framework.sh to drop decred/zano steps
- Patch scripts/android/docker/build.sh + Dockerfile.final to drop the
decred Docker stage; delete scripts/android/docker/Dockerfile.decred
- Update .github/workflows/build-linux.yml comments to reflect the
remaining cw_* module list (evm, nano, bitcoin)
Note: WalletType.{solana,tron,zano,decred,zcash} enum values still live
in cw_core/lib/wallet_type.dart and there are dead switch cases in
lib/di.dart and lib/new-ui/pages/*.dart that reference them. Those
paths are unreachable (the enum values never get assigned to any wallet)
but cleaning them up is a separate hygiene pass.
Gitea Actions does not implement the v2+ artifact HTTP API that GitHub
introduced. upload-artifact@v4 fails with GHESNotSupportedError. v3 uses
the older wire format that Gitea's act_runner handles correctly.
The Linux build itself succeeded — this just lets the downloadable
artifact get attached to the run page.
Previous CI step pre-wrote tool/.secrets-config.json with a curated key
subset. The generator at tool/generate_secrets_config.dart has an early
return when the base config exists (line 61), which ALSO skips creating
the per-module configs (evm/solana/nano/tron/bitcoin). Result: dozens
of secrets.xxx references in cw_bitcoin/cw_evm/cw_nano/lib/main.dart
failed at compile time with 'Undefined name'.
New approach (matches Cake's CI pattern):
1. Run generate_new_secrets.dart with no pre-existing config → it creates
all the JSON files from the full SecretKey list with empty defaults,
then writes the per-module .secrets.g.dart files
2. sed-inject Trocador values into lib/.secrets.g.dart
Side effect: changenow_exchange_provider.dart's 'Map<String,dynamic> not
assignable to Map<String,String>' error also resolves — that error was
caused by Dart inferring 'dynamic' for the apiKey ternary because both
arms referenced undefined secrets. Once secrets exist as empty strings,
inference settles on String.
The 'async' flag in model_generator.sh launches per-module flutter pub get
in parallel via 'bash -c ... &'. Flutter has a single-process startup lock
for SDK initialization — when N parallel calls race for it, most lose,
leaving the SDK cache half-initialized. Subsequent pub gets then fail
with the misleading 'doesn't support null safety' error because Flutter
can't resolve its own bundled sky_engine.
Two fixes:
1. Drop 'async' — model_generator.sh now runs the 8 modules sequentially.
Adds maybe 3 minutes per CI run vs parallel, but reliable beats fast.
2. Add explicit 'flutter precache --linux' step before model_generator. The
'|| true' absorbs the known flutter_gpu.zip 404 on Flutter 3.32.0 —
that asset isn't actually published at the URL Flutter constructs and
isn't needed for desktop Linux.
Single workflow at .github/workflows/build-linux.yml that builds Linux
release in Cake's prebuilt Docker image. Skips the simplybs source-toolchain
bootstrap (which ate 9GB on jw-laptop before bailing) — uses the prebuilt
monero_c .so bundle instead, just like Cake's own CI does.
Targets runs-on: ubuntu-latest, which matches both your linux-beast
self-hosted runner (per its labels in the Gitea runners panel) AND
GitHub-hosted ubuntu-latest, so the same workflow file works whether CI
fires from Gitea Actions or GitHub Actions.
Triggers on push to dev/main, on PRs, and manual workflow_dispatch.
Outputs hash_wallet_linux_<sha>.zip as a downloadable artifact (14d retention).
Secrets needed on the runner / repo:
- TROCADOR_API_KEY
- TROCADOR_MONERO_API_KEY (set to same value as TROCADOR_API_KEY for now)
- TROCADOR_EXCHANGE_MARKUP (e.g. "1")
Add via: GitHub repo Settings > Secrets and variables > Actions, or
Gitea repo Settings > Secrets.
jwinterm