jwinterm
c1f618176c
Three desktop targets, three different states, one destination. macOS did not build at all. There was no workflow, only Cake's from-source scripts and an Xcode project. It turns out most of the work was already done: monero_c ships aarch64-apple-darwin and x86_64-apple-darwin, and Runner.xcodeproj already references both dylibs with CodeSignOnCopy. So this fetches the same prebuilt bundle the iOS and Android legs use, lipos the two slices into universal libraries, and builds. One download serves Apple Silicon and Intel, because a single-arch build looks correct on the machine that made it and fails on half of everyone else's. It signs with a Developer ID Application certificate, which is NOT the Apple Distribution certificate the TestFlight workflow uses. They are not interchangeable: an App Store cert on a directly downloaded app is refused by Gatekeeper. Signing is inside-out by hand rather than --deep, which Apple deprecated and which skips nested code it does not recognise. Then notarytool with the App Store Connect key this repository already has, then stapler, so Gatekeeper clears the app without a network round trip. Every credential is optional and the preflight says, before spending forty minutes, exactly which stages the run can reach and what the user will see if it cannot reach them. Absent secrets downgrade the build loudly; they do not fail it and they do not pass silently. Windows and Linux already built. Windows already Authenticode-signs through the Fleet broker. What both lacked was a way to get the artifact to anybody: upload-artifact is the only publication and Gitea Actions artifacts here upload and then list as zero, so the signed Windows zip has never been reachable. Both now publish to the GitHub release, on the smirk pattern: tag-triggered, the release must already exist so a half-populated one never goes public, and a same-named asset from an earlier attempt is replaced rather than duplicated. Windows does its API work in PowerShell because git-bash there has neither python nor node guaranteed and ConvertFrom-Json is native. Tags now build automatically on all three. A tag is the thing a release is cut from, and the artifact that gets signed should come from it rather than from whatever was dispatched by hand. scripts/release/sign-release.sh detach-signs the collected artifacts and signs SHA256SUMS, which is the signature that matters when a download reaches someone from a mirror without its .asc. It verifies even immediately after signing: a signature written but never checked invites trust it has not earned. Not done here, and both need a human: GH_RELEASE_TOKEN does not exist in this repository's Gitea secrets, and the release key's user ID still says Smirk.
Hash Bags
Hash Bags (#) is an open-source, non-custodial, multi-currency crypto wallet for Android, iOS, macOS, Linux, and Windows. It is a fork of Cake Wallet maintained by Such Software LLC.
Why a fork?
Cake Wallet ended Wownero support in early 2026. Hash Bags exists to keep Wownero as a first-class mobile experience, run by the project's founder, while shipping a slimmer, more focused multi-coin wallet without the chains and integrations we don't want to maintain or recommend.
Supported chains
- Monero (XMR)
- Wownero (WOW)
- Bitcoin (BTC)
- Litecoin (LTC), incl. MWEB
- Bitcoin Cash (BCH)
- Dogecoin (DOGE)
- Nano (XNO)
- Ethereum (ETH) + ERC-20s
- Polygon (POL)
- Base (BASE)
- Arbitrum (ARB)
- BNB Smart Chain (BSC)
Hardware wallet support: Ledger, Trezor, BitBox.
What's different from Cake Wallet
Removed:
- Solana, Tron, Zano, Zcash, Decred (chain support disabled)
- Lightning Network (deferred — running Greenlight infra is out of scope for now)
- Cake Pay gift cards (Cake Labs–operated service)
- All direct swap-provider integrations except Trocador, which already aggregates ChangeNow, FixedFloat, LetsExchange, Exolix, StealthEx, Quantex, and ~16 others under one privacy-friendly API
Replaced or planned:
- Default Monero/Wownero/BTC node lists augmented with community nodes (don't rely on Cake Labs–operated nodes alone)
- Fiat price API replacement (Cake's API → public source) — pending
- Tor / Arti integration improvements — pending
Build instructions
The build system is unchanged from upstream Cake Wallet. See docs/ for per-platform instructions:
- Android:
docs/builds/ANDROID.md - iOS:
docs/builds/IOS.md - macOS:
docs/builds/MACOS.md - Linux:
docs/builds/LINUX.md - Windows:
docs/builds/WINDOWS.md
Required Flutter version is pinned in Dockerfile (currently 3.32.0) and .tool-versions. Newer Flutter SDKs (3.5+) drop the _macros pseudo-package that Cake's pinned hive_generator + build_resolvers transitively require — flutter pub get will fail until you switch to 3.32.0. If using asdf or mise, the version will be picked up automatically; otherwise:
git clone --depth 1 --branch 3.32.0 https://github.com/flutter/flutter.git ~/sdks/flutter/3.32.0
export PATH="$HOME/sdks/flutter/3.32.0/bin:$PATH"
flutter --version # confirm 3.32.0 / Dart 3.8.0
Before the first flutter pub get, you must run the prep scripts to clone external native dependencies:
./scripts/prepare_torch.sh
./scripts/prepare_moneroc.sh
./scripts/build_bitbox_flutter.sh
# Then fetch the prebuilt reown_flutter tarball (CI does this; reproduce locally
# with the URL in .github/workflows/build-linux.yml).
Then run the platform-specific configure script, e.g.:
APP_LINUX_TYPE=cakewallet ./configure_hash_wallet.sh linux
Contributing
Issues and PRs welcome at https://github.com/Such-Software/hash-wallet. See CONTRIBUTING.md for ground rules.
License
Hash Bags' own application code is distributed under the MIT License, inherited from Cake Wallet. It also bundles third-party open-source components under their own licenses — including the Monero and Wownero wallet cores (BSD-3-Clause) and additional components under Apache-2.0 and LGPL-3.0 — so the app as a whole is not solely MIT-licensed. See the LICENSE files in the repository.
Copyright (C) 2018–2025 Cake Labs LLC
Copyright (C) 2026 Such Software LLC
Cake Wallet, the Cake Wallet logo, and related marks are trademarks of Cake Labs LLC and are not used by Hash Bags.