Merge pull request #5 from wownero/fix/appimage-libcom-err-20261024

fix(appimage): bundle libcom_err runtime
2026-10-28 19:58:35 +01:00 · 2026-10-24 12:10:01 -04:00 · 2026-10-24 12:09:17 -04:00 · 2026-10-17 08:29:38 -04:00 · 2026-10-17 08:27:14 -04:00 · 2026-10-17 06:21:55 -04:00
43 changed files with 2031 additions and 368 deletions
@@ -1,7 +1,7 @@
 name: linux appimage (gitea self-hosted)

 # Runs ONLY on Gitea (GitHub ignores .gitea/workflows), in the private Builds
-# repository. Gitea is master; GitHub is a mirror and a release surface.
+# repository. GitHub wownero/wowlet owns source and release publication.
 #
 # Unlike the Windows lane, which builds a static toolchain of its own through
 # contrib/depends, the x86_64 AppImage links against the host's Qt6. Those
@@ -11,7 +11,16 @@ name: linux appimage (gitea self-hosted)
 #
 # Dispatch-only. The runner is capacity 1 and shared with the fleet gates.

-on: [workflow_dispatch]
+on:
+  workflow_dispatch:
+    inputs:
+      expected_sha:
+        description: Exact reviewed Builds commit
+        required: true
+        type: string
+
+env:
+  EXPECTED_SHA: ${{ inputs.expected_sha }}

 jobs:
  appimage:
@@ -39,33 +48,33 @@ jobs:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
+          ref: ${{ github.sha }}

-      - name: fetch wownerod to embed
+      - name: Verify exact reviewed source
+        run: python3 -B contrib/release/check_dispatch.py
+
+      - name: fetch verified wownerod to embed
        run: |
-          rm -rf /tmp/wownerod-embed && mkdir -p /tmp/wownerod-embed
-          curl -fL -o /tmp/wownero.tar.bz2 \
-            https://github.com/wownero/wownero-codeberg-mirror/releases/download/v0.11.4.0/wownero-x86_64-linux-gnu-v0.11.4.0.tar.bz2
-          rm -rf /tmp/wow-x && mkdir -p /tmp/wow-x
-          tar xjf /tmp/wownero.tar.bz2 -C /tmp/wow-x
-          find /tmp/wow-x -name wownerod -type f -exec cp {} /tmp/wownerod-embed/ \;
-          chmod +x /tmp/wownerod-embed/wownerod
-          ls -la /tmp/wownerod-embed
+          python3 -B contrib/release/fetch_wownerod.py \
+            --target x86_64-linux-gnu \
+            --destination "/tmp/wowlet-${GITHUB_RUN_ID}/wownerod-embed"

      - name: fetch tor to embed
        run: |
-          rm -rf /tmp/tor-embed && mkdir -p /tmp/tor-embed
-          curl -fL -o /tmp/teb.tgz \
+          EMBED="/tmp/wowlet-${GITHUB_RUN_ID:-local}"
+          rm -rf "$EMBED/tor-embed" && mkdir -p "$EMBED/tor-embed"
+          curl -fL -o "$EMBED/teb.tgz" \
            https://archive.torproject.org/tor-package-archive/torbrowser/15.0/tor-expert-bundle-linux-x86_64-15.0.tar.gz
-          rm -rf /tmp/teb && mkdir -p /tmp/teb && tar xzf /tmp/teb.tgz -C /tmp/teb
-          cp /tmp/teb/tor/tor /tmp/teb/tor/libssl.so.3 /tmp/teb/tor/libevent-2.1.so.7 \
-             /tmp/teb/tor/libcrypto.so.3 /tmp/tor-embed/
+          rm -rf "$EMBED/teb" && mkdir -p "$EMBED/teb" && tar xzf "$EMBED/teb.tgz" -C "$EMBED/teb"
+          cp "$EMBED/teb/tor/tor" "$EMBED/teb/tor/libssl.so.3" "$EMBED/teb/tor/libevent-2.1.so.7" \
+             "$EMBED/teb/tor/libcrypto.so.3" "$EMBED/tor-embed/"
          # The expert bundle's tor carries no rpath; point it and its libs at
          # $ORIGIN so the embedded copy resolves them from the extract dir on
          # any distro.
          for f in tor libssl.so.3 libevent-2.1.so.7 libcrypto.so.3; do
-            patchelf --set-rpath '$ORIGIN' /tmp/tor-embed/$f
+            patchelf --set-rpath '$ORIGIN' "$EMBED/tor-embed/$f"
          done
-          chmod +x /tmp/tor-embed/tor
+          chmod +x "$EMBED/tor-embed/tor"

      - name: build
        run: |
@@ -73,15 +82,16 @@ jobs:
          # binary, or TorManager::unpackBins() sees embedded > unpacked and
          # rewrites Tor on every launch. The bundle's release number (15.0) is
          # not its tor version, so derive it.
-          TORVER=$(/tmp/tor-embed/tor --version | grep -oE '[0-9]+(\.[0-9]+){3}' | head -1)
+          EMBED="/tmp/wowlet-${GITHUB_RUN_ID:-local}"
+          TORVER=$("$EMBED/tor-embed/tor" --version | grep -oE '[0-9]+(\.[0-9]+){3}' | head -1)
          echo "embedded tor version: $TORVER"
          # ARCH=x86-64, never native: the build host's CPU is newer than many
          # users' and native bakes in unsupported instructions -> SIGILL.
          cmake -S . -B build \
            -DWITH_SCANNER=OFF \
            -DARCH=x86-64 \
-            -DWOWNEROD_DIR=/tmp/wownerod-embed \
-            -DTOR_DIR=/tmp/tor-embed \
+            -DWOWNEROD_DIR="$EMBED/wownerod-embed" \
+            -DTOR_DIR="$EMBED/tor-embed" \
            -DTOR_VERSION="$TORVER"
          cmake --build build -j6
          ls -la build/bin/
@@ -91,7 +101,7 @@ jobs:
          rm -rf AppDir
          mkdir -p AppDir/usr/bin AppDir/usr/share/applications \
                   AppDir/usr/share/icons/hicolor/256x256/apps
-          cp build/bin/feather AppDir/usr/bin/wowlet
+          cp build/bin/wowlet AppDir/usr/bin/wowlet
          chmod +x AppDir/usr/bin/wowlet
          cp src/assets/wowlet.desktop AppDir/usr/share/applications/wowlet.desktop
          cp src/assets/images/appicons/256x256.png \
@@ -139,11 +149,16 @@ jobs:
          ARCH=x86_64 ./appimagetool AppDir wowlet-x86_64.AppImage
          ls -la wowlet-x86_64.AppImage

+      - name: Record candidate source and hashes
+        run: python3 -B contrib/release/write_receipt.py --platform linux --file wowlet-x86_64.AppImage --output wowlet-linux-receipt.json
+
      - name: upload wowlet AppImage
        # v3: Gitea implements the older artifact protocol and rejects
        # @actions/artifact v2 clients (upload-artifact@v4+) as unsupported.
        uses: actions/upload-artifact@v3
        with:
          name: wowlet-x86_64-linux-AppImage
-          path: wowlet-x86_64.AppImage
+          path: |
+            wowlet-x86_64.AppImage
+            wowlet-linux-receipt.json
          if-no-files-found: error
@@ -12,9 +12,18 @@ name: macos build (gitea self-hosted)
 #   APPLE_CERTIFICATE (b64 Developer ID Application .p12),
 #   APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_TEAM_ID,
 #   APPLE_API_ISSUER, APPLE_API_KEY, APPLE_API_KEY_P8_BASE64 (notarytool).
-# If APPLE_CERTIFICATE is unset the build ships unsigned instead of failing.
+# Missing signing or notarization inputs refuse before compilation.

-on: [workflow_dispatch]
+on:
+  workflow_dispatch:
+    inputs:
+      expected_sha:
+        description: Exact reviewed Builds commit
+        required: true
+        type: string
+
+env:
+  EXPECTED_SHA: ${{ inputs.expected_sha }}

 jobs:
  build-macos:
@@ -31,30 +40,36 @@ jobs:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
+          ref: ${{ github.sha }}

-      - name: install dependencies (brew)
-        run: |
-          export PATH="/opt/homebrew/bin:$PATH"
-          set +o pipefail   # yes(1) takes SIGPIPE when brew has nothing to ask
-          export NONINTERACTIVE=1 HOMEBREW_NO_ENV_HINTS=1 HOMEBREW_NO_INSTALL_UPGRADE=1
-          yes | brew install --quiet qt libsodium libzip qrencode unbound cmake boost hidapi openssl expat protobuf pkgconfig zxing-cpp
+      - name: Verify exact reviewed source
+        run: python3 -B contrib/release/check_dispatch.py

-      - name: fetch wownerod to embed
+      - name: Check signing inputs before compiling
+        run: python3 -B contrib/release/sign_macos.py --check-inputs
+
+      - name: Verify Fleet-managed build dependencies
        run: |
          set -e
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            arm64) WOWTAR=wownero-aarch64-apple-darwin11-v0.11.4.0.tar.bz2 ;;
-            *)     WOWTAR=wownero-x86_64-apple-darwin11-v0.11.4.0.tar.bz2 ;;
+          export PATH="/opt/homebrew/bin:$PATH"
+          for formula in qt libsodium libzip qrencode unbound cmake boost hidapi openssl expat protobuf zxing-cpp; do
+            brew --prefix "$formula" >/dev/null || {
+              echo "Missing Fleet-managed build dependency: $formula" >&2
+              exit 1
+            }
+          done
+
+      - name: fetch verified wownerod to embed
+        run: |
+          set -e
+          case "$(uname -m)" in
+            arm64) target=aarch64-apple-darwin11 ;;
+            x86_64) target=x86_64-apple-darwin11 ;;
+            *) echo "Unsupported macOS build architecture" >&2; exit 1 ;;
          esac
-          mkdir -p /tmp/wownerod-embed /tmp/wow-extract
-          curl -L -o /tmp/wownero.tar.bz2 \
-            "https://github.com/wownero/wownero-codeberg-mirror/releases/download/v0.11.4.0/$WOWTAR"
-          # /tmp is a symlink on macOS — find(1) won't descend it as a bare argument
-          tar xjf /tmp/wownero.tar.bz2 -C /tmp/wow-extract
-          find /tmp/wow-extract -name wownerod -type f -exec cp {} /tmp/wownerod-embed/ \;
-          chmod +x /tmp/wownerod-embed/wownerod
-          ls -la /tmp/wownerod-embed
+          EMBED="/tmp/wowlet-${GITHUB_RUN_ID}/wownerod-embed"
+          python3 -B contrib/release/fetch_wownerod.py --target "$target" --destination "$EMBED"
+          echo "WOWNEROD_DIR=$EMBED" >> "$GITHUB_ENV"

      - name: fetch tor to embed
        run: |
@@ -88,7 +103,7 @@ jobs:
          export CPATH="$(brew --prefix)/include"
          export LIBRARY_PATH="$(brew --prefix)/lib"
          mkdir -p build && cd build
-          cmake -DWITH_SCANNER=OFF -DUSE_DEVICE_TREZOR=OFF -DBoost_USE_STATIC_LIBS=ON -DWOWNEROD_DIR=/tmp/wownerod-embed -DTOR_DIR=/tmp/tor-embed -DTOR_VERSION="$TOR_VERSION" -DCMAKE_PREFIX_PATH="$(brew --prefix qt)" ..
+          cmake -DWITH_SCANNER=OFF -DUSE_DEVICE_TREZOR=OFF -DBoost_USE_STATIC_LIBS=ON -DWOWNEROD_DIR="$WOWNEROD_DIR" -DTOR_DIR=/tmp/tor-embed -DTOR_VERSION="$TOR_VERSION" -DCMAKE_PREFIX_PATH="$(brew --prefix qt)" ..
          cmake --build . -j "$(sysctl -n hw.ncpu)"

      - name: package app bundle
@@ -103,8 +118,39 @@ jobs:
          # for the dormant `installed/` layout)
          mkdir -p dist/Wowlet.app/Contents/Resources
          cp ../src/assets/images/appicons/appicon.icns dist/Wowlet.app/Contents/Resources/
-          # bundle Qt frameworks/plugins so the app runs off-machine
-          /opt/homebrew/opt/qt/bin/macdeployqt dist/Wowlet.app
+          # bundle Qt frameworks/plugins so the app runs off-machine.
+          # -qmldir is not optional: our QML lives in .qrc resources, which
+          # macdeployqt cannot scan, so without it the bundle ships no QML
+          # modules at all and every page importing anything beyond QtQuick
+          # fails to load. That is how 5.1.2 shipped a grey mining tab on mac
+          # while Linux was fine: Contents/Resources held no qml directory, and
+          # the app logged 'module "QtQuick.Layouts" is not installed'.
+          /opt/homebrew/opt/qt/bin/macdeployqt dist/Wowlet.app -qmldir=../src/assets/qml
+
+          # qmlimportscanner reads only the `import` lines in our QML and does
+          # not follow a module's own qmldir depends chain, so transitive
+          # modules (QtQuick -> QtQml.WorkerScript/Models) are silently skipped.
+          # The AppImage build hit this twice and blanket-copies the trees; do
+          # the same here, before the dylib passes below so their deps resolve.
+          # Ask Qt where its QML modules live rather than assuming a brew
+          # layout; the AppImage build asks qmake the same question.
+          QTPREFIX="$(brew --prefix qt)"
+          QMLSRC="$("$QTPREFIX/bin/qmake6" -query QT_INSTALL_QML 2>/dev/null || echo "$QTPREFIX/share/qt/qml")"
+          [ -d "$QMLSRC" ] || { echo "ERROR: Qt QML modules not found at $QMLSRC" >&2; exit 1; }
+          mkdir -p dist/Wowlet.app/Contents/Resources/qml
+          for m in QtQuick QtQml; do
+            cp -Rn "$QMLSRC/$m" dist/Wowlet.app/Contents/Resources/qml/ 2>/dev/null || true
+          done
+
+          # Guard: the module the mining tab needs has to be in the bundle. A
+          # missing QML module is invisible until someone opens the tab, so it
+          # fails the build instead of shipping a page that paints grey.
+          for m in QtQuick QtQuick/Layouts; do
+            [ -d "dist/Wowlet.app/Contents/Resources/qml/$m" ] || {
+              echo "ERROR: $m missing from the bundle; QML pages will not load" >&2
+              exit 1
+            }
+          done

          # macdeployqt bundles Qt frameworks but not the plain-dylib brew deps
          # of Qt's image plugins (libwebp/libsharpyuv/libbrotli...), which are
@@ -153,47 +199,8 @@ jobs:
          ls -la "$FW" | grep -iE "webp|sharpyuv|brotli" || true
          ls -la dist/

-      - name: sign and notarize (skipped when secrets absent)
-        run: |
-          set -e
-          cd build
-          if [ -z "$APPLE_CERTIFICATE" ]; then
-            echo "APPLE_CERTIFICATE not set — shipping UNSIGNED build"
-            exit 0
-          fi
-          KC=/tmp/wowlet-ci.keychain-db
-          KCPW=$(/usr/bin/uuidgen)
-          echo "$KCPW" > /tmp/wowlet-ci-kcpw   # for the cleanup step only
-          security create-keychain -p "$KCPW" "$KC"
-          security set-keychain-settings -lut 3600 "$KC"
-          security unlock-keychain -p "$KCPW" "$KC"
-          printf '%s' "$APPLE_CERTIFICATE" | base64 -d > /tmp/dev_id.p12
-          security import /tmp/dev_id.p12 -k "$KC" -P "$APPLE_CERTIFICATE_PASSWORD" \
-            -T /usr/bin/codesign
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$KCPW" "$KC" >/dev/null
-          security list-keychains -d user -s "$KC" login.keychain-db
-
-          # Sign inside-out: every Mach-O NOT inside a .framework (embedded
-          # wownerod/tor, the bundled webp/sharpyuv/brotli dylibs, and the
-          # image-format plugins whose signatures install_name_tool just
-          # invalidated — keyed on `file`, not exec bit, since plugins/dylibs
-          # aren't +x), then each Qt framework as a unit, then the bundle.
-          SIGN() { codesign --force --options runtime --timestamp --keychain "$KC" \
-                     --sign "$APPLE_SIGNING_IDENTITY" "$@"; }
-          find dist/Wowlet.app -type f ! -path "*/*.framework/*" \
-            | while read -r f; do file "$f" | grep -q Mach-O && SIGN "$f" || true; done
-          find dist/Wowlet.app/Contents/Frameworks -maxdepth 1 -name "*.framework" 2>/dev/null \
-            | while read -r fw; do SIGN "$fw"; done
-          SIGN dist/Wowlet.app
-          codesign --verify --deep --strict dist/Wowlet.app
-
-          printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 -d > /tmp/notary.p8
-          ditto -c -k --keepParent dist/Wowlet.app /tmp/wowlet-notarize.zip
-          xcrun notarytool submit /tmp/wowlet-notarize.zip \
-            --key /tmp/notary.p8 --key-id "$APPLE_API_KEY" --issuer "$APPLE_API_ISSUER" \
-            --wait --timeout 30m
-          xcrun stapler staple dist/Wowlet.app
-          echo "signed + notarized + stapled"
+      - name: Sign and notarize the private candidate
+        run: python3 -B contrib/release/sign_macos.py

      - name: zip artifact
        run: |
@@ -202,17 +209,17 @@ jobs:
          ditto -c -k --keepParent Wowlet.app ../wowlet-macos-$(uname -m).zip
          ls -la ../wowlet-macos-*.zip

-      - name: cleanup signing material
-        if: always()
-        run: |
-          if [ -f /tmp/wowlet-ci-kcpw ]; then
-            security delete-keychain /tmp/wowlet-ci.keychain-db || true
-          fi
-          rm -f /tmp/dev_id.p12 /tmp/notary.p8 /tmp/wowlet-ci-kcpw /tmp/wowlet-notarize.zip
+      - name: Record signed candidate source and hashes
+        run: python3 -B contrib/release/write_receipt.py --platform macos --file build/wowlet-macos-$(uname -m).zip --output build/wowlet-macos-receipt.json

      - name: upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: wowlet-macos
-          path: build/wowlet-macos-*.zip
+          path: |
+            build/wowlet-macos-*.zip
+            build/wowlet-macos-receipt.json
          retention-days: 14
+          # Without this an empty upload passes silently, which is how a signed
+          # build can appear to publish while shipping nothing.
+          if-no-files-found: error
@@ -1,7 +1,7 @@
 name: windows build + sign (gitea self-hosted)

 # Runs ONLY on Gitea (GitHub ignores .gitea/workflows), in the private Builds
-# repository. Gitea is master; GitHub is a mirror and a release surface.
+# repository. GitHub wownero/wowlet owns source and release publication.
 #
 # Two jobs on two different machines, and that split is the whole point:
 #
@@ -20,9 +20,16 @@ name: windows build + sign (gitea self-hosted)
 #
 # Dispatch-only. Both runners are capacity 1 and shared with other lanes.

-on: [workflow_dispatch]
+on:
+  workflow_dispatch:
+    inputs:
+      expected_sha:
+        description: Exact reviewed Builds commit
+        required: true
+        type: string

 env:
+  EXPECTED_SHA: ${{ inputs.expected_sha }}
  HOST: x86_64-w64-mingw32

 jobs:
@@ -52,6 +59,10 @@ jobs:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
+          ref: ${{ github.sha }}
+
+      - name: Verify exact reviewed source
+        run: python3 -B contrib/release/check_dispatch.py

      # depends is the slow part (static Qt6/boost/openssl/tor from source).
      # Cache the source tarballs and the compiled packages so only a cold run
@@ -96,15 +107,11 @@ jobs:
          path: contrib/depends/built
          key: depends-built-mingw32-${{ hashFiles('contrib/depends/packages/*', 'contrib/depends/hosts/*', 'contrib/depends/toolchain.cmake.in') }}

-      - name: fetch wownerod.exe to embed
+      - name: fetch verified wownerod to embed
        run: |
-          rm -rf /tmp/wownerod-embed && mkdir -p /tmp/wownerod-embed
-          curl -fL -o /tmp/wownero-win.zip \
-            https://github.com/wownero/wownero-codeberg-mirror/releases/download/v0.11.4.0/wownero-x86_64-w64-mingw32-v0.11.4.0.zip
-          # -j flattens the versioned subdir so wownerod.exe is a DIRECT child
-          # (WownerodQrcGenerator globs ${WOWNEROD_DIR}/* non-recursively).
-          unzip -o -j /tmp/wownero-win.zip 'wownero-x86_64-w64-mingw32-v0.11.4.0/wownerod.exe' -d /tmp/wownerod-embed
-          ls -la /tmp/wownerod-embed
+          python3 -B contrib/release/fetch_wownerod.py \
+            --target x86_64-w64-mingw32 \
+            --destination "/tmp/wowlet-${GITHUB_RUN_ID}/wownerod-embed"

      - name: build wowlet.exe
        run: |
@@ -118,7 +125,7 @@ jobs:
            -DCHECK_UPDATES=OFF \
            -DTOR_INSTALLED=On \
            -DFEATHER_TARGET_TRIPLET="$HOST" \
-            -DWOWNEROD_DIR=/tmp/wownerod-embed \
+            -DWOWNEROD_DIR="/tmp/wowlet-${GITHUB_RUN_ID:-local}/wownerod-embed" \
            ..
          cmake --build . -j6
          ls -la bin/
@@ -129,11 +136,14 @@ jobs:
        # archive contains the signed binary.
        run: |
          mkdir -p stage/tor
-          cp build/bin/feather.exe stage/wowlet.exe
+          cp build/bin/wowlet.exe stage/wowlet.exe
          cp "contrib/depends/$HOST/Tor/tor.exe" stage/tor/tor.exe
          (cp LICENSE stage/LICENSE.txt 2>/dev/null || cp COPYING stage/LICENSE.txt 2>/dev/null) || true
          ls -la stage stage/tor

+      - name: Record unsigned build source and hash
+        run: python3 -B contrib/release/write_receipt.py --platform windows-build --file stage/wowlet.exe --output stage/wowlet-build.json
+
      - name: upload unsigned staging tree
        # v3, not v4: Gitea Actions implements the older artifact protocol and
        # rejects @actions/artifact v2 clients with
@@ -149,12 +159,39 @@ jobs:
    needs: build
    runs-on: windows             # gitea label windows:host -> desktop-iim2fs2
    steps:
+      - name: Prepare the exact signing run workspace
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:EXPECTED_SHA -notmatch '^[0-9a-f]{40}$' -or $env:GITHUB_SHA -ne $env:EXPECTED_SHA) {
+            throw "Signing run differs from the reviewed source"
+          }
+          foreach ($path in @('stage', 'unsigned', 'wowlet-build.json', 'wowlet-windows-receipt.json', 'wowlet-x86_64-windows.zip', 'wowlet-x86_64-windows-unsigned.zip')) {
+            if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Recurse -Force }
+          }
+
      - name: download unsigned staging tree
        uses: actions/download-artifact@v3
        with:
          name: wowlet-x86_64-windows-unsigned
          path: stage

+      - name: Verify exact signing source and unsigned input
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:EXPECTED_SHA -notmatch '^[0-9a-f]{40}$' -or $env:GITHUB_SHA -ne $env:EXPECTED_SHA) {
+            throw "Signing run differs from the reviewed source"
+          }
+          $build = Get-Content 'stage/wowlet-build.json' -Raw | ConvertFrom-Json
+          if ($build.dispatch_commit -ne $env:EXPECTED_SHA -or $build.platform -ne 'windows-build' -or $build.artifacts.Count -ne 1) {
+            throw "Unsigned build receipt differs from the reviewed signing run"
+          }
+          if ($build.artifacts[0].name -ne 'wowlet.exe' -or $build.artifacts[0].sha256 -ne (Get-FileHash 'stage/wowlet.exe' -Algorithm SHA256).Hash.ToLowerInvariant()) {
+            throw "Unsigned executable differs from its build receipt"
+          }
+          Move-Item 'stage/wowlet-build.json' 'wowlet-build.json'
+
      - name: keep the unsigned tree for the reproducible archive
        shell: powershell
        run: |
@@ -258,6 +295,29 @@ jobs:
              (Get-FileHash $archive -Algorithm SHA256).Hash
          }

+      - name: Record signed candidate source, hashes and certificate
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $build = Get-Content 'wowlet-build.json' -Raw | ConvertFrom-Json
+          $sig = Get-AuthenticodeSignature 'stage/wowlet.exe'
+          if ($sig.Status -ne 'Valid' -or -not $sig.TimeStamperCertificate -or $sig.SignerCertificate.Subject -notmatch 'Such Software LLC') {
+            throw "Final executable signature is not valid, timestamped and from the expected publisher"
+          }
+          $files = @('wowlet-x86_64-windows.zip', 'wowlet-x86_64-windows-unsigned.zip') | ForEach-Object {
+            @{name=$_;size=(Get-Item $_).Length;sha256=(Get-FileHash $_ -Algorithm SHA256).Hash.ToLowerInvariant()}
+          }
+          $receipt = @{
+            schema_version=1;app='wowlet';version=$build.version;platform='windows';
+            dispatch_commit=$env:GITHUB_SHA;wallet_library_commit=$build.wallet_library_commit;
+            environment_run_id=$env:GITHUB_RUN_ID;environment_run_attempt=$env:GITHUB_RUN_ATTEMPT;
+            artifacts=@($files);unsigned_executable=$build.artifacts[0];
+            signed_executable_sha256=(Get-FileHash 'stage/wowlet.exe' -Algorithm SHA256).Hash.ToLowerInvariant();
+            signing=@{status=$sig.Status.ToString();timestamped=$true;subject=$sig.SignerCertificate.Subject;
+              certificate_thumbprint=$sig.SignerCertificate.Thumbprint;certificate_not_after=$sig.SignerCertificate.NotAfter.ToUniversalTime().ToString('o')}
+          }
+          $receipt | ConvertTo-Json -Depth 6 | Set-Content -Encoding UTF8 'wowlet-windows-receipt.json'
+
      - name: upload Windows zips
        uses: actions/upload-artifact@v3
        with:
@@ -265,4 +325,5 @@ jobs:
          path: |
            wowlet-x86_64-windows.zip
            wowlet-x86_64-windows-unsigned.zip
+            wowlet-windows-receipt.json
          if-no-files-found: error
@@ -0,0 +1,15 @@
+name: Wowlet verify
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check support guides and release source admission
+        run: make check
@@ -1,6 +1,7 @@
 name: ci/gh-actions/build

-on: [push, pull_request, workflow_dispatch]
+# Legacy builds are manual only. Release artifacts are built in Builds/wowlet.
+on: [workflow_dispatch]

 # NOTE (wownero-rebase branch): the Arch + macOS jobs from upstream Feather's build.yml are
 # temporarily disabled to get a fast, cheap iteration loop while bringing up the build against the
@@ -21,7 +22,7 @@ jobs:
                            qt6-wayland-dev qt6-declarative-dev libzip-dev libsodium-dev libgcrypt20-dev libx11-xcb-dev
                            qml6-module-qtquick qml6-module-qtquick-layouts qml6-module-qtquick-window qml6-module-qtqml-workerscript qml6-module-qtqml-models
                            protobuf-compiler libprotobuf-dev libhidapi-dev libzxing-dev libusb-dev
-                            libusb-1.0-0-dev patchelf
+                            libusb-1.0-0-dev libcom-err2 patchelf
      - name: configure git
        run: git config --global --add safe.directory '*'
      - uses: actions/checkout@v4
@@ -76,10 +77,20 @@ jobs:
          export EXTRA_QT_PLUGINS="svg;multimedia;tls"
          export QML_SOURCES_PATHS="$PWD/src/assets/qml"
          export PATH="$PWD:$PATH"
+          # linuxdeploy's AppImage excludelist assumes libcom_err.so.2 is present on the host.
+          # Minimal Debian and openSUSE systems may omit it, but it is a transitive runtime dependency.
+          LIBCOM_ERR="$(ldconfig -p | awk '$1 == "libcom_err.so.2" { print $NF; exit }')"
+          if [[ -z "$LIBCOM_ERR" || ! -f "$LIBCOM_ERR" ]]; then
+            echo "ERROR: libcom_err.so.2 is unavailable in the build image; cannot make a portable AppImage." >&2
+            exit 1
+          fi
          # Populate AppDir (libs + Qt plugins + QML modules) — no --output yet, so we can patch QML first.
          ./linuxdeploy --appdir AppDir --plugin qt \
+            --library "$LIBCOM_ERR" \
            -d AppDir/usr/share/applications/wowlet.desktop \
            -i AppDir/usr/share/icons/hicolor/256x256/apps/wowlet.png
+          # Guard this packaging regression: the AppImage must carry the excluded system library.
+          bash contrib/AppImage/check-libcom-err.sh AppDir
          # ---------------------------------------------------------------------------------------
          # Make the QML bundle COMPLETE and deterministic (no whack-a-mole).
          #
@@ -0,0 +1,16 @@
+name: source checks
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  docs:
+    name: Wowlet documentation gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check generated documentation and support contacts
+        run: make check
@@ -1,6 +1,7 @@
 name: ci/gh-actions/guix

-on: [push, pull_request]
+# Legacy builds are manual only. Release artifacts are built in Builds/wowlet.
+on: [workflow_dispatch]

 jobs:
  cache-sources:
@@ -1,6 +1,6 @@
 [submodule "monero"]
 	path = monero
-	url = https://codeberg.org/wownero/wownero.git
+	url = https://github.com/wownero/wownero.git
 	branch = gui
 [submodule "src/third-party/polyseed"]
 	path = src/third-party/polyseed
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.18)

 project(feather
-  VERSION "5.1.1"
+  VERSION "5.1.5"
  DESCRIPTION "A free Monero desktop wallet"
  LANGUAGES CXX C ASM
 )
@@ -13,4 +13,8 @@ clean:
 DEFAULT_GOAL := default
 default: build

-.PHONY: default build attest verify clean
+check:
+	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s contrib/docs/tests -v
+	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s contrib/release/tests -v
+
+.PHONY: default build attest verify clean check
@@ -1,60 +1,44 @@
-# Feather Wallet
+# Wowlet

-Feather is a free Monero desktop wallet for Linux, Tails, macOS and Windows. It is written in C++ with the Qt framework.
-
- **easy-to-use**, **small** and **fast** - Feather runs well on any modern hardware, including virtual machines and live operating systems.
- **beginner friendly**, but also caters to advanced Monero users by providing a [feature set](https://docs.featherwallet.org/guides/features) that is on par with the official CLI.
- ships with **sane defaults** that suit most users, but can also be configured for high or uncommon threat models.
- serves as a testing grounds for **experimental features** that may later be adopted in the reference wallets.
+Wowlet is a Wownero desktop wallet for Linux, macOS and Windows, built with C++ and
+Qt. It is based on [Feather Wallet](https://github.com/feather-wallet/feather).

 ## Download

-You can download Feather from **[featherwallet.org](https://featherwallet.org/download/)** or **[GitHub](https://github.com/feather-wallet/feather/releases)**.
+Download Wowlet and its signed release hashes from
+[Wowlet releases](https://github.com/wownero/wowlet/releases).

-If you need help installing Feather, check the [installation documentation](https://docs.featherwallet.org/).
+## Support

-We recommend that you verify downloads with GPG. Releases are signed with our [release signing key](https://docs.featherwallet.org/guides/release-signing-key). The fingerprint is:
+- Matrix: [#wownero-gen:wowne.ro](https://matrix.to/#/#wownero-gen:wowne.ro)
+- IRC: `#wownero` on [OFTC](https://www.oftc.net/), or use
+  [webchat](https://webchat.oftc.net/?randomnick=1&channels=wownero)
+- Email: [wownero@wownero.org](mailto:wownero@wownero.org)
+- Bug reports: [Wowlet issues](https://github.com/wownero/wowlet/issues)

-```
-8185 E158 A333 30C7 FD61 BC0D 1F76 E155 CEFB A71C
-```
+If nobody replies immediately, stay in the room and give volunteers time to respond.
+Include your Wowlet version, operating system, reproduction steps and any error
+message. Never share your wallet seed, private keys, password or wallet files.

-Windows releases are code-signed for free by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
-
-## Resources
-
-* [Official Site](https://featherwallet.org)
-* [Documentation](https://docs.featherwallet.org)
-* [Git Repository](https://github.com/feather-wallet/feather)
-* [Matrix](https://matrix.to/#/#feather:monero.social)
-* IRC: `#feather` on [OFTC](https://www.oftc.net/)
-* Mail: dev@featherwallet.org
-
-If you need help with your wallet, please contact us via Matrix or IRC.
-If you don't have an IRC client, you can join the room via [webchat](https://webchat.oftc.net/?randomnick=1&channels=feather).
-If you don’t receive a response immediately please idle in the room.
-
-## Release Builds
-
-To learn how to run a bootstrappable release build, see: [contrib/guix/README.md](https://github.com/feather-wallet/feather/blob/master/contrib/guix/README.md)
-
-For release attestations, see the [feather-sigs](http://github.com/feather-wallet/feather-sigs) repo.
-
-For release policy, see: [RELEASE.md](https://github.com/feather-wallet/feather/blob/master/RELEASE.md)
+Report vulnerabilities privately using [SECURITY.md](SECURITY.md).

 ## Development

-If you are looking to set up a development environment for Feather, see [HACKING.md](https://github.com/feather-wallet/feather/blob/master/HACKING.md).
+[GitHub](https://github.com/wownero/wowlet) is the canonical source repository.
+Release builds run in our private Builds system. Signed release artifacts and
+hashes are published on GitHub Releases. GitHub runs lightweight source checks;
+its legacy build workflows require an explicit manual dispatch.

-It is highly recommended that you join our Matrix or IRC channel if you are hacking on Feather.
-Idling in this channel is the best way to stay updated on best practices and new developments.
+The application includes an offline documentation browser under Help. Its guides
+are generated by `contrib/docs/generate.py` from the Feather documentation submodule.
+Wowlet-specific guides in `contrib/docs/overrides` take precedence over upstream
+guides with the same filename. Edit those sources, then regenerate; files under
+`src/assets/docs` are generated and must not be edited directly.

-For information on how Feather is maintained, see: [MAINTENANCE.md](https://github.com/feather-wallet/feather/blob/master/MAINTENANCE.md)
-
-To report a security vulnerability, see: [SECURITY.md](https://github.com/feather-wallet/feather/blob/master/SECURITY.md)
+Run the documentation regression checks with `make check`. The inherited build
+instructions are in [HACKING.md](HACKING.md).

 ## License

-Feather is free and open-source software, [licensed under BSD-3](https://raw.githubusercontent.com/feather-wallet/feather/master/LICENSE).
-
-Copyright (c) 2020-2025, The Monero Project
+Wowlet is free and open-source software under [BSD-3-Clause](LICENSE).
+Upstream copyright notices are retained in the source.
@@ -1,46 +1,41 @@
-# Release process
+# Wowlet release process

- Before a minor release:
-  - Update `src/assets/restore_heights_monero_{mainnet,stagenet}.txt`
-    - To obtain values, run `contrib/generate-restore-heights/heights.py`
-  - Update default node lists in `src/assets/nodes.json`
-  - Bump `openssl`, `qt`, `tor_*` packages in `contrib/depends/packages`
-  - Update or patch any statically linked dependencies that have known vulnerabilities
-    - Run `feather-utils/depends/vulns.py` to check
-  - Rebase on top of latest Monero version
- Update `src/assets/ack.txt`
- Update documentation (`feather-wallet/feather-docs`) and `external/feather-docs` submodule
- Update the version number in `CMakeLists.txt`
-  - A hardfork-ready release must bump major version
- Create an annotated tag (`git tag x.x.x -a`)
-  - Tag must match version in `CMakeLists.txt`
-  - Only commits that update the version number in `CMakeLists.txt` may be tagged
- Push the master branch and tags
-  - `git push --tags origin master`
- Run `guix` builds in a clean repo:
-  - ```bash
-    git clone https://github.com/feather-wallet/feather.git
-    cd feather
-    git checkout <TAG>
-    git submodule update --init --recursive
-    ./contrib/guix/guix-build
-    ```
-  - Alternatively, run `feather-utils/guix/run-build.sh`
- Attest the builds (`contrib/guix/guix-attest`) and PR to `feather/feather-sigs`.
-  - Wait until at least one other person has independently verified reproducibility
-  - If builds are not reproducible: fix any reproducibility defects and bump patch version. Do not sign or release non-reproducible builds.
- Sign release artifacts and hashlists.
-  - Transfer files in `guix-build-x.x.x/output` to release signing machine
-  - Run `feather-utils/release/make-release.sh`
- Update the site (`feather-wallet/feather-site`)
-  - Run the `feather-utils/site/bump-version.py` script to create a template commit.
-  - Edit the changelog in `content/changelog`
-    - If a release includes security fixes add "(includes security fixes)" to the title.
-  - Update the version number, file sizes and paths in `data/release.json`
-  - Upload releases, signatures and signed hashlists.
-    - Follow the directory structure defined in `MainWindow::onShowUpdateCheck`.
-  - Make `depends` source files [available](https://featherwallet.org/files/sources/):
-    - `make -C contrib/depends download`
- Announce release on irc/Matrix
- Update websocket servers to notify clients of new release
-  - Wait up to 7 days to allow for bug reports before major rollout
+GitHub `wownero/wowlet` owns source and public releases. Private `Builds/wowlet`
+is the build ingress on our hardware. Fleet owns dispatch and publication plans.
+A source merge, a build, a code signature and a published release are separate outcomes.
+
+1. Prepare and review a GitHub pull request with the version, wallet-library pin,
+   support documentation and release inputs. Publish a new library commit to its
+   canonical repository before pinning it. Keep source and dependency revisions exact.
+2. `make check` runs the cheap source checks. Run the private Linux, Windows and
+   macOS workflows through reviewed Fleet admission with `expected_sha` equal to
+   the protected Builds commit. Preserve canonical source and Builds commit identities
+   separately. Do not run release builds on GitHub.
+3. The build helpers verify embedded Wownero archives against `contrib/release/wownerod.json`.
+   That file records the reviewed checksum provenance. Do not describe an unsigned
+   checksum list as a PGP verification.
+4. Collect artifacts by their run and artifact identities. Require a Linux AppImage,
+   macOS archive, signed Windows archive and unsigned Windows archive. Check archive
+   paths, bundled runtimes and packaging requirements. Never select an artifact by size.
+5. Require Developer ID signing, accepted notarization and stapling for macOS.
+   Require valid, timestamped Such Software LLC Authenticode signing for Windows.
+   The EV token stays on its signing host; CI never receives its password or key.
+6. Record any manual wallet checks actually performed. Manual testing and independent
+   reproducibility are separate evidence; successful builds do not prove either.
+   The unsigned Windows archive is provided for reproduction, without claiming an
+   independent reproduction occurred.
+7. Create `hashes.txt` over the four final archives. Sign it on the owner's signing
+   machine with the existing release key `9F9930300530DF724761B7055A881347310EB79F`.
+   Verify the detached signature and all hashes before publication. Never transfer
+   the private key or put a passphrase in a command, environment or log.
+8. Create an annotated `vX.Y.Z` tag from the exact reviewed canonical source, matching
+   `CMakeLists.txt`. Use Fleet's reviewed publication plan to upload the four archives,
+   `hashes.txt` and `hashes.txt.asc` to GitHub Releases. Refuse replacement of existing
+   tags or assets; recover partial publication from retained intent.
+9. Download the public assets again and verify their hashes and PGP signature. Record
+   the tag, source commit, Builds commit, run identities, signing evidence and public
+   URL in the private journal. Release notes should say when security fixes are included.
+
+Additional architectures and Guix builds remain separate lanes. Do not claim a
+platform is released merely because its workflow exists. Announcements are an
+owner action, separate from publishing the release files.
@@ -2,43 +2,11 @@

 ## Reporting a Vulnerability

-Please do not open an issue to report security issues.
+Report Wowlet security vulnerabilities privately to
+[wownero@wownero.org](mailto:wownero@wownero.org).
+Please do not disclose them in public issues or community chat before the
+maintainers have had time to investigate.

-To report a vulnerability email to dev@featherwallet.org
-
-The following keys may be used to communicate sensitive information to developers:
-
-| Name    | Fingerprint                                       |
-|---------|---------------------------------------------------|
-| tobtoht | E87B D921 CDD8 85C9 D78A 38C5 E45B 10DD 027D 2472 |
-
-Public keys can be found in [`utils/pubkeys`](utils/pubkeys).
-
-## Bug Bounty Program
-
-A bounty may be rewarded to a vulnerability report **if and only if** the issue can result in **a loss of funds**.
-
-You must describe a **plausible scenario** in which a loss of funds can occur (or has occurred) that **isn't solely attributable to user error**.
-
-Only **the code** of the **latest tagged release** of **[this repository](https://github.com/feather-wallet/feather/)** is in scope.
-
-**The bounty can only be rewarded in XMR**. The bounty amount for your report is determined by the maintainers and ranges from USD 150 to USD 3000 (in terms of XMR) and depends on the severity of the issue and other factors.
-
-Clarifications on scope:
-
- The issue **must be present in a [signed](https://docs.featherwallet.org/guides/release-signing-key) [release build](https://github.com/feather-wallet/feather/blob/master/contrib/guix/README.md)**. Custom builds, including distribution packages, are out of scope.
- The developers **must be able to reproduce and fix the issue**. If the issue cannot be fixed **in our code** for any reason, it is out of scope.
- The live [websites](https://github.com/feather-wallet/feather-site/blob/master/mirrors.txt) and their repositories are out of scope.
- Loss of funds due to malware on the user's machine is out of scope.
- Memory imaging, including cold boot attacks, is out of scope.
- Social engineering against users is out of scope. This includes messages received from the [websocket server](https://docs.featherwallet.org/guides/websocket).
- Any form of coercion, physical or psychological, is out of scope.
- Vulnerabilities that are attributable to hardware are out of scope.
- If the issue was fixed in the `master` branch before we receive your report, it is invalid and not eligible for a bounty from this program.
- If the vulnerability involves binary exploitation, we may ask you to provide a proof of concept of secret key exfiltration.
- Vulnerabilities that are present in the monero submodule but were not introduced in patches made by the Feather developers must
-  be reported [upstream](https://github.com/monero-project/meta/blob/master/VULNERABILITY_RESPONSE_PROCESS.md) and are not eligible for a bounty from this program.
- Vulnerabilities that are present in any of our third-party dependencies must be reported upstream and are not eligible for a bounty from this program.
- Vulnerabilities that are present in [supported hardware wallets](https://docs.featherwallet.org/guides/hardware-wallet-support) must be reported upstream and are not eligible for a bounty from this program.
- A bounty will not be awarded if the reported vulnerability was already known. We may make an exception if you demonstrate that the severity of the issue was underestimated and no immediate fix was planned.
- If, during your research, you disrupt Feather's release infrastructure or services, or attempt to coerce its developers, you will not be awarded a bounty.
+Include the affected Wowlet version, operating system, expected impact and steps
+to reproduce the issue. Use a disposable wallet for any reproduction and never
+send a real wallet seed, private keys, password or wallet files.
@@ -5,4 +5,4 @@ echo $HERE

 # Tails 5.8 sets QT_QPA_PLATFORM to wayland which breaks our app
 export QT_QPA_PLATFORM=xcb
-${APPDIR}/usr/bin/feather $*
+${APPDIR}/usr/bin/wowlet $*
@@ -5,29 +5,29 @@ unset SOURCE_DATE_EPOCH

 # Manually create the AppImage (reproducibly) since linuxdeployqt is not able to create cross-compiled AppImages

-APPDIR="$PWD/feather.AppDir"
+APPDIR="$PWD/wowlet.AppDir"

 mkdir -p "$APPDIR"
 mkdir -p "$APPDIR/usr/share/applications/"
 mkdir -p "$APPDIR/usr/bin"

-cp "src/assets/feather.desktop" "$APPDIR/usr/share/applications/feather.desktop"
-cp "src/assets/feather.desktop" "$APPDIR/feather.desktop"
-cp "src/assets/images/appicons/64x64.png" "$APPDIR/feather.png"
-cp "build/bin/feather" "$APPDIR/usr/bin/feather"
-chmod +x "$APPDIR/usr/bin/feather"
+cp "src/assets/wowlet.desktop" "$APPDIR/usr/share/applications/wowlet.desktop"
+cp "src/assets/wowlet.desktop" "$APPDIR/wowlet.desktop"
+cp "src/assets/images/appicons/64x64.png" "$APPDIR/wowlet.png"
+cp "build/bin/wowlet" "$APPDIR/usr/bin/wowlet"
+chmod +x "$APPDIR/usr/bin/wowlet"

 cp "contrib/AppImage/AppRun" "$APPDIR/"
 chmod +x "$APPDIR/AppRun"

-find feather.AppDir/ -exec touch -h -a -m -t 202101010100.00 {} \;
+find wowlet.AppDir/ -exec touch -h -a -m -t 202101010100.00 {} \;

-mksquashfs feather.AppDir feather.squashfs -comp zstd -info -root-owned -no-xattrs -noappend -fstime 0
+mksquashfs wowlet.AppDir wowlet.squashfs -comp zstd -info -root-owned -no-xattrs -noappend -fstime 0
 # mksquashfs writes a timestamp to the header
-printf '\x00\x00\x00\x00' | dd conv=notrunc of=feather.squashfs bs=1 seek=$((0x8))
+printf '\x00\x00\x00\x00' | dd conv=notrunc of=wowlet.squashfs bs=1 seek=$((0x8))

-rm -f feather.AppImage
+rm -f wowlet.AppImage

-cat "${GITHUB_WORKSPACE:-/feather}/contrib/depends/${HOST}/runtime" >> feather.AppImage
-cat feather.squashfs >> feather.AppImage
-chmod a+x feather.AppImage
+cat "${GITHUB_WORKSPACE:-/feather}/contrib/depends/${HOST}/runtime" >> wowlet.AppImage
+cat wowlet.squashfs >> wowlet.AppImage
+chmod a+x wowlet.AppImage
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+appdir="${1:?usage: check-libcom-err.sh APPDIR}"
+library="$(find "$appdir/usr/lib" -name libcom_err.so.2 -print -quit 2>/dev/null || true)"
+if [[ -z "$library" || ! -e "$library" ]]; then
+  echo "ERROR: AppDir is missing the bundled libcom_err.so.2 runtime library." >&2
+  exit 1
+fi
@@ -43,6 +43,15 @@ SET(absl_ROOT @prefix@)
 SET(NATIVE_BIN_PATH @prefix@/native/bin CACHE FILEPATH "path to native binaries" FORCE)
 SET(LRELEASE_PATH @prefix@/native/bin CACHE FILEPATH "path to lrelease" FORCE)

+# A cross Qt that carries qtdeclarative makes find_package(Qt6) demand a HOST Qt,
+# because QML needs host-side tools (qmlcachegen, qmlimportscanner,
+# qmltyperegistrar). depends already builds one: native_qt installs to
+# native/qt-host and qt.mk hands that path to the cross Qt's own configure. Our
+# build never heard about it, so Qt6Config refused with "please set the
+# QT_HOST_PATH cache variable" and the Windows cross build has failed since
+# qtdeclarative landed. Same path, stated once more for the consuming project.
+SET(QT_HOST_PATH @prefix@/native/qt-host CACHE PATH "host Qt for cross QML tooling")
+
 if(NOT CMAKE_SYSTEM_NAME STREQUAL "Android")
 SET(LIBUNWIND_INCLUDE_DIR @prefix@/include)
 SET(LIBUNWIND_LIBRARIES @prefix@/lib/libunwind.a)
@@ -2,6 +2,7 @@ import os
 import glob

 DOCS_DIR = "external/feather-docs/content/_guides"
+OVERRIDES_DIR = "contrib/docs/overrides"
 OUT_DIR = "src/assets/docs"

 CATEGORY_MAP = {
@@ -21,9 +22,12 @@ outfiles = glob.glob(f"{OUT_DIR}/*.md")
 for file in outfiles:
    os.remove(file)

-files = glob.glob(f"{DOCS_DIR}/*.md")
+# Wowlet owns its support contacts. Local sources take precedence so regenerating
+# the bundled docs cannot restore Feather's contact details.
+files = {os.path.basename(path): path for path in glob.glob(f"{DOCS_DIR}/*.md")}
+files.update({os.path.basename(path): path for path in glob.glob(f"{OVERRIDES_DIR}/*.md")})

-for file in files:
+for file in sorted(files.values()):
    with open(file) as f:
        doc = f.read()

@@ -0,0 +1,29 @@
+---
+title: "How to report an issue"
+nav_title: "Report an issue"
+category: "help"
+---
+
+For help with Wowlet, contact the Wownero community:
+
+- Matrix: [#wownero-gen:wowne.ro](https://matrix.to/#/#wownero-gen:wowne.ro)
+- IRC: `#wownero` on [OFTC](https://www.oftc.net/)
+- Email: [wownero@wownero.org](mailto:wownero@wownero.org)
+- Bug reports: [Wowlet issues](https://github.com/wownero/wowlet/issues)
+
+For live support, use Matrix or IRC. If you do not have an IRC client, join
+[#wownero in your browser](https://webchat.oftc.net/?randomnick=1&channels=wownero).
+If nobody replies immediately, stay in the room and give volunteers time to respond.
+
+Please include your Wowlet version, operating system, the steps that caused the
+problem, and any error message. Review **Help → Debug Info** before sharing it and
+remove any personal information. Never share your wallet seed, private keys or
+password, and do not upload your wallet files.
+
+Report security vulnerabilities privately to
+[wownero@wownero.org](mailto:wownero@wownero.org), rather than in a public issue or
+chat. See the [Wowlet security policy](https://github.com/wownero/wowlet/blob/master/SECURITY.md).
+
+Downloads and signed release hashes are available from
+[Wowlet releases](https://github.com/wownero/wowlet/releases), also linked from
+[wownero.org](https://wownero.org/).
@@ -0,0 +1,85 @@
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from urllib.parse import parse_qs, urlsplit
+
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+class GenerateDocsTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.upstream = self.root / "external/feather-docs/content/_guides"
+        self.upstream.mkdir(parents=True)
+        self.output = self.root / "src/assets/docs"
+        self.output.mkdir(parents=True)
+        shutil.copytree(ROOT / "contrib/docs/overrides", self.root / "contrib/docs/overrides")
+
+    def write_upstream(self, name, body):
+        (self.upstream / name).write_text(
+            '---\ntitle: "Upstream guide"\nnav_title: "Upstream"\ncategory: "help"\n---\n'
+            + body
+        )
+
+    def generate(self):
+        result = subprocess.run(
+            [sys.executable, "-B", str(ROOT / "contrib/docs/generate.py")],
+            cwd=self.root, capture_output=True, text=True,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def assert_wownero_contacts(self, document):
+        urls = [urlsplit(url) for url in re.findall(r"\]\(([^)]+)\)", document)]
+        self.assertTrue(any(
+            url.hostname == "matrix.to" and url.fragment == "/#wownero-gen:wowne.ro"
+            for url in urls
+        ), "Matrix must lead to Wownero's published room")
+        self.assertTrue(any(
+            url.hostname == "webchat.oftc.net"
+            and "wownero" in parse_qs(url.query).get("channels", [])
+            for url in urls
+        ), "Webchat must join Wownero's IRC channel")
+        self.assertTrue(any(
+            url.hostname == "github.com" and url.path == "/wownero/wowlet/issues"
+            for url in urls
+        ), "Bug reports must go to the Wowlet tracker")
+        self.assertTrue(any(
+            url.scheme == "mailto" and url.path == "wownero@wownero.org"
+            for url in urls
+        ), "Email must reach the published Wownero contact")
+        for url in urls:
+            self.assertNotIn("feather", url.geturl().lower(), "Support must not route to Feather")
+
+    def test_support_override_survives_regeneration(self):
+        self.write_upstream("report_an_issue.md", "Upstream support contacts")
+        self.write_upstream("accounts.md", "An upstream guide without an override")
+        (self.output / "stale.md").write_text("Obsolete generated guide")
+        for body in ("Upstream support contacts", "Changed upstream support contacts"):
+            self.write_upstream("report_an_issue.md", body)
+            self.generate()
+            support = (self.output / "report_an_issue.md").read_text()
+            self.assert_wownero_contacts(support)
+            self.assertNotIn(body, support)
+            self.assertRegex(support, r"(?m)^\[nav_title\]: # \(.+\)$")
+            self.assertRegex(support, r"(?m)^\[category\]: # \(.+\)$")
+            self.assertIn("An upstream guide without an override", (self.output / "accounts.md").read_text())
+            self.assertFalse((self.output / "stale.md").exists())
+
+    def test_readme_and_security_contacts_agree_with_bundled_help(self):
+        readme = (ROOT / "README.md").read_text()
+        support = readme.split("## Support\n", 1)[1].split("\n## ", 1)[0]
+        self.assert_wownero_contacts(support)
+        policy = (ROOT / "SECURITY.md").read_text()
+        self.assertIn("mailto:wownero@wownero.org", policy)
+        self.assertNotIn("featherwallet.org", policy)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -34,13 +34,13 @@
  <string>????</string>

  <key>CFBundleExecutable</key>
-  <string>feather</string>
+  <string>wowlet</string>

  <key>CFBundleName</key>
-  <string>Feather</string>
+  <string>Wowlet</string>

  <key>CFBundleIdentifier</key>
-  <string>org.monero-project.feather</string>
+  <string>org.wownero.wowlet</string>

  <key>NSCameraUsageDescription</key>
  <string>Camera is used to scan QR codes on demand.</string>
@@ -0,0 +1,22 @@
+"""Refuse a build whose resolved source differs from its reviewed request."""
+import os
+import re
+import subprocess
+
+
+def check(expected, reported, checked_out):
+    if not re.fullmatch(r"[0-9a-f]{40}", expected or ""):
+        raise ValueError("expected_sha must identify the exact reviewed commit")
+    if reported != expected:
+        raise ValueError("provider run head differs from expected_sha")
+    if checked_out != expected:
+        raise ValueError("checked-out source differs from expected_sha")
+
+
+if __name__ == "__main__":
+    head = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
+    try:
+        check(os.environ.get("EXPECTED_SHA"), os.environ.get("GITHUB_SHA"), head)
+    except ValueError as error:
+        raise SystemExit(str(error)) from None
+    print("Exact requested build source verified")
@@ -0,0 +1,73 @@
+"""Fetch the pinned daemon archive and copy only its verified daemon binary."""
+import argparse
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import shutil
+import tarfile
+import tempfile
+import urllib.request
+import zipfile
+
+MAX_ARCHIVE = 300 * 1024 * 1024
+MAX_BINARY = 128 * 1024 * 1024
+TARGETS = {"x86_64-linux-gnu", "x86_64-w64-mingw32", "aarch64-apple-darwin11", "x86_64-apple-darwin11"}
+
+
+def copy_daemon(archive, destination, windows):
+    name = "wownerod.exe" if windows else "wownerod"
+    if windows:
+        container = zipfile.ZipFile(archive)
+        members = [m for m in container.infolist() if PurePosixPath(m.filename).name == name]
+        valid = lambda m: not m.is_dir() and (m.external_attr >> 16 & 0o170000) in (0, 0o100000) and 0 < m.file_size <= MAX_BINARY
+        reader = container.open
+    else:
+        container = tarfile.open(archive, "r:bz2")
+        members = [m for m in container.getmembers() if PurePosixPath(m.name).name == name]
+        valid = lambda m: m.isfile() and 0 < m.size <= MAX_BINARY
+        reader = container.extractfile
+    with container:
+        if len(members) != 1 or not valid(members[0]):
+            raise ValueError("Pinned archive must contain exactly one regular daemon binary")
+        # Do not extract archive paths, symlinks or unrelated files.
+        with reader(members[0]) as source, (destination / name).open("xb") as output:
+            shutil.copyfileobj(source, output)
+    (destination / name).chmod(0o755)
+
+
+def fetch(target, destination):
+    manifest = json.loads(Path(__file__).with_name("wownerod.json").read_text())
+    suffix = ".zip" if target.endswith("mingw32") else ".tar.bz2"
+    filename = f"wownero-{target}-{manifest['version']}{suffix}"
+    expected = manifest["archives"][filename]
+    destination.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix="wowlet-daemon-") as staging:
+        archive = Path(staging) / filename
+        digest = hashlib.sha256()
+        size = 0
+        url = f"https://github.com/wownero/wownero/releases/download/{manifest['version']}/{filename}"
+        with urllib.request.urlopen(url, timeout=120) as response, archive.open("xb") as output:
+            if not response.geturl().startswith("https://"):
+                raise ValueError("Daemon download redirected outside HTTPS")
+            while chunk := response.read(1024 * 1024):
+                size += len(chunk)
+                if size > MAX_ARCHIVE:
+                    raise ValueError("Daemon archive exceeds size bound")
+                digest.update(chunk)
+                output.write(chunk)
+        if digest.hexdigest() != expected:
+            raise ValueError("Daemon archive SHA-256 differs from the reviewed release pin")
+        copy_daemon(archive, destination, target.endswith("mingw32"))
+    print(f"Verified {filename}: {expected}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--target", required=True, choices=sorted(TARGETS))
+    parser.add_argument("--destination", required=True, type=Path)
+    args = parser.parse_args()
+    fetch(args.target, args.destination)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,204 @@
+"""Sign one private candidate without placing passwords in process arguments.
+
+Apple SecurityTool reads one quoted operation from stdin in interactive mode:
+https://github.com/apple-oss-distributions/SecurityTool/blob/main/security.c
+Output stays captured because native diagnostics may repeat supplied input.
+"""
+import base64
+from contextlib import contextmanager
+import json
+import os
+from pathlib import Path
+import secrets
+import shlex
+import subprocess
+import sys
+import tempfile
+import uuid
+
+
+FIELDS = (
+    "APPLE_CERTIFICATE", "APPLE_CERTIFICATE_PASSWORD", "APPLE_SIGNING_IDENTITY",
+    "APPLE_API_ISSUER", "APPLE_API_KEY", "APPLE_API_KEY_P8_BASE64",
+)
+
+
+def argument(value):
+    if any(ord(char) < 32 or ord(char) == 127 for char in value):
+        raise ValueError("Keychain input contains an unsupported control character")
+    return '"' + value.replace('\\', '\\\\').replace('"', '\\"') + '"'
+
+
+def child_environment():
+    return {key: os.environ[key] for key in ("HOME", "PATH", "TMPDIR", "LANG", "DEVELOPER_DIR") if key in os.environ}
+
+
+def security(operation, *values):
+    if operation not in {
+        "create-keychain", "set-keychain-settings", "unlock-keychain", "import",
+        "set-key-partition-list", "delete-keychain", "list-keychains",
+    }:
+        raise ValueError("Keychain operation is outside candidate signing")
+    command = " ".join(argument(value) for value in (operation, *values)) + "\n"
+    if len(command.encode()) > 1024:
+        raise ValueError("Keychain input exceeds the bounded operation size")
+    result = subprocess.run(
+        ["/usr/bin/security", "-i", "-q"], input=command,
+        text=True, capture_output=True, env=child_environment(), timeout=90,
+    )
+    if result.returncode:
+        # Never forward diagnostics or operation data. Report recognized causes.
+        causes = {
+            "MAC verification failed": "PKCS12 encoding or password verification failed",
+            "User interaction is not allowed": "keychain requires interactive access",
+            "already exists": "ephemeral keychain or imported identity already exists",
+            "could not be found": "requested keychain item was not found",
+        }
+        cause = next((cause for marker, cause in causes.items() if marker in result.stderr),
+                     "native keychain operation returned an error")
+        raise RuntimeError(f"{operation}: {cause} (exit {result.returncode}); raw diagnostics withheld")
+
+    return result.stdout
+
+
+def run(arguments, *, timeout=120):
+    result = subprocess.run(arguments, text=True, capture_output=True,
+                            env=child_environment(), timeout=timeout)
+    if result.returncode:
+        causes = {
+            "no identity found": "expected signing identity was not found",
+            "User interaction is not allowed": "signing key requires interactive access",
+            "errSecInternalComponent": "keychain denied access to the signing identity",
+            "not signed at all": "candidate contains an unsigned component",
+            "resource fork, Finder information": "candidate contains metadata forbidden by code signing",
+            "unable to build chain": "signing certificate chain could not be built",
+            "unsealed contents present": "embedded bundle has unsealed root contents",
+            "bundle format unrecognized": "component has an unsupported bundle format",
+            "timestamp service": "Apple timestamp service failed",
+            "Timestamping service": "Apple timestamp service failed",
+            "certificate has expired": "signing certificate has expired",
+            "CSSMERR_TP_CERT_EXPIRED": "signing certificate has expired",
+        }
+        cause = next((cause for marker, cause in causes.items() if marker in result.stderr),
+                     "native signing operation returned an error")
+        raise RuntimeError(f"{Path(arguments[0]).name}: {cause} (exit {result.returncode}); raw diagnostics withheld")
+    return result.stdout
+
+
+@contextmanager
+def keychain_search(keychain):
+    previous = [value for value in shlex.split(security("list-keychains", "-d", "user"))
+                if Path(value) != keychain]
+    if not previous or any(not Path(value).is_absolute() for value in previous):
+        raise RuntimeError("Existing user keychain search list is absent or malformed")
+    try:
+        security("list-keychains", "-d", "user", "-s", str(keychain), *previous)
+        yield
+    finally:
+        security("list-keychains", "-d", "user", "-s", *previous)
+
+
+def signable_files(app):
+    for path in sorted(app.rglob("*")):
+        if path.is_symlink() or not path.is_file() or any(part.endswith(".framework") for part in path.parts):
+            continue
+        if "Mach-O" in run(["/usr/bin/file", "-b", str(path)]):
+            yield path
+
+
+def private_file(path, content):
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(descriptor, "wb") as stream:
+        stream.write(content)
+
+
+def signing_inputs():
+    credentials = {name: os.environ.get(name, "") for name in FIELDS}
+    missing = [name for name, value in credentials.items() if not value]
+    if missing:
+        raise ValueError("Signing input is missing: " + ", ".join(missing))
+    if "Such Software" not in credentials["APPLE_SIGNING_IDENTITY"]:
+        raise ValueError("Developer ID identity does not name the expected publisher")
+    return credentials
+
+
+def main():
+    credentials = signing_inputs()
+    app = Path("build/dist/Wowlet.app").resolve()
+    if not app.is_dir():
+        raise ValueError("Packaged Wowlet.app is missing")
+    old_umask = os.umask(0o077)
+    try:
+        with tempfile.TemporaryDirectory(prefix=".wowlet-signing-", dir=app.parent) as temporary:
+            workspace = Path(temporary)
+            keychain = workspace / "candidate.keychain-db"
+            certificate = workspace / "identity.p12"
+            notary_key = workspace / "notary.p8"
+            private_file(certificate, base64.b64decode(credentials["APPLE_CERTIFICATE"]))
+            private_file(notary_key, base64.b64decode(credentials["APPLE_API_KEY_P8_BASE64"]))
+            password = secrets.token_hex(32)
+            created = False
+            try:
+                security("create-keychain", "-p", password, str(keychain))
+                created = True
+                security("set-keychain-settings", "-lut", "3600", str(keychain))
+                security("unlock-keychain", "-p", password, str(keychain))
+                security("import", str(certificate), "-k", str(keychain), "-P",
+                         credentials["APPLE_CERTIFICATE_PASSWORD"], "-T", "/usr/bin/codesign")
+                security("set-key-partition-list", "-S", "apple-tool:,apple:", "-s",
+                         "-k", password, str(keychain))
+
+                with keychain_search(keychain):
+                    def sign(path):
+                        print("Signing component: " + (str(path.relative_to(app)) if path != app else "Wowlet.app"), flush=True)
+                        run(["/usr/bin/codesign", "--force", "--options", "runtime", "--timestamp",
+                             "--keychain", str(keychain), "--sign",
+                             credentials["APPLE_SIGNING_IDENTITY"], str(path)])
+
+                    for path in signable_files(app):
+                        sign(path)
+                    frameworks = app / "Contents/Frameworks"
+                    for path in sorted(frameworks.glob("*.framework")):
+                        sign(path)
+                    sign(app)
+                    run(["/usr/bin/codesign", "--verify", "--deep", "--strict", str(app)])
+                    archive = workspace / "candidate.zip"
+                    run(["/usr/bin/ditto", "-c", "-k", "--keepParent", str(app), str(archive)])
+                    raw = run(["/usr/bin/xcrun", "notarytool", "submit", str(archive),
+                               "--key", str(notary_key), "--key-id", credentials["APPLE_API_KEY"],
+                               "--issuer", credentials["APPLE_API_ISSUER"], "--wait", "--timeout", "30m",
+                               "--output-format", "json"], timeout=1900)
+                    response = json.loads(raw)
+                    if response.get("status") != "Accepted":
+                        raise RuntimeError("Apple notarization did not return Accepted")
+                    try:
+                        uuid.UUID(response.get("id", ""))
+                    except (ValueError, TypeError, AttributeError):
+                        raise RuntimeError("Apple notarization submission identity is missing or malformed") from None
+                    run(["/usr/bin/xcrun", "stapler", "staple", str(app)])
+                    run(["/usr/bin/xcrun", "stapler", "validate", str(app)])
+                    private_file(app.parent / "macos-signing.json", json.dumps({
+                        "developer_id_verified": True, "notarization_status": "Accepted",
+                        "notary_submission_id": response.get("id"), "staple_validated": True,
+                    }, sort_keys=True).encode())
+                    print("Developer ID signature verified; notarization accepted; staple validated")
+            finally:
+                if created:
+                    security("delete-keychain", str(keychain))
+    finally:
+        os.umask(old_umask)
+
+
+if __name__ == "__main__":
+    try:
+        if sys.argv[1:] == ["--check-inputs"]:
+            signing_inputs()
+            print("Required signing inputs are present")
+        elif sys.argv[1:]:
+            raise ValueError("Use no arguments to sign or --check-inputs for the cheap input guard")
+        else:
+            main()
+    except (OSError, ValueError, RuntimeError, subprocess.TimeoutExpired) as error:
+        # These exceptions contain logical fields, native result classes or
+        # public file paths. Captured child output is never included.
+        raise SystemExit(str(error)) from None
@@ -0,0 +1,40 @@
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[3]
+CHECKER = ROOT / "contrib/AppImage/check-libcom-err.sh"
+
+
+class AppImageDependencyBundleTest(unittest.TestCase):
+    def test_accepts_appdir_with_libcom_err(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            appdir = Path(temporary) / "AppDir"
+            library = appdir / "usr/lib/libcom_err.so.2"
+            library.parent.mkdir(parents=True)
+            library.write_bytes(b"fixture")
+
+            result = subprocess.run(["bash", str(CHECKER), str(appdir)], check=False)
+
+            self.assertEqual(result.returncode, 0)
+
+    def test_refuses_appdir_without_libcom_err(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            appdir = Path(temporary) / "AppDir"
+            (appdir / "usr/lib").mkdir(parents=True)
+
+            result = subprocess.run(
+                ["bash", str(CHECKER), str(appdir)],
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+
+            self.assertNotEqual(result.returncode, 0)
+            self.assertTrue(result.stderr.strip())
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,20 @@
+import importlib.util
+from pathlib import Path
+import unittest
+
+spec = importlib.util.spec_from_file_location("dispatch", Path(__file__).parents[1] / "check_dispatch.py")
+dispatch = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(dispatch)
+
+
+class DispatchTests(unittest.TestCase):
+    def test_exact_source_is_required_before_building(self):
+        sha = "a" * 40
+        dispatch.check(sha, sha, sha)
+        for expected, reported, checked_out in (
+            (None, sha, sha), ("master", sha, sha),
+            (sha, "b" * 40, sha), (sha, sha, "b" * 40),
+        ):
+            with self.subTest(expected=expected, reported=reported, checked_out=checked_out):
+                with self.assertRaises(ValueError):
+                    dispatch.check(expected, reported, checked_out)
@@ -0,0 +1,49 @@
+import importlib.util
+import io
+from pathlib import Path
+import tarfile
+import tempfile
+import unittest
+from unittest.mock import patch
+
+SPEC = importlib.util.spec_from_file_location("fetch_wownerod", Path(__file__).parents[1] / "fetch_wownerod.py")
+fetcher = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(fetcher)
+
+
+class DaemonTests(unittest.TestCase):
+    def test_checksum_failure_never_extracts_a_daemon(self):
+        response = io.BytesIO(b"untrusted archive bytes")
+        response.geturl = lambda: "https://release-assets.githubusercontent.com/archive"
+        with tempfile.TemporaryDirectory() as tmp, patch.object(fetcher.urllib.request, "urlopen", return_value=response), patch.object(fetcher, "copy_daemon") as extract:
+            with self.assertRaisesRegex(ValueError, "SHA-256"):
+                fetcher.fetch("x86_64-linux-gnu", Path(tmp) / "daemon")
+            extract.assert_not_called()
+            self.assertFalse((Path(tmp) / "daemon/wownerod").exists())
+
+    def test_archive_paths_cannot_write_outside_destination(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            archive = root / "daemon.tar.bz2"
+            with tarfile.open(archive, "w:bz2") as output:
+                info = tarfile.TarInfo("../../wownerod")
+                info.size = 3
+                output.addfile(info, io.BytesIO(b"exe"))
+            destination = root / "stage"
+            destination.mkdir()
+            fetcher.copy_daemon(archive, destination, False)
+            self.assertEqual((destination / "wownerod").read_bytes(), b"exe")
+            self.assertFalse((root / "wownerod").exists())
+
+    def test_symlink_daemon_is_refused(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            archive = root / "daemon.tar.bz2"
+            with tarfile.open(archive, "w:bz2") as output:
+                info = tarfile.TarInfo("wownerod")
+                info.type = tarfile.SYMTYPE
+                info.linkname = "/etc/passwd"
+                output.addfile(info)
+            with self.assertRaisesRegex(ValueError, "regular daemon"):
+                fetcher.copy_daemon(archive, root, False)
+            self.assertFalse((root / "wownerod").exists())
@@ -0,0 +1,26 @@
+import importlib.util
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, str(Path(__file__).parents[1]))
+SPEC = importlib.util.spec_from_file_location("write_receipt", Path(__file__).parents[1] / "write_receipt.py")
+receipt = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(receipt)
+
+
+class ReceiptTests(unittest.TestCase):
+    def test_hash_changes_with_artifact_bytes_and_symlinks_refuse(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "candidate.zip"
+            path.write_bytes(b"candidate")
+            first = receipt.file_record(path)
+            path.write_bytes(b"different candidate")
+            second = receipt.file_record(path)
+            self.assertNotEqual(first["sha256"], second["sha256"])
+            self.assertEqual(second["size"], path.stat().st_size)
+            link = Path(tmp) / "link.zip"
+            link.symlink_to(path)
+            with self.assertRaisesRegex(ValueError, "regular file"):
+                receipt.file_record(link)
@@ -0,0 +1,95 @@
+import importlib.util
+from pathlib import Path
+from types import SimpleNamespace
+import unittest
+import tempfile
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location("sign_macos", Path(__file__).parents[1] / "sign_macos.py")
+signing = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(signing)
+
+
+class MacSigningTests(unittest.TestCase):
+    def test_password_uses_private_input_and_diagnostics_never_echo_it(self):
+        synthetic = 'synthetic "quoted" value \\ with spaces'
+        captured = []
+
+        def execute(arguments, **options):
+            captured.append((arguments, options))
+            return SimpleNamespace(returncode=1, stdout=synthetic,
+                                   stderr="MAC verification failed " + synthetic)
+
+        with patch.object(signing.subprocess, "run", execute):
+            with self.assertRaises(RuntimeError) as caught:
+                signing.security("import", "candidate.p12", "-P", synthetic)
+        self.assertNotIn(synthetic, str(caught.exception))
+        arguments, options = captured[0]
+        self.assertNotIn(synthetic, " ".join(arguments))
+        self.assertIn("quoted", options["input"])
+        self.assertTrue(options["capture_output"])
+        self.assertNotIn("APPLE_CERTIFICATE_PASSWORD", options["env"])
+
+    def test_missing_inputs_refuse_without_native_operations(self):
+        with patch.dict(signing.os.environ, {}, clear=True), patch.object(signing.subprocess, "run") as execute:
+            with self.assertRaises(ValueError):
+                signing.signing_inputs()
+            execute.assert_not_called()
+
+    def test_control_characters_and_unrelated_keychain_operations_refuse(self):
+        with patch.object(signing.subprocess, "run") as execute:
+            for value in ("line\nbreak", "nul\x00byte", "carriage\rreturn"):
+                with self.assertRaises(ValueError):
+                    signing.security("unlock-keychain", "-p", value, "candidate.keychain")
+            with self.assertRaises(ValueError):
+                signing.security("dump-keychain", "login.keychain")
+            execute.assert_not_called()
+
+    def test_user_keychain_search_is_restored_after_signing_failure(self):
+        previous = ['/Users/runner/Library/Keychains/login.keychain-db', '/Library/Keychains/System.keychain']
+        calls = []
+        def security(operation, *values):
+            calls.append((operation, values))
+            return ' '.join('"' + value + '"' for value in previous)
+        with patch.object(signing, "security", security):
+            with self.assertRaisesRegex(RuntimeError, "synthetic signing failure"):
+                with signing.keychain_search(Path('/private/candidate.keychain-db')):
+                    self.assertEqual(calls[-1][1][-len(previous):], tuple(previous))
+                    self.assertIn('/private/candidate.keychain-db', calls[-1][1])
+                    raise RuntimeError('synthetic signing failure')
+        self.assertEqual(calls[-1], ('list-keychains', ('-d', 'user', '-s', *previous)))
+
+    def test_failed_search_list_write_still_restores_original_list(self):
+        calls = []
+        previous = '/Users/runner/Library/Keychains/login.keychain-db'
+        def security(operation, *values):
+            calls.append((operation, values))
+            if '/private/candidate.keychain-db' in values:
+                raise RuntimeError('synthetic search write failure')
+            return '"' + previous + '"'
+        with patch.object(signing, "security", security):
+            with self.assertRaises(RuntimeError):
+                with signing.keychain_search(Path('/private/candidate.keychain-db')):
+                    self.fail('failed search-list setup entered signing')
+        self.assertEqual(calls[-1][1], ('-d', 'user', '-s', previous))
+
+    def test_signing_walk_skips_symlink_aliases_and_framework_internals(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary)
+            executable = app / 'actual.dylib'
+            executable.write_bytes(b'mach-o fixture')
+            (app / 'alias.dylib').symlink_to(executable.name)
+            framework = app / 'QtCore.framework'
+            framework.mkdir()
+            (framework / 'QtCore').write_bytes(b'framework fixture')
+            with patch.object(signing, 'run', return_value='Mach-O arm64'):
+                self.assertEqual(list(signing.signable_files(app)), [executable])
+
+    def test_native_failure_cause_does_not_echo_untrusted_diagnostics(self):
+        sentinel = 'must-not-echo-native-input'
+        result = SimpleNamespace(returncode=1, stdout='', stderr='unable to build chain ' + sentinel)
+        with patch.object(signing.subprocess, 'run', return_value=result):
+            with self.assertRaises(RuntimeError) as caught:
+                signing.run(['/usr/bin/codesign', 'public-component'])
+        self.assertIn('certificate chain', str(caught.exception))
+        self.assertNotIn(sentinel, str(caught.exception))
@@ -0,0 +1,12 @@
+{
+  "version": "v0.11.5.0",
+  "source_commit": "b22382c55fa2a97cd70aca450026b8e2bb8711a6",
+  "checksum_evidence": "https://github.com/wownero/wownero/actions/runs/37402323531",
+  "checksum_signature": "The release tag build replaced the archives after SHA256SUMS.txt.asc was signed. These hashes match the successful tag build and current release metadata; that signature does not cover these archives.",
+  "archives": {
+    "wownero-x86_64-w64-mingw32-v0.11.5.0.zip": "46dffbd313de1df4667516acf23737f986eb2e131c06a8dde1d11dcff2eb06e2",
+    "wownero-aarch64-apple-darwin11-v0.11.5.0.tar.bz2": "bad8cc7f1c78d026e63dbe3ffc0f2175d50b986bbde3fc18826a04ff693866d4",
+    "wownero-x86_64-apple-darwin11-v0.11.5.0.tar.bz2": "ae562c90a10856fcdd183dc9530dff73e46ed6eece9fb8dcfaa77f1e07174787",
+    "wownero-x86_64-linux-gnu-v0.11.5.0.tar.bz2": "2d0cc62c24255d45c51936616559651378011501c55a8caadb9a125bb875849b"
+  }
+}
@@ -0,0 +1,59 @@
+"""Bind candidate archive hashes to the checked source and provider run."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+
+from check_dispatch import check
+
+
+def file_record(path):
+    if not path.is_file() or path.is_symlink() or path.stat().st_size == 0:
+        raise ValueError("Candidate artifact must be a nonempty regular file")
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        while chunk := stream.read(1024 * 1024):
+            digest.update(chunk)
+    return {"name": path.name, "size": path.stat().st_size, "sha256": digest.hexdigest()}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--platform", required=True, choices=("linux", "macos", "windows-build"))
+    parser.add_argument("--file", type=Path, required=True, action="append")
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    head = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
+    check(os.environ.get("EXPECTED_SHA"), os.environ.get("GITHUB_SHA"), head)
+    run_id = os.environ.get("GITHUB_RUN_ID", "")
+    if not re.fullmatch(r"[1-9][0-9]*", run_id):
+        raise ValueError("Provider run identity is absent")
+    version = re.findall(r'^\s*VERSION "([0-9]+\.[0-9]+\.[0-9]+)"\s*$', Path("CMakeLists.txt").read_text(), re.M)
+    if len(version) != 1:
+        raise ValueError("Committed Wowlet version is ambiguous")
+    module = subprocess.check_output(["git", "ls-tree", "HEAD", "monero"], text=True).split()
+    if len(module) != 4 or module[:2] != ["160000", "commit"] or module[3] != "monero":
+        raise ValueError("Committed wallet-library pin is absent")
+    files = [file_record(path) for path in args.file]
+    if len({row["name"] for row in files}) != len(files):
+        raise ValueError("Candidate artifact filenames repeat")
+    receipt = {"schema_version": 1, "app": "wowlet", "version": version[0], "platform": args.platform,
+               "dispatch_commit": head, "wallet_library_commit": module[2],
+               "environment_run_id": run_id, "environment_run_attempt": os.environ.get("GITHUB_RUN_ATTEMPT"),
+               "artifacts": files}
+    if args.platform == "macos":
+        signing = json.loads(Path("build/dist/macos-signing.json").read_text())
+        if signing.get("developer_id_verified") is not True or signing.get("notarization_status") != "Accepted" or signing.get("staple_validated") is not True:
+            raise ValueError("macOS signing evidence is incomplete")
+        receipt["signing"] = signing
+    with args.output.open("x") as stream:
+        json.dump(receipt, stream, indent=2)
+        stream.write("\n")
+    print("Candidate source and artifact hashes recorded")
+
+
+if __name__ == "__main__":
+    main()
@@ -148,7 +148,10 @@ add_executable(feather ${EXECUTABLE_FLAG} main.cpp
        ${ASSETS_TOR}
 )

+# The CMake target keeps its upstream name so the target_* calls below stay put;
+# only what we ship is renamed.
 set_target_properties(feather PROPERTIES
+        OUTPUT_NAME wowlet
        RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin"
        LINK_FLAGS_RELEASE -s
 )
@@ -370,14 +373,14 @@ else()
    )

    if (UNIX AND NOT APPLE)
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/feather.desktop DESTINATION ${CMAKE_INSTALL_PREFIX}/share/applications)
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/32x32.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/32x32/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/48x48.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/48x48/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/64x64.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/64x64/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/96x96.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/96x96/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/128x128.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/128x128/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/256x256.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/256x256/apps RENAME "feather.png")
-        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/512x512.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/512x512/apps RENAME "feather.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/wowlet.desktop DESTINATION ${CMAKE_INSTALL_PREFIX}/share/applications)
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/32x32.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/32x32/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/48x48.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/48x48/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/64x64.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/64x64/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/96x96.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/96x96/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/128x128.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/128x128/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/256x256.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/256x256/apps RENAME "wowlet.png")
+        install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/assets/images/appicons/512x512.png DESTINATION ${CMAKE_INSTALL_PREFIX}/share/icons/hicolor/512x512/apps RENAME "wowlet.png")
    endif()
 endif()

@@ -385,13 +388,14 @@ if(APPLE)
    configure_file(${CMAKE_SOURCE_DIR}/contrib/macdeploy/Info.plist.in ${CMAKE_SOURCE_DIR}/contrib/macdeploy/Info.plist @ONLY)

    set_target_properties(feather PROPERTIES
+            OUTPUT_NAME wowlet
            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin"
            MACOSX_BUNDLE TRUE
            MACOSX_BUNDLE_INFO_PLIST "${CMAKE_SOURCE_DIR}/contrib/macdeploy/Info.plist"
            LINK_FLAGS_RELEASE -s
    )

-    file(COPY "${CMAKE_SOURCE_DIR}/src/assets/images/appicons/appicon.icns" DESTINATION "${CMAKE_SOURCE_DIR}/installed/feather.app/Contents/Resources/" )
+    file(COPY "${CMAKE_SOURCE_DIR}/src/assets/images/appicons/appicon.icns" DESTINATION "${CMAKE_SOURCE_DIR}/installed/wowlet.app/Contents/Resources/" )
 endif()

 qt_finalize_executable(feather)
@@ -252,7 +252,7 @@ void MainWindow::initWidgets() {
    });

    // [Mining] — wowlet: the pixel-art mining tab (mining.qml + embedded-node solo miner)
-    m_miningWidget = new MiningWidget(m_wallet, this);
+    m_miningWidget = new MiningWidget(m_wallet, m_nodes, this);
    ui->tabWidget->addTab(m_miningWidget, "Mining");

    // [Notes]
@@ -23,7 +23,7 @@ ReceiveWidget::ReceiveWidget(Wallet *wallet, QWidget *parent)

    // wowlet: ambient scene as a short banner under the address table. A layout
    // item, never an overlay over the table.
-    auto *scene = new SceneWidget(this, SceneWidget::Dawn);
+    auto *scene = new SceneWidget(this, SceneWidget::Dawn, SceneWidget::Sit);
    scene->setMinimumHeight(110);
    scene->setMaximumHeight(130);
    ui->verticalLayout->addWidget(scene);
@@ -29,10 +29,17 @@ SendWidget::SendWidget(Wallet *wallet, QWidget *parent)
    // wowlet: the form only needs the top of the tab — give the rest of it to
    // the ambient scene. A layout item under the form, never an overlay: the
    // send form itself stays untouched.
-    auto *scene = new SceneWidget(this, SceneWidget::Night);
+    //
+    // Centred in the space below the form rather than stacked straight under
+    // it: butted up against the Clear/Send row the scene reads as part of the
+    // form, and a band of night sky touching a button looks like a mistake.
+    auto *scene = new SceneWidget(this, SceneWidget::Night, SceneWidget::Money);
    scene->setMinimumHeight(160);
-    scene->setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
-    ui->verticalLayoutOuter->addWidget(scene, 1);
+    scene->setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Preferred);
+    ui->verticalLayoutOuter->addSpacing(14);   // never touches the Send row
+    ui->verticalLayoutOuter->addStretch(1);
+    ui->verticalLayoutOuter->addWidget(scene);
+    ui->verticalLayoutOuter->addStretch(1);

    QString amount_rx = R"(^\d{0,8}[\.,]\d{0,12}|(all)$)";
    QRegularExpression rx;
@@ -512,6 +512,10 @@ Rectangle {
                    Image {
                        id: imgAxe
                        visible: mining.daemonMiningState === 0
+                        // Greyed out while the wallet is on someone else's node:
+                        // solo mining is an RPC to the daemon we are connected
+                        // to, and that daemon has to be ours.
+                        opacity: mining.canMine ? 1.0 : 0.35
                        source: "qrc:/mining/axe.png"
                        width: 73
                        height: 75
@@ -551,7 +555,11 @@ Rectangle {
                        cursorShape: Qt.PointingHandCursor

                        onClicked: {
-                            if(mining.daemonMiningState === 0) {
+                            if (mining.daemonMiningState === 0) {
+                                if (!mining.canMine) {
+                                    remoteNodeNotice.flash();
+                                    return;
+                                }
                                root.startMining();
                                root.calcAvailableHeightConsoleLines();
                            }
@@ -559,14 +567,56 @@ Rectangle {
                                root.stopMining();
                        }
                        onEntered: {
-                            imgAxe.height = 64
-                            imgAxe.width = 64
+                            if (mining.canMine) {
+                                imgAxe.height = 64
+                                imgAxe.width = 64
+                            } else {
+                                remoteNodeNotice.show();
+                            }
                        }
                        onExited: {
                            imgAxe.height = 75
                            imgAxe.width = 73
+                            remoteNodeNotice.hideSoon();
                        }
                    }
+
+                    // Why the axe is greyed out. Shown on hover, and flashed if
+                    // the axe is clicked anyway.
+                    Rectangle {
+                        id: remoteNodeNotice
+                        z: parent.z + 5
+                        visible: opacity > 0.01
+                        opacity: 0.0
+                        width: 250
+                        height: noticeText.implicitHeight + 16
+                        radius: 6
+                        color: "#231a10"
+                        border.color: "#e0b062"
+                        border.width: 1
+                        anchors.right: parent.left
+                        anchors.rightMargin: 8
+                        anchors.verticalCenter: parent.verticalCenter
+
+                        Text {
+                            id: noticeText
+                            anchors.centerIn: parent
+                            width: parent.width - 16
+                            wrapMode: Text.WordWrap
+                            horizontalAlignment: Text.AlignHCenter
+                            color: "#f2dcb4"
+                            font.pointSize: 9
+                            text: "Mining needs your own node.\nYou are connected to a remote one. " +
+                                  "start the built-in node or point the wallet at a local daemon " +
+                                  "under Settings to mine."
+                        }
+
+                        Behavior on opacity { NumberAnimation { duration: 160 } }
+                        Timer { id: noticeHide; interval: 2600; onTriggered: remoteNodeNotice.opacity = 0.0 }
+                        function show()     { noticeHide.stop(); opacity = 1.0 }
+                        function hideSoon() { noticeHide.restart() }
+                        function flash()    { show(); noticeHide.restart() }
+                    }
                }
            }
        }
@@ -137,7 +137,7 @@
       <item row="3" column="1">
        <widget class="QLabel" name="label_11">
         <property name="text">
-          <string>codeberg.org/wownero/wowlet</string>
+          <string>github.com/wownero/wowlet</string>
         </property>
         <property name="textInteractionFlags">
          <set>Qt::TextInteractionFlag::LinksAccessibleByMouse|Qt::TextInteractionFlag::TextSelectableByMouse</set>
@@ -3,6 +3,8 @@

 #include "MiningWidget.h"

+#include "utils/nodes.h"
+
 #include <algorithm>

 #include <QVBoxLayout>
@@ -20,9 +22,10 @@ static QString formatUptime(qint64 secs) {
        .arg(secs % 60, 2, 10, QChar('0'));
 }

-MiningWidget::MiningWidget(Wallet *wallet, QWidget *parent)
+MiningWidget::MiningWidget(Wallet *wallet, Nodes *nodes, QWidget *parent)
    : QWidget(parent)
    , m_wallet(wallet)
+    , m_nodes(nodes)
    , m_quickWidget(new QQuickWidget(this))
    , m_backend(new MiningBackend(this))
    , m_timer(new QTimer(this))
@@ -46,6 +49,10 @@ MiningWidget::MiningWidget(Wallet *wallet, QWidget *parent)
 }

 void MiningWidget::onStartMining() {
+    // The QML disables the control, but the signal is not a promise: refuse
+    // here too rather than send start_mining to a stranger's daemon.
+    if (!m_backend->canMine())
+        return;
    int threads = std::max(1, QThread::idealThreadCount() / 2);
    if (m_wallet->startMining(threads))
        m_backend->setState(3);
@@ -57,6 +64,8 @@ void MiningWidget::onStopMining() {
 }

 void MiningWidget::poll() {
+    m_backend->setCanMine(m_nodes && m_nodes->connection().isLocal());
+
    bool mining = m_wallet->isMining();
    m_backend->setState(mining ? 3 : 0);

@@ -5,6 +5,8 @@
 #define WOWLET_MININGWIDGET_H

 #include <QWidget>
+
+class Nodes;
 #include <QTimer>
 #include <QQuickWidget>

@@ -16,16 +18,24 @@ class MiningBackend : public QObject {
 Q_OBJECT
    Q_PROPERTY(int daemonMiningState READ daemonMiningState NOTIFY daemonMiningStateChanged)
    Q_PROPERTY(bool reducedMotion READ reducedMotion NOTIFY reducedMotionChanged)
+    Q_PROPERTY(bool canMine READ canMine NOTIFY canMineChanged)
 public:
    explicit MiningBackend(QObject *parent = nullptr) : QObject(parent) {}
    int daemonMiningState() const { return m_state; }
    void setState(int s) { if (m_state != s) { m_state = s; emit daemonMiningStateChanged(); } }
    bool reducedMotion() const { return m_reducedMotion; }
    void setReducedMotion(bool r) { if (m_reducedMotion != r) { m_reducedMotion = r; emit reducedMotionChanged(); } }
+    // Solo mining is a start_mining RPC to whichever daemon the wallet is
+    // connected to. Against a remote node that is either refused outright or —
+    // worse, if the operator left the RPC open — it puts someone else's machine
+    // to work on our address. It is only ever ours to ask of our own node.
+    bool canMine() const { return m_canMine; }
+    void setCanMine(bool c) { if (m_canMine != c) { m_canMine = c; emit canMineChanged(); } }

 signals:
    void daemonMiningStateChanged();
    void reducedMotionChanged();
+    void canMineChanged();
    void daemonOutput(const QString &line);
    void syncStatus(int from, int to, int pct);
    void uptimeChanged(const QString &uptime);
@@ -34,6 +44,7 @@ signals:
 private:
    int m_state = 0;   // 0:idle 1:startup 2:syncing 3:mining
    bool m_reducedMotion = false;
+    bool m_canMine = false;
 };

 // wowlet: the pixel-art mining tab. Hosts mining.qml and wires its pick-axe to the wallet's solo
@@ -41,7 +52,7 @@ private:
 class MiningWidget : public QWidget {
 Q_OBJECT
 public:
-    explicit MiningWidget(Wallet *wallet, QWidget *parent = nullptr);
+    explicit MiningWidget(Wallet *wallet, Nodes *nodes, QWidget *parent = nullptr);

 private slots:
    void onStartMining();
@@ -50,6 +61,7 @@ private slots:

 private:
    Wallet *m_wallet;
+    Nodes *m_nodes;
    QQuickWidget *m_quickWidget;
    MiningBackend *m_backend;
    QTimer *m_timer;
@@ -4,18 +4,44 @@
 #include "SceneWidget.h"

 #include <QQmlContext>
+#include <QQuickItem>

 #include "utils/config.h"

-SceneWidget::SceneWidget(QWidget *parent, Variant variant)
+SceneWidget::SceneWidget(QWidget *parent, Variant variant, Mode mode)
    : QQuickWidget(parent)
    , m_backend(new SceneBackend(this))
 {
    m_backend->setReducedMotion(conf()->get(Config::reducedMotion).toBool());
    m_backend->setVariant(static_cast<int>(variant));
+    m_backend->setMode(mode == Sit   ? QStringLiteral("sit")
+                     : mode == Money ? QStringLiteral("money")
+                                     : QStringLiteral("run"));
    this->rootContext()->setContextProperty("sceneCtx", m_backend);
    this->setResizeMode(QQuickWidget::SizeRootObjectToView);
    this->setSource(QUrl("qrc:/qml/scene.qml"));
+    this->callScene("suspend");
+}
+
+void SceneWidget::showEvent(QShowEvent *event) {
+    QQuickWidget::showEvent(event);
+    this->callScene("restart");
+}
+
+void SceneWidget::hideEvent(QHideEvent *event) {
+    this->callScene("suspend");
+    QQuickWidget::hideEvent(event);
+}
+
+void SceneWidget::resizeEvent(QResizeEvent *event) {
+    QQuickWidget::resizeEvent(event);
+    if (this->isVisible())
+        this->callScene("restart");
+}
+
+void SceneWidget::callScene(const char *method) {
+    if (auto *root = this->rootObject())
+        QMetaObject::invokeMethod(root, method);
 }

 void SceneWidget::refreshReducedMotion() {
@@ -5,6 +5,7 @@
 #define WOWLET_SCENEWIDGET_H

 #include <QObject>
+#include <QString>
 #include <QQuickWidget>

 // Context object exposed to scene.qml as `sceneCtx`. Carries the reduced-motion
@@ -14,18 +15,23 @@ class SceneBackend : public QObject {
 Q_OBJECT
    Q_PROPERTY(bool reducedMotion READ reducedMotion NOTIFY reducedMotionChanged)
    Q_PROPERTY(int variant READ variant NOTIFY variantChanged)
+    Q_PROPERTY(QString mode READ mode NOTIFY modeChanged)
 public:
    explicit SceneBackend(QObject *parent = nullptr) : QObject(parent) {}
    bool reducedMotion() const { return m_reducedMotion; }
    void setReducedMotion(bool r) { if (m_reducedMotion != r) { m_reducedMotion = r; emit reducedMotionChanged(); } }
    int variant() const { return m_variant; }
    void setVariant(int v) { if (m_variant != v) { m_variant = v; emit variantChanged(); } }
+    QString mode() const { return m_mode; }
+    void setMode(const QString &m) { if (m_mode != m) { m_mode = m; emit modeChanged(); } }
 signals:
    void reducedMotionChanged();
    void variantChanged();
+    void modeChanged();
 private:
    bool m_reducedMotion = false;
    int  m_variant = 0;
+    QString m_mode = QStringLiteral("run");
 };

 // wowlet: reusable ambient-scene surface. Hosts scene.qml and reads the
@@ -38,9 +44,32 @@ public:
    // same field. Must match the `skies` table in scene.qml.
    enum Variant { Dusk = 0, Dawn = 1, Night = 2 };

-    explicit SceneWidget(QWidget *parent = nullptr, Variant variant = Dusk);
+    // How much scene a surface wants. History has room for the whole run;
+    // Receive gets a doge sitting in the field; Send gets money blowing past and
+    // nothing else, so the form it sits under is not competing with a dog.
+    enum Mode { Run, Sit, Money };
+
+    explicit SceneWidget(QWidget *parent = nullptr, Variant variant = Dusk,
+                         Mode mode = Run);
    void refreshReducedMotion();
+
+protected:
+    // A scene on a hidden tab is parked rather than left running: an unshown
+    // QQuickWidget is 0px wide, and a lap run against a 0px field collects every
+    // coin at once and leaves its litter (+1s, barks) to surface on the real lap
+    // when the tab is finally shown. Parking also keeps a background tab from
+    // burning CPU on animation nobody is looking at.
+    void showEvent(QShowEvent *event) override;
+    void hideEvent(QHideEvent *event) override;
+    // Belt and braces: a scene that is on screen and has just been given a real
+    // size is running, whether or not a show event was the thing that got it
+    // there. `restart` only sets a flag, so re-arming an already-running scene
+    // costs nothing and does not interrupt its lap.
+    void resizeEvent(QResizeEvent *event) override;
+
 private:
+    void callScene(const char *method);
+
    SceneBackend *m_backend;
 };
Author	SHA1	Message	Date
John Winter MurphyandGitHub	64529590a5	Merge pull request #5 from wownero/fix/appimage-libcom-err-20261024 fix(appimage): bundle libcom_err runtime	2026-10-24 12:10:01 -04:00
such-gitea	3c5aaed087	fix(appimage): bundle libcom_err runtime	2026-10-24 12:09:17 -04:00
John Winter MurphyandGitHub	020b177bd1	Merge pull request #4 from wownero/fix/macos-signing-keychain-515 fix(release): restore Mac signing keychain search	2026-10-17 08:29:38 -04:00
such-gitea	fb0c34cd70	fix(release): restore Mac signing keychain search	2026-10-17 08:27:14 -04:00
John Winter MurphyandGitHub	e0670bede5	Merge pull request #3 : retain candidate source and signing evidence fix(release): bind candidate files and signing evidence to each run	2026-10-17 06:21:55 -04:00
such-gitea	ea04f585aa	fix(release): bind candidate hashes and signing evidence to each run	2026-10-17 06:20:40 -04:00
John Winter MurphyandGitHub	25a341fd10	Merge pull request #2 : prepare Wowlet 5.1.5 security release chore(release): prepare Wowlet 5.1.5	2026-10-17 06:04:13 -04:00
such-gitea	ec8bdf4dfe	fix(wallet): include the Wownero 0.11.5.0 security library	2026-10-17 06:03:15 -04:00
such-gitea	34bdecf5ac	fix(release): embed the verified Wownero 0.11.5.0 daemon	2026-10-17 05:59:54 -04:00
such-gitea	d9cd8e328e	fix(release): check macOS signing inputs before compilation	2026-10-17 05:52:26 -04:00
such-gitea	998684c1a7	ci(release): bind private Wowlet candidates to reviewed source	2026-10-17 05:51:46 -04:00
such-gitea	bf455e06f1	chore(release): prepare Wowlet 5.1.5	2026-10-17 05:46:57 -04:00
John Winter MurphyandGitHub	4e3f74a38a	fix: use Wownero support contacts Use Wownero support contacts and preserve them when regenerating bundled guides. Run lightweight source checks on GitHub; release builds remain in the private Builds system.	2026-10-17 05:32:51 -04:00
such-gitea	4050d51760	ci: keep GitHub source checks separate from private release builds	2026-10-17 05:15:39 -04:00
such-gitea	8dacc3ba5a	ci: gate Wowlet documentation changes	2026-10-16 14:43:04 -04:00
such-gitea	66c16d152d	fix(docs): route Wowlet support to Wownero contacts	2026-10-16 14:27:59 -04:00
jwinterm	f4bbfd49ad	fix(ci): publish the signed Windows zips to the tag's release The Linux and macOS jobs already attach their tag-build output to the release, because this Gitea reports zero artifacts for every run through its REST API and its web download route answers "Not found." under every auth style. The Windows job was left out, so even a green signed build produced an exe nobody could fetch back. The step runs after the Authenticode, RFC 3161 timestamp and signer checks, so an unsigned or untimestamped binary can never reach a release. Both archives go up: the signed one users should download, and the unsigned one that stays byte-reproducible for verifiers. curl.exe rather than Invoke-WebRequest, because `shell: powershell` is Windows PowerShell 5.1 and its Invoke-WebRequest has no -Form for multipart uploads. Fail-safe like the others: no token, no resolvable release or a non-201 upload reports itself and exits 0 rather than reddening a build that produced a correctly signed binary.	2026-09-13 18:09:17 -04:00
jwinterm	142b79ee27	fix(depends): tell the consuming build where the host Qt is A cross Qt carrying qtdeclarative makes find_package(Qt6) demand a host Qt, because QML needs host-side tools: qmlcachegen, qmlimportscanner and qmltyperegistrar. depends already builds one. native_qt installs it to native/qt-host, and qt.mk passes that path to the cross Qt's own configure. What nobody passed it to was wowlet. Qt6Config re-runs the host-path setup when our project calls find_package, finds nothing, and stops with "To use a cross-compiled Qt, please set the QT_HOST_PATH cache variable". The Windows cross build has failed that way on every tag since qtdeclarative landed in June, which is why 5.1.4 shipped macOS and Linux but no exe. Stating it in the toolchain rather than in the workflow fixes every cross target and anyone building locally through depends, and the built-cache key already hashes this file, so the stale mingw tree is rebuilt rather than restored without the host Qt.	2026-09-13 18:06:55 -04:00
jwinterm	a43e9fe122	fix(ci): publish tag builds to the release, where they can be fetched back Run artifacts upload fine, but this Gitea reports zero artifacts for every run through its REST API, and the web download route answers "Not found." under token, bearer and basic auth alike. A signed build was therefore unreachable from anywhere except the browser session that produced it. Release assets do work: create, upload, list and download all round-trip with an ordinary token, so tag builds now attach their output to the tag's release as well as to the run. Retrieval must use browser_download_url; the asset-id API path returns the asset's JSON metadata even when asked for octet-stream. The step is fail-safe on purpose. With no token, no resolvable release, or a non-201 upload it explains itself and exits 0 rather than turning a green build red. The macOS upload also gains if-no-files-found, without which an empty publish passes silently.	2026-09-13 13:18:22 -04:00
jwinterm	ce84b1d062	fix(ci): scope the embed extracts to the run, not to a shared /tmp ubuntu-latest and windows-latest both resolve to the same host in host mode, and both jobs began with `rm -rf /tmp/wownerod-embed`. Dispatched together for 5.1.4, the Windows fetch deleted the Linux job's binary in the eight seconds between its own `ls` showing the file present and cmake configuring, so the Linux build died on "WOWNEROD_DIR was specified but the wownerod binary could not be found" while the identical workflow had passed minutes earlier when it ran alone. Both jobs now extract under /tmp/wowlet-$GITHUB_RUN_ID, so concurrent runs stop sharing state. macOS is left alone: it runs on its own host, it never rm -rf's the directory, and it is the one platform currently building green.	2026-09-13 13:13:35 -04:00
jwinterm	0e6113729d	chore(release): 5.1.4 Carries the binary rename: the shipped executable, the macOS bundle and the Linux desktop entry are all wowlet now, where 5.1.3 still shipped feather.	2026-09-13 13:03:50 -04:00
such-gitea	27d7b346c0	fix(build): ship the binary as wowlet, not feather	2026-09-13 10:57:32 -04:00
jwinterm	ea9c73826b	fix(build): ship the binary as wowlet, not feather The CMake target keeps its upstream name so the twenty-odd target_* calls stay put, but OUTPUT_NAME now produces build/bin/wowlet, and on macOS a wowlet.app whose CFBundleExecutable matches it. Linux and Windows already renamed the artifact as they copied it, so their cp lines just move to the new path. macOS copied the whole bundle instead, so it shipped Contents/MacOS/feather with a Feather name in the Info.plist, which is what anyone installing it actually saw. The Linux install rules had the same problem one level down: they installed feather.desktop, which sets Exec=feather and Name=Feather Wallet, while the correct wowlet.desktop sat unused beside it. CFBundleIdentifier moves to org.wownero.wowlet. Nothing in signing or notarization reads it, but macOS keys per-app state by bundle id, so an existing install starts with fresh window state.	2026-09-13 10:49:00 -04:00
jwinterm	5a9605c87b	release: wowlet 5.1.3 Carries the macOS QML bundling fix, so the mining tab loads on mac instead of painting grey, and the mining offer restricted to a node that is ours.	2026-09-12 20:57:13 -04:00
jwinterm	db151c2920	fix(ci/macos): bundle the QML modules the app actually imports 5.1.2 shipped a grey mining tab on macOS while Linux was fine. The app said why: 'qrc:/qml/mining.qml:2:1: module "QtQuick.Layouts" is not installed', and Contents/Resources held only appicon.icns and qt.conf, with no qml directory at all. macdeployqt cannot scan .qrc resources, and it was called without -qmldir, so the bundle shipped no QML modules; scene.qml survived only because it imports nothing beyond QtQuick. Pass -qmldir, then blanket-copy the QtQuick and QtQml trees as the AppImage build already does, because qmlimportscanner does not follow a module's own qmldir depends chain. Both happen before the dylib passes so new plugin deps resolve, and before signing, which already sweeps every non-framework Mach-O. A guard fails the build when a module is missing, because an absent QML module is invisible until someone opens the tab.	2026-09-12 20:49:23 -04:00
jwinterm	c7fca31653	fix(mining): only offer to mine on a node that is ours Start Mining was live regardless of which daemon the wallet was talking to. It is a `start_mining` RPC to the connected node, so on a remote one it is either refused — the button appearing to do nothing — or, if the operator left the RPC open, it sets someone else's machine mining to our address. Neither is a thing a wallet should offer. The axe now greys out unless `Nodes::connection().isLocal()`, hovering it explains why, and clicking anyway flashes the same notice rather than silently doing nothing. `onStartMining` refuses too: the QML disables the control, but a signal is not a promise. isLocal() counts localhost, .local, 127/8 and the RFC1918 ranges, so the embedded node and a daemon on the LAN both qualify. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-04 05:36:45 -04:00
jwinterm	081c01ada9	release: wowlet 5.1.2 Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 15:12:27 -04:00
jwinterm	613d4e7f61	Merge scene work for 5.1.2 The ambient scene grows up: the hidden-tab bug that rained +1s out of an empty sky is fixed at both ends, the wipeout is a skid rather than a stunt, clearing a field says WIN, and each tab gets its own amount of scene — History runs, Receive sits, Send is money going past. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 15:12:18 -04:00
jwinterm	79daae6796	fix(send): the scene sits in the middle of the space below the form It was butted straight up against the Clear/Send row, so a band of night sky touched a button and read as part of the form. Now there is a fixed 14px gap under the buttons and a stretch either side of the scene, which centres it in whatever space the form leaves. And the coins come in handfuls. One at a time reads as a metronome, so Send now has three of them: usually one goes past, sometimes two, and about one time in seven all three, staggered by a beat so they arrive together rather than in a rank. Each rolls its own height, size, duration and spin direction. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 15:10:48 -04:00
jwinterm	b1e751a6b7	fix(scene): the sitting doge belongs to Receive only He was filling History's empty beat as well, left over from before Receive had a scene of its own. Two tabs showing the same sitting doge reads as one tab's scene leaking into the other, and History is meant to be the tab where he runs. History's opening beat is now sky, grass, clouds and the sun — the scene breathing before the coins come out — and the sitting doge appears on Receive and nowhere else. The per-lap idle roll goes with him. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 15:04:41 -04:00
jwinterm	068e4c2aa5	fix(scene): money no longer vanishes mid-flight, and the quiet tabs have something to watch Send's bills were being cut off halfway across. Money mode reused the run's lap machinery, so every 9-14 seconds the cycle restarted and reset every bill to the start of its flight — and a roll whose delay plus duration ran past the cycle simply disappeared wherever it had got to. Bills now keep their own clock: cross, re-roll, wait, cross again, with the re-roll deciding afresh whether that bill flies at all. Nothing resets them from outside, so nothing can cut them short, and the sky thins and fills instead of carrying identical traffic for ever. 26 seconds of frames now contain no mid-screen disappearance. Both quiet tabs get an ambient clock, because a form is a long time to look at a dog breathing: * Send: a gold coin arcs across on its own trajectory now and then, bills tumble in proportion to their speed, and at night the odd shooting star. * Receive: a coin drops out of the sky, bounces, and settles in the grass beside the doge with a small sparkle burst — a coin arriving is the entire point of that tab — and he perks up when it lands. Birds fly by in daylight. It lands to one side of him and clear of the sun, which is where the first version put it. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 14:17:54 -04:00
jwinterm	f1144c483e	fix(scene): the wipeout is a skid, the win says so, and each tab gets its own amount of scene The crash launched him. Rotating 66 degrees about a pivot inside the sprite, shearing him through the middle and scaling him about the same point left him diagonal in mid-air, elongated, nowhere near the ground — a stunt, not a trip. It is now a face-plant and a skid: 26 degrees, a 21px drop so the snout reaches the grass, and 26px of forward slide along the ground with the dust coming up. The shear is gone entirely. The pivot is the snout at the grass line rather than a point inside the body. The other half of looking airborne was the frozen frame: stopping a run cycle leaves whatever mid-stride pose the gif was on, legs extended. He now lands on frame 4, the one with the legs tucked under him. Clearing the field and getting across now says WIN, with the tally, the way eating it says GAME OVER. Before, a won lap just ended and the next one opened with a doge sitting down, which reads as nothing having happened. And the scene comes in three amounts, because a form should not have to compete with a dog: History runs the whole thing, Receive is a doge sitting in the field, Send is money blowing past and nothing else. One QML file, gated by mode; the beat machine only runs where there is a run. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-03 13:07:04 -04:00
jwinterm	e5b8ef6a00	fix(scene): park hidden tabs, and put some weight behind the doge The +1s raining out of an empty sky came from a scene running on a tab that had never been shown. An unshown QQuickWidget is 0px wide, and at 0px every coin sits at x=0, so the doge "collected" the whole field in one step; the pickup pops from that phantom lap were still mid-flight when the tab was finally selected and the real width arrived. Their `SequentialAnimation on opacity { running: <bound> }` was cut off by the width change, which leaves the property wherever it stopped — so a +1 hung in the air for the rest of the lap, next to a coin nobody had taken. Both halves are fixed: * SceneWidget parks its scene on hide and starts a fresh lap on show, and the QML refuses to run at all until it has been laid out. A background tab now costs nothing, too. * Every one-shot flourish (+1, bark, dust, GAME OVER) is started and reset from an explicit handler, so an interrupted lap cannot strand one on screen. The rest is the ambient scene earning its keep: * The face-plant has weight. He tips over his front paws — pivoting on the paw at the grass line, not the middle of the sprite, which used to swing his snout through the ground — squashes at the nose, bends through the body, throws dust off the impact, and lies there breathing. GAME OVER now lands a beat later so the crash reads on its own, and the lap ends shortly after instead of running out the clock on a wreck. * He has opinions: HRNMMROOF, BONK, SNOOT.EXE and friends on a wipeout; MUCH COIN, AMAZE, VERY WIN when he clears the field, with a victory hop to go with it. * More variety per lap: zero to three bills at their own speeds and heights, a 1-in-3 fat +5 coin with a halo, a doge sitting in the field during the empty beat, drifting clouds, a soft corona on the sun, blinking stars and the odd shooting star at night, birds by day, and a run speed that is no longer always eight seconds. Verified by rendering scene.qml headless (qml6 + xvfb, frame grabs) at the real widget sizes, and by driving two scenes through a QTabWidget to watch the hidden-tab case before and after. Claude-Session: https://claude.ai/code/session_01VLQ5DsgKv23osGANoFT3zF	2026-09-02 22:34:23 -04:00