From 19f679cfbc77cb6631c9f3d9aeae2a8679d096c2 Mon Sep 17 00:00:00 2001
From: Antics Decoded <237784870+AnticsDecoded@users.noreply.github.com>
Date: Mon, 26 Oct 2026 18:52:07 +0100
Subject: [PATCH] Make installed app smoke portable on Windows
---
CHANGELOG.md | 7 ++++++
README.md | 2 +-
desktop/README.md | 2 +-
desktop/installed-smoke.mjs | 9 ++++++--
desktop/package-lock.json | 4 ++--
desktop/package.json | 2 +-
desktop/src-tauri/Cargo.lock | 8 +++----
desktop/src-tauri/Cargo.toml | 2 +-
desktop/src-tauri/tauri.conf.json | 2 +-
docs/07-timeline.md | 2 +-
docs/15-release-signing.md | 2 +-
mobile/app.json | 2 +-
mobile/package-lock.json | 4 ++--
mobile/package.json | 2 +-
mobile/src/app/scope.tsx | 2 +-
platform/signer-image/EXPECTED-HASHES.txt | 2 +-
signing-core/Cargo.lock | 26 +++++++++++------------
signing-core/Cargo.toml | 2 +-
signing-core/EXPECTED-HASHES.txt | 4 ++--
signing-core/bench/Cargo.lock | 4 ++--
signing-core/fuzz/Cargo.lock | 8 +++----
21 files changed, 55 insertions(+), 43 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b962522..6093155 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@ Security fixes say what an affected version does wrong, not just that something
was fixed. A release note that says "various improvements" is a release note
that keeps people on a broken version.
+## v0.1.7 — 2026-10-26
+
+- Carries forward the unpublished v0.1.6 candidate after its Windows installer
+ smoke test reached a WebView storage API that the document origin denies.
+- Keeps Linux package-history isolation while allowing Windows to use the fresh
+ per-test WebView profile the harness already creates.
+
## v0.1.6 — 2026-10-26
- Carries forward the v0.1.5 evaluation candidate, which was not published
diff --git a/README.md b/README.md
index 7c13042..2cf9e7f 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ choosing a version.
The desktop reviewer does not need keys and does not sign transactions. It is a second opinion, not a trusted display: a compromised computer can alter what you see. Compare the recomputed hash with the signing device and follow your existing approval procedure. A successful decode is not a safety assessment of the destination contract.
-The dedicated signer and seL4 platform are experimental and have been tested in emulation, not on production hardware. The v0.1.6 release is configured as an unsigned evaluation prerelease. A tag fails unless the repository explicitly selects either a signed stable release or an unsigned evaluation prerelease; signed mode requires macOS and Windows signing checks to pass. The [release-signing record](docs/15-release-signing.md) names the modes, credentials and platform guarantees. The [verification record](docs/03-verification-status.md) distinguishes the reported human review from later AI-assisted checks and records the outstanding review and hardware work.
+The dedicated signer and seL4 platform are experimental and have been tested in emulation, not on production hardware. The v0.1.7 release is configured as an unsigned evaluation prerelease. A tag fails unless the repository explicitly selects either a signed stable release or an unsigned evaluation prerelease; signed mode requires macOS and Windows signing checks to pass. The [release-signing record](docs/15-release-signing.md) names the modes, credentials and platform guarantees. The [verification record](docs/03-verification-status.md) distinguishes the reported human review from later AI-assisted checks and records the outstanding review and hardware work.
The repository also contains an iOS and Android client backed by the same Rust review API. It is source for an evaluation build, not a published App Store or Play Store release; clean native CI and device testing remain release gates.
diff --git a/desktop/README.md b/desktop/README.md
index 6f10f62..cacc14a 100644
--- a/desktop/README.md
+++ b/desktop/README.md
@@ -37,7 +37,7 @@ signs.
## Signing and notarisation
-The v0.1.6 application is not publisher-signed or notarized, so macOS and
+The v0.1.7 application is not publisher-signed or notarized, so macOS and
Windows warn that it comes from an unidentified developer. The macOS linker may
add an identity-free ad-hoc signature; that is not a Developer ID signature.
Until a signed release replaces it, the honest check is the hash of what you
diff --git a/desktop/installed-smoke.mjs b/desktop/installed-smoke.mjs
index 6264743..8b3beb2 100644
--- a/desktop/installed-smoke.mjs
+++ b/desktop/installed-smoke.mjs
@@ -94,8 +94,13 @@ try {
});
session = opened.sessionId;
assert.ok(session, 'native session was created');
- // The Debian and AppImage checks share a runner account but must not share app history.
- await evaluate('localStorage.clear(); sessionStorage.clear(); location.reload();');
+ // Linux packages share a runner account. Windows already gets a fresh WebView
+ // profile and denies storage access for this document origin.
+ await evaluate(`
+ try { localStorage.clear(); } catch {}
+ try { sessionStorage.clear(); } catch {}
+ location.reload();
+ `);
await until(() => evaluate('return document.getElementById("version-line")?.innerText.includes(arguments[0])', [version]), 'Rust build version');
await click('load-example');
await until(async () => (await output()).includes('DO NOT SIGN'), 'critical historical review');
diff --git a/desktop/package-lock.json b/desktop/package-lock.json
index c5c6c93..c2cc8ff 100644
--- a/desktop/package-lock.json
+++ b/desktop/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "clearsign-desktop",
- "version": "0.1.6",
+ "version": "0.1.7",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "clearsign-desktop",
- "version": "0.1.6",
+ "version": "0.1.7",
"devDependencies": {
"@tauri-apps/cli": "^2"
}
diff --git a/desktop/package.json b/desktop/package.json
index 642d2c6..9755e12 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -1,7 +1,7 @@
{
"name": "clearsign-desktop",
"private": true,
- "version": "0.1.6",
+ "version": "0.1.7",
"description": "ClearSign — see what a transaction really does before you approve it.",
"scripts": {
"dev": "tauri dev",
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index a7738ef..f3c319a 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -344,7 +344,7 @@ dependencies = [
[[package]]
name = "clearsign"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"crypto-bigint",
"k256",
@@ -353,7 +353,7 @@ dependencies = [
[[package]]
name = "clearsign-api"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"clearsign-safe-json",
@@ -363,7 +363,7 @@ dependencies = [
[[package]]
name = "clearsign-desktop"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign-api",
"serde",
@@ -374,7 +374,7 @@ dependencies = [
[[package]]
name = "clearsign-safe-json"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"serde",
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index 33a66b0..3130b61 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -1,7 +1,7 @@
[package]
name = "clearsign-desktop"
description = "ClearSign — see what a transaction really does before you approve it."
-version = "0.1.6"
+version = "0.1.7"
edition = "2024"
rust-version = "1.87"
license = "MIT OR Apache-2.0"
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index 5554b50..d481a62 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
{
"$schema": "https://schema.tauri.app/config/2",
"productName": "ClearSign",
- "version": "0.1.6",
+ "version": "0.1.7",
"identifier": "com.anticsdecoded.clearsign",
"build": {
"frontendDist": "../src"
diff --git a/docs/07-timeline.md b/docs/07-timeline.md
index f5ed9fa..a6e96dc 100644
--- a/docs/07-timeline.md
+++ b/docs/07-timeline.md
@@ -16,7 +16,7 @@ from what comparable projects actually took, not from optimism.
|---|---|
| The reviewer | Works. 314 tests, nine fuzz targets, reproducible builds, one external audit with all ten findings fixed |
| The command-line tool | Works. Reads Safe's own JSON, catches the Bybit transaction, and agreed with Safe's service and alloy on 10,851 of 10,851 sampled Safe transaction hashes across 27 chains |
-| The desktop application | Builds, installs and runs on macOS, Windows and Linux in CI. v0.1.6 is configured as an unsigned evaluation prerelease; stable signing credentials are not provisioned |
+| The desktop application | Builds, installs and runs on macOS, Windows and Linux in CI. v0.1.7 is configured as an unsigned evaluation prerelease; stable signing credentials are not provisioned |
| The compartment prototype | Runs on seL4 in an emulator: untrusted Linux, no shell, signer owns the console |
| Users | **None.** This is the number that matters |
diff --git a/docs/15-release-signing.md b/docs/15-release-signing.md
index 10ec6f5..0e3fd0a 100644
--- a/docs/15-release-signing.md
+++ b/docs/15-release-signing.md
@@ -4,7 +4,7 @@ This document describes the repository's release controls. It does not claim
that already-published downloads were retroactively signed. ClearSign v0.1.2 is
unsigned. The protected v0.1.3 tag produced no release because its macOS
evaluation gate rejected an identity-free ad-hoc linker signature. v0.1.4 was
-published as an unsigned evaluation release, and v0.1.6 is configured the same
+published as an unsigned evaluation release, and v0.1.7 is configured the same
way. Every future release tag requires an explicit mode; an unset or unknown
mode fails before packaging begins.
diff --git a/mobile/app.json b/mobile/app.json
index de3315f..c1a2df0 100644
--- a/mobile/app.json
+++ b/mobile/app.json
@@ -2,7 +2,7 @@
"expo": {
"name": "ClearSign",
"slug": "clearsign",
- "version": "0.1.6",
+ "version": "0.1.7",
"scheme": "clearsign",
"icon": "./assets/icon.png",
"userInterfaceStyle": "automatic",
diff --git a/mobile/package-lock.json b/mobile/package-lock.json
index ff76d44..433571c 100644
--- a/mobile/package-lock.json
+++ b/mobile/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "clearsign-mobile",
- "version": "0.1.6",
+ "version": "0.1.7",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "clearsign-mobile",
- "version": "0.1.6",
+ "version": "0.1.7",
"dependencies": {
"@expo/vector-icons": "^15.0.2",
"expo": "~58.0.19",
diff --git a/mobile/package.json b/mobile/package.json
index 259ec63..74b3b4b 100644
--- a/mobile/package.json
+++ b/mobile/package.json
@@ -1,6 +1,6 @@
{
"name": "clearsign-mobile",
- "version": "0.1.6",
+ "version": "0.1.7",
"main": "expo-router/entry",
"dependencies": {
"@expo/vector-icons": "^15.0.2",
diff --git a/mobile/src/app/scope.tsx b/mobile/src/app/scope.tsx
index 3c2e34c..bfa3794 100644
--- a/mobile/src/app/scope.tsx
+++ b/mobile/src/app/scope.tsx
@@ -49,7 +49,7 @@ export default function ScopeScreen() {
))}
- Mobile evaluation build 0.1.6 · Review API v1
+ Mobile evaluation build 0.1.7 · Review API v1
diff --git a/platform/signer-image/EXPECTED-HASHES.txt b/platform/signer-image/EXPECTED-HASHES.txt
index 2294a2e..572d79d 100644
--- a/platform/signer-image/EXPECTED-HASHES.txt
+++ b/platform/signer-image/EXPECTED-HASHES.txt
@@ -7,4 +7,4 @@
# binary recorded in signing-core/EXPECTED-HASHES.txt, and the build refuses to
# package any other.
2aa6a4b8a0bedd695c4d331f7c824c96433290598869ec9a91720dd065c11a13 Image
-2318f9e70a113b06c03e0c6b96578b6e4d8208ffc00ead718acee4e0142212d0 initramfs.cpio.gz
+b24bfacf57ec6202d7b91ac80102a18fa35b15fa108e88b89a7b15221fa1c474 initramfs.cpio.gz
diff --git a/signing-core/Cargo.lock b/signing-core/Cargo.lock
index 2553c1a..55c3a4f 100644
--- a/signing-core/Cargo.lock
+++ b/signing-core/Cargo.lock
@@ -572,14 +572,14 @@ checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
[[package]]
name = "authority"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
]
[[package]]
name = "authority-agent"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"authority",
"clearsign",
@@ -876,7 +876,7 @@ dependencies = [
[[package]]
name = "clearsign"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"crypto-bigint 0.7.7",
"k256 0.14.0",
@@ -885,7 +885,7 @@ dependencies = [
[[package]]
name = "clearsign-api"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"clearsign-safe-json",
@@ -895,7 +895,7 @@ dependencies = [
[[package]]
name = "clearsign-cli"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"clearsign-keys",
@@ -908,7 +908,7 @@ dependencies = [
[[package]]
name = "clearsign-device"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"clearsign-keys",
@@ -919,7 +919,7 @@ dependencies = [
[[package]]
name = "clearsign-difftest"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"alloy-consensus",
"alloy-dyn-abi",
@@ -935,7 +935,7 @@ dependencies = [
[[package]]
name = "clearsign-ffi"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"authority",
"clearsign",
@@ -943,7 +943,7 @@ dependencies = [
[[package]]
name = "clearsign-keys"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"bip32",
"bip39",
@@ -956,7 +956,7 @@ dependencies = [
[[package]]
name = "clearsign-native"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign-api",
"jni",
@@ -965,7 +965,7 @@ dependencies = [
[[package]]
name = "clearsign-qr"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"sha2 0.10.9",
@@ -973,7 +973,7 @@ dependencies = [
[[package]]
name = "clearsign-safe-json"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"serde",
@@ -982,7 +982,7 @@ dependencies = [
[[package]]
name = "clearsign-wasm"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign-api",
"serde_json",
diff --git a/signing-core/Cargo.toml b/signing-core/Cargo.toml
index 4a0309e..52a9705 100644
--- a/signing-core/Cargo.toml
+++ b/signing-core/Cargo.toml
@@ -17,7 +17,7 @@ members = [
]
[workspace.package]
-version = "0.1.6"
+version = "0.1.7"
edition = "2024"
rust-version = "1.87"
license = "MIT OR Apache-2.0"
diff --git a/signing-core/EXPECTED-HASHES.txt b/signing-core/EXPECTED-HASHES.txt
index da59106..4c4ed5b 100644
--- a/signing-core/EXPECTED-HASHES.txt
+++ b/signing-core/EXPECTED-HASHES.txt
@@ -7,5 +7,5 @@
# reproducible in practice rather than sealed.
# Anything built elsewhere, including on the maintainer's own machine, may
# differ: rustc does not promise identical output across compiler hosts.
-8e0f7727b90f45ddf82fbcf5c04f80706a18e7c4949966123a7404525bcd5bdb clearsign
-9f00f56f9e67fa27733c71493b9525fcfa33ffe438608cc4a024bf9c2a08d124 clearsign-device
+65831267d31f804853d267c3640b686abd54e1cbeac1199a3bc97cf2f54215ce clearsign
+c49256d64f8e116297e973cf944bf3bb0f56ab1c14fdff574fe258c6bf06adb5 clearsign-device
diff --git a/signing-core/bench/Cargo.lock b/signing-core/bench/Cargo.lock
index c924844..cd6bf2d 100644
--- a/signing-core/bench/Cargo.lock
+++ b/signing-core/bench/Cargo.lock
@@ -865,7 +865,7 @@ dependencies = [
[[package]]
name = "clearsign"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"crypto-bigint 0.7.8",
"k256 0.14.0",
@@ -890,7 +890,7 @@ dependencies = [
[[package]]
name = "clearsign-safe-json"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"serde",
diff --git a/signing-core/fuzz/Cargo.lock b/signing-core/fuzz/Cargo.lock
index c4dc4fd..56f8178 100644
--- a/signing-core/fuzz/Cargo.lock
+++ b/signing-core/fuzz/Cargo.lock
@@ -10,7 +10,7 @@ checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
[[package]]
name = "authority"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
]
@@ -65,7 +65,7 @@ checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
[[package]]
name = "clearsign"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"crypto-bigint",
"k256",
@@ -85,7 +85,7 @@ dependencies = [
[[package]]
name = "clearsign-qr"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"sha2 0.10.9",
@@ -93,7 +93,7 @@ dependencies = [
[[package]]
name = "clearsign-safe-json"
-version = "0.1.6"
+version = "0.1.7"
dependencies = [
"clearsign",
"serde",