Fix automatic ScanLink HTTPS setup and prepare 0.7.5b1

.github/workflows/release.yml

@@ -118,6 +118,8 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           name: ${{ github.ref_name }}
+          prerelease: ${{ contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}
+          make_latest: ${{ (contains(github.ref_name, 'b') || contains(github.ref_name, 'rc')) && 'false' || 'true' }}
           body_path: RELEASE_NOTES.md
           files: release-files/*.exe
           fail_on_unmatched_files: true

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 This file owns the release history for `ScanLink`.
 
+## v0.7.5b1
+
+- **Windows x86 Crypto Wheels**: Resolve cryptography from compatible binary wheels during executable builds, avoiding an unsupported latest-source Rust/OpenSSL compilation on 32-bit Python.
+
+- **Windows First-Launch Consent Gate**: Exercise the specific ScanLink certificate Yes prompt in installed-app tests instead of bypassing trust; stress 120 normally verified HTTPS requests per architecture and log certificate setup stages.
+
+- **Beta Publication**: Mark beta/RC tags as GitHub prereleases and keep the stable latest pointer unchanged.
+
+- **Automatic Windows HTTPS Setup**: Provision and trust a localhost-only server certificate for the current Windows user during normal startup; encrypt its key with a DPAPI-protected password, repair missing trust, and renew within 30 days of expiry.
+- **Background Setup And Renewal**: Preserve HTTP scanning while preparing HTTPS, expose `https_setup` in `/health`, swap renewed identities for new TLS handshakes, and offer native Retry plus a tray repair action on setup failures.
+- **Installer HTTPS Verification**: Verify trusted HTTPS without bypassing certificate checks and reuse the identity after restart in both x86/x64 installed-app smoke gates; remove the optional mkcert build dependency.
+
 ## v0.7.4
 
 - **Windows Installed-App Verification**: Added x86/x64 installer smoke tests for installed assets, HKCU startup/protocol registration, packaged runtime identity, live REST endpoints, protocol launch, and graceful shutdown before artifact publication.

README.md

@@ -38,7 +38,7 @@ ScanLink is a robust, lightweight system-tray application that bridges the gap b
 - **ReportLab**: Professional PDF generation engine.
 - **PyStray**: System tray icon and menu integration.
 - **Tkinter**: Native GUI dialogs for scanner selection.
-- **mkcert**: Auto-generates trusted localhost SSL certificates.
+- **cryptography + Windows CryptoAPI/DPAPI**: Generate a localhost identity, trust its server certificate for the current user, and protect its private key.
 - **PyInstaller**: Compilation into standalone Windows executable.
 - **Inno Setup**: Professional Windows installer generation.
 
@@ -48,9 +48,13 @@ ScanLink is a robust, lightweight system-tray application that bridges the gap b
 
 ### Method 1: Windows Installer (Recommended)
 1. Download and run `ScanLinkSetup.exe`.
-2. Follow the installation wizard (installs to `Program Files (x86)\ScanLink`).
+2. Follow the installation wizard (installs to your Windows user profile).
 3. Launch **ScanLink** from your Start Menu or Desktop.
-4. The app will appear in your system tray (near the clock).
+4. The app appears in your system tray and sets up its secure connection automatically. Approve any Windows or browser prompt, then scan from your application. No commands or certificate imports are needed.
+
+If Windows blocks setup, ScanLink offers **Retry**. You can also right-click its
+tray icon and choose **Retry secure connection setup**. If your organization
+manages this computer and setup stays blocked, contact your support team.
 
 ### Method 2: Portable Executable
 1. Unzip the release package.
@@ -90,7 +94,11 @@ ScanLink exposes a local REST API for browser apps:
 - `GET http://127.0.0.1:5000/scan/<job_id>`
 - `GET http://127.0.0.1:5000/scan/<job_id>/result`
 
-HTTPS is also available at `https://127.0.0.1:5443` when trusted localhost certificates exist.
+HTTPS is prepared automatically at `https://127.0.0.1:5443` on Windows. Healthy
+identities are reused and renewed before expiry. `/health.https_setup` reports
+`preparing`, `ready`, or `failed`; HTTP remains available while setup runs.
+The certificate is a localhost-only server identity, not a certificate authority.
+See [architecture](docs/architecture.md#local-transports) for trust and key storage.
 
 Minimal browser flow:
 

VERSION

@@ -1 +1 @@
-0.7.4
+0.7.5b1

build_exe.py

@@ -17,6 +17,7 @@
     ("pystray", "pystray"),
     ("requests", "requests"),
     ("twain", "pytwain"),
+    ("cryptography", "cryptography"),
 )
 
 
@@ -36,11 +37,6 @@ def read_version():
 r"""
 ScanLink build script.
 
-Prerequisite:
-1. Download mkcert.exe from https://github.com/FiloSottile/mkcert/releases
-   and place it in the project root before building if you want optional
-   trusted localhost HTTPS support.
-
 Usage:
     python build_exe.py
     python build_exe.py --arch x64
@@ -76,7 +72,7 @@ def ensure_venv(arch, base_python):
     if os.path.exists(REQUIREMENTS_FILE):
         print(f"Installing requirements into {arch} venv ...")
         subprocess.run(
-            [python_exe, "-m", "pip", "install", "--quiet", "-r", REQUIREMENTS_FILE],
+            [python_exe, "-m", "pip", "install", "--quiet", "--only-binary=cryptography", "-r", REQUIREMENTS_FILE],
             check=True,
         )
         print(f"{arch} requirements installed.")
@@ -197,10 +193,6 @@ def build_pyinstaller_args(build_name):
         pyinstaller_args.append("--icon=app_icon.ico")
         pyinstaller_args.append(add_data_arg("app_icon.ico"))
 
-    if os.path.exists("mkcert.exe"):
-        pyinstaller_args.append(add_data_arg("mkcert.exe"))
-        print("mkcert.exe will be bundled for optional HTTPS certificate generation")
-
     return pyinstaller_args
 
 
@@ -227,13 +219,6 @@ def main():
     requested_arches = resolve_requested_arches(args.arch)
     python_by_arch = {}
 
-    if not os.path.exists("mkcert.exe"):
-        print("WARNING: mkcert.exe not found!")
-        print("Download from: https://github.com/FiloSottile/mkcert/releases")
-        print("Place mkcert-vX.X.X-windows-amd64.exe as 'mkcert.exe' in this folder.")
-        print("Continuing without mkcert (HTTP scanning will still work; trusted HTTPS will be unavailable).")
-        print()
-
     for arch in requested_arches:
         python_executable = resolve_python_for_arch(arch, args)
         if not python_executable: