mikebrandon/here-telemetry-rnd
1
0
Fork 0
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions
10 releases 10 tags
  • v0.2.0 c251e4ded4

    v0.2.0 — signed Windows installer, and updates that can reach it Stable

    mikebrandon released this 2026-09-18 20:07:59 +00:00 | 0 commits to main since this release

    The first release this project can actually update from.

    Windows installer, signed. Verified against the key compiled into the client:

    verify-release: accepted by the key this build trusts
  trusted comment: timestamp:1789758066	file:here capture_0.2.0_x64-setup.exe

    SHA-256 4044b091d9b3073857279ff4617dbb9b10db6ed4e9d5548adab3410c249a21a4

    Updates now work from a public repository. The client reads either a purpose-built
    {version, artifact, signature} feed or a forge release like this one — so an install can be
    updated without a server to deploy, a certificate to issue or a proxy to configure.

    To point an install at this:

    HERE_UPDATE_FEED=https://everything.hereandmore.com/api/v1/repos/mikebrandon/here-telemetry-rnd/releases/latest

    Nothing installs itself. The client verifies the signature against a key built into its own
    binary, reads the version back out of that signature rather than trusting this page, and waits
    for somebody to press Update.

    Since 0.1.0

    • Display recording ships — pick a window, see what would be captured, decide.
    • The app can be reset to a genuine first run, identity and all.
    • It asks once whether to look for updates, and says what version it is and what is newer.

    Where this came from. This repository is a distribution point, not the source. The tag above is
    where the release was filed; it is not the tree that produced the installer. These bytes were built
    from HERE/Capture at d19f666 ("Release 0.2.0").

    That distinction is the point of the signature. Nothing here has to be trusted — not the tag, not
    the repository, not the feed that pointed at it. The client verifies the artifact against a public
    key compiled into its own binary and reads the version back out of the signature's trusted comment,
    so the most a feed can decide is what to look at.

    Downloads