-
JellyTau v0.10.0
Stable🏗️ Build and Test JellyTau / Run Tests (push) Successful in 15m52s🏗️ Build and Test JellyTau / Supply Chain (push) Failing after 29sPublish Documentation / Build & publish docs to gitea-pages (push) Successful in 5m35sTraceability Validation / Check Requirement Traces (push) Successful in 11sBuild & Release / Run Tests (push) Successful in 14m53s🏗️ Build and Test JellyTau / Android Compile Check (push) Successful in 4m22sBuild & Release / Build Linux (push) Successful in 20m53sBuild & Release / Build Windows (push) Successful in 15m41sBuild & Release / Build Android (push) Successful in 30m46sBuild & Release / Create Release (push) Successful in 38sdtourolle released this
2026-08-22 00:52:36 +00:00 | 13 commits to master since this releaseTwo things you can see, and a great deal of work on how this project builds and
ships itself. The app can now update itself, and it can tell you what it did
when something goes wrong — both of which existed as gaps rather than as bugs,
which is why they lasted so long.✨ Changes
-
JellyTau can update itself. Anyone who installed an AppImage or ran the
Windows installer was frozen on that version permanently: nothing in the app
ever mentioned that a newer one existed, and the release page was the only
announcement. Settings → Updates now checks, shows what changed, and installs
and restarts on request. Each download is verified against JellyTau's signing
key before anything is installed, so a substituted file is refused rather than
run. Android is deliberately not wired to this — an app may not replace its own
APK, that is the system installer's job — and is given a link to the releases
page instead of a button that would fail. (UR-077 → DR-217) -
You can export a diagnostics bundle. Until now the app forgot everything it
had done the moment it closed. Logs went to standard output, which nobody sees
when launching from a desktop icon, and on Android went nowhere at all — so the
backend was invisible on the platform where the hardest playback bugs live. A
crash left nothing behind. Logs are now kept in a size-capped file that
survives a restart, a crash is recorded before the app dies, and Settings →
Diagnostics exports the lot as one file to attach to a bug report. Access
tokens and passwords are stripped before anything is written to disk, not
merely before it is exported. Nothing is transmitted anywhere; you attach the
file yourself. (UR-078 → DR-218) -
Linux gets an AppImage again. The release notes have advertised one for
months while the build never produced it — the packaging step looked for the
file, found nothing, and said nothing. (DR-217)
🐛 Fixes
-
Releases no longer ship every Windows installer ever built. Every release
from v0.1.0 to v0.8.2 carried its predecessors': sixteen installers on v0.8.2,
thirteen of them stale, and a download list on v0.5.0 reaching back to 0.1.0.
The build directory is never cleaned and the build machine reuses it, so each
release collected whatever was left behind. It went unnoticed for eight months
because nothing looked wrong — the files were real and the page merely looked
busy. The stale files have been removed from the published releases, the build
now clears that directory first, and a check refuses to publish a release
containing an artifact from a different version. (DR-220) -
Release notes now say what changed. All 35 previous releases published the
same block of generic install instructions, whose "What's New" section was a
link to a file that does not resolve from a release page. Every release page
now carries its own entry from this changelog, and the past ones have been
filled in. (DR-219)
🔒 Security and supply chain
-
Dependencies are now checked against a vulnerability database on every
build. They never had been. The first run found eight vulnerabilities and one
unsoundness in the Rust dependency graph — all of them fixed by an update
nobody had a reason to run. Licences are checked against an allow-list too, so
nothing gets redistributed inside a release that does not permit it.
(DR-216) -
Every release publishes checksums and a bill of materials.
SHA256SUMS
lets you verify a download (sha256sum -c SHA256SUMS); the SBOM lists what
went into the build, so "does this release contain ?" has
an answer that is not "rebuild it and find out". (DR-216) -
Builds are reproducible again. Every CI job named a container image tag
that was rewritten in place, so rebuilding an old release did not necessarily
rebuild the same thing. Jobs now pin an immutable tag. The one dependency that
comes from a git branch rather than a package registry is pinned to an exact
revision, closing a path by which new upstream code could arrive unreviewed in
a library linked into the player. (DR-216)
🧹 Under the hood
-
Formatting, linting and type-checking now run in CI. All three were configured
and enforced by nothing: 199 files did not match the project's own formatter, a
type error could sit on the main branch until somebody cut a release, and the
test-coverage command had been broken for months by a dependency mismatch.
Coverage now has a floor that only moves up. (DR-215) -
The traceability matrix counts requirements implemented by configuration.
Several carried the necessary annotations and were being counted as uncovered
because the extraction tool only read source files. (DR-215) -
The project now has a security policy, contribution guide, code of conduct,
issue and pull-request templates, and an operations document covering the
builder image, the release secrets, and what losing the signing key would mean. -
The app framework moved from Tauri 2.9.5 to 2.11.5. Nothing about this is
visible in use, but it is worth recording that it did not go quietly: the
windowing layer beneath Tauri quietly stopped publishing the Android JavaVM
and application handle that this app's credential storage had been reading for
its whole life. Nothing here had changed; a side effect several dependencies
down had simply gone away, and the app aborted on launch on every Android
device. JellyTau now sets that handle itself rather than relying on someone
else to do it. Caught by installing on a real tablet before release — no test
suite runs the app. (UR-012 → DR-223)
Downloads
Platform File Linux (portable) *.AppImage—chmod +xand runLinux (Debian/Ubuntu) *.deb—sudo dpkg -iLinux (Fedora/openSUSE) *.rpm—sudo rpm -iWindows *-setup.exe(NSIS). Unsigned — SmartScreen may warn on first run.Android *.apksideload, or*.aabfor Play ConsoleDesktop builds check for updates from here and can install a new
version in place, verifying its signature first.Verifying your download
sha256sum -c SHA256SUMSSHA256SUMScovers every file in this release. An SBOM
(*.cdx.json,frontend-dependencies.txt) lists what went into it.Requirements
- Linux: 64-bit, GLIBC 2.29+
- Windows: 64-bit Windows 10 or later
- Android: 8.0 or later, ~50 MB free
Report a problem: https://gitea.tourolle.paris/dtourolle/jellytau/issues
Downloads
-