37 Releases 47 Tags

RSS Feed

• v0.8.0 2c52077b1d

  Compare

  JellyTau v0.8.0 Stable

  dtourolle released this 2026-08-16 22:00:10 +00:00 | 80 commits to master since this release

  A security and correctness release, from an audit of the codebase against its own
  requirements and against current Android/Tauri practice. Most of it is invisible
  in use; three things change behaviour you can see, listed first.

  ✨ Changes

  • The app no longer backs its data up to your Google account. It never
    should have: allowBackup was on by default, which sent the library catalogue
    and watch history off the device — and the credentials went with it in a form
    that could never be read again, because they are encrypted under an Android
    Keystore key and Keystore keys are never backed up. Restoring onto a new phone
    therefore produced ciphertext with no key: an authentication failure with no
    explanation. Backup is now off, for device-to-device transfer as well as cloud
    (a separate channel with the identical failure), and an unreadable credential
    blob is now treated as "logged out" rather than an error, so the next sign-in
    repairs it. (UR-012 → DR-135)

  • The app no longer offers itself as an Android TV app. (This is about the
    app icon on a TV device's home screen — your TV shows library is untouched.)
    It advertised a leanback launcher entry without any of what makes a TV app work — no D-pad focus model,
    no banner, and a missing touchscreen declaration that fails Play's TV
    validation. Launching it on a TV would have landed you in a UI you could not
    navigate. It can be re-declared when TV support is actually built.

  • Lockscreen skip scrubs a film instead of leaving it. While a video's audio
    plays in the background, the skip buttons jump 30 seconds forward and 10
    seconds back, rather than advancing to the next episode. There is no "next
    track" inside a film, and pressing skip to re-hear a line should not eject you
    from what you are watching. Music is unchanged: skip still moves through the
    queue. (UR-040, UR-006 → DR-201)

  🔒 Security

  • The webview now runs under a Content-Security-Policy. It had none, so any
    script reaching the web layer inherited the full IPC surface. script-src is
    now 'self' with no inline or eval, and plugins and frames are refused
    outright. (UR-071 → DR-198)

  • The webview stops undoing the network security config. It set a blanket
    cleartext opt-in by hand, along with file and content access it never used —
    defeating the config that exists to block exactly that, and whose own comment
    warned against it. (UR-071 → DR-199)

  • The asset protocol no longer reaches the database or the credential store.
    Its scope was the whole app data directory; it is now the one subdirectory it
    serves. (UR-012, UR-071 → DR-198)

  🐛 Fixes

  • A credential store that could not be read is now recoverable. The decrypt
    failure surfaced as a hard error rather than a logged-out state, so the app got
    stuck instead of offering the login screen. (UR-012 → DR-135)

  🔧 Internal

  • CI now enforces the checks the contributor rules already required —
    cargo fmt --check and clippy — neither of which had ever run there. The
    traceability gate was also raised from 50% to 82%, a floor low enough that half
    the matrix could rot before it fired, and a new check fails the build on a
    requirement ID that no longer exists.
  • Twelve requirements marked "Done" carried no implementation trace at all;
    they are now tagged, and stale integration requirements that named a backend
    never built have been re-scoped to the ones that actually deliver them.
    Coverage moved 86% → 90%.
  • The Rust lint backlog is cleared (51 warnings → 0), and a flaky test that
    intermittently reddened CI is fixed — it was paying a cold module-transform
    cost inside a test body, not waiting on a timer.

  Downloads

  Platform	File
  Android	jellytau-release.apk — sideload or adb install
  Windows (portable)	jellytau.exe
  Linux (Debian/Ubuntu)	jellytau_0.8.0_amd64.deb — sudo dpkg -i
  Windows	jellytau_0.8.0_x64-setup.exe (NSIS installer)

  ---

  Report a problem: https://gitea.tourolle.paris/dtourolle/jellytau/issues

  Downloads

  • jellytau-release.apk
    37 MiB

    2026-08-17 02:31:07 +00:00
  • jellytau.exe
    29 MiB

    2026-08-17 02:31:08 +00:00
  • jellytau_0.8.0_amd64.deb
    11 MiB

    2026-08-17 02:31:07 +00:00
  • jellytau_0.8.0_x64-setup.exe
    6.6 MiB

    2026-08-17 02:31:10 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)