bherbruckandClaude Opus 5.5
d4a7b3abf3
Where SolidCraft can replace itself safely, the Update window gets Update now: - AppImage: the new AppImage is downloaded next to the old one, verified and renamed over it; Restart now starts it as SolidCraft exits. - Windows MSI: the verified .msi starts (msiexec /i … /passive) once SolidCraft has closed, after the usual questions about unsaved designs. - Windows portable zip / standalone exe: the running solidcraft.exe is renamed to .old, the new one takes its name (solidcraft-cli.exe too), Restart now; .old goes at the next start. - macOS: the verified .dmg is opened (the app is ad-hoc signed and not notarized, so it isn't replaced behind the user's back). - Flatpak, Snap, deb, rpm, tar.gz: never replaced; the window shows the command. Every package's SHA-256 must match the release's SHA256SUMS.txt (HTTPS, same release); a mismatch deletes the download and changes nothing. With PUBLIC_KEY set in update/install.rs, SHA256SUMS.txt.minisig must also verify (minisign-verify, MIT) with a trusted comment naming the release. release.yml signs the list when the UPDATE_SIGNING_KEY secret exists and fails when the app expects signatures but the secret is missing; docs/releasing.md has the steps. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.0 KiB
TOML
35 lines
1.0 KiB
TOML
[package]
|
|
name = "solidcraft-ui-egui"
|
|
description = "SolidCraft user interface (egui + wgpu): the swappable front end"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
solidcraft-engine = { workspace = true }
|
|
egui = { workspace = true }
|
|
egui-wgpu = { workspace = true }
|
|
solidcraft-gpu = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
log = { workspace = true }
|
|
web-time = { workspace = true }
|
|
image = { workspace = true, features = ["jpeg"] }
|
|
ttf-parser = { workspace = true }
|
|
semver = { workspace = true }
|
|
# Updates: the downloaded package's SHA-256 (against the release's SHA256SUMS.txt), its optional
|
|
# minisign signature (MIT), and the portable .zip's executables.
|
|
sha2 = { workspace = true }
|
|
minisign-verify = "0.3"
|
|
zip = { workspace = true }
|
|
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
|
|
# The offscreen viewport render test opens a device without a window.
|
|
pollster = { workspace = true }
|
|
|
|
[build-dependencies]
|
|
serde_json = { workspace = true }
|