Pool fixed

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/release.yml

@@ -0,0 +1,136 @@
+name: Release
+
+# Fires when VERSION changes on main. workflow_dispatch is also enabled so
+# the pipeline can be test-run without bumping the version.
+on:
+  push:
+    branches: [main]
+    paths:
+      - VERSION
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+      should_release: ${{ steps.v.outputs.should_release }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - id: v
+        run: |
+          VERSION=$(cat VERSION | tr -d '[:space:]')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "Tag v$VERSION already exists, skipping release."
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  build-linux:
+    needs: check-version
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install AppImage icon dependency
+        run: pip install --break-system-packages pillow
+      - name: Build AppImage
+        run: make linux REPO=${{ github.repository }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-build
+          path: "*-*-x86_64.AppImage"
+
+  build-windows:
+    needs: check-version
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: msys2/setup-msys2@v2
+        with:
+          msystem: UCRT64
+          update: true
+          install: >-
+            base-devel
+            git
+            zip
+      - name: Build (MSYS2 UCRT64)
+        run: make windows REPO=${{ github.repository }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-build
+          path: "*-*-windows.zip"
+
+  release:
+    needs: [check-version, build-linux, build-windows]
+    if: needs.check-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Build short changelog
+        id: notes
+        run: |
+          PREV_TAG=$(git tag --sort=-creatordate | head -n1 || true)
+          if [ -n "$PREV_TAG" ]; then
+            RANGE="$PREV_TAG..HEAD"
+          else
+            RANGE="HEAD"
+          fi
+          {
+            echo "notes<<EOF"
+            echo "Top changes in this release:"
+            git log $RANGE --no-merges --pretty=format:'%H %s' | \
+              while read -r hash subject; do
+                n=$(git show --numstat --pretty=format: "$hash" | awk '{s+=$1+$2} END{print s+0}')
+                echo "$n|- $subject"
+              done | sort -t'|' -k1,1 -rn | head -n 8 | cut -d'|' -f2
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Sign release assets
+        env:
+          UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
+        run: |
+          if [ -z "$UPDATE_SIGNING_KEY" ]; then
+            echo "::error::UPDATE_SIGNING_KEY secret is not set — cannot sign release assets. Auto-update will refuse to install this release."
+            exit 1
+          fi
+          echo "$UPDATE_SIGNING_KEY" > /tmp/update_signing_key.pem
+          for f in artifacts/*-*-x86_64.AppImage artifacts/*-*-windows.zip; do
+            [ -f "$f" ] || continue
+            openssl pkeyutl -sign -rawin -inkey /tmp/update_signing_key.pem -in "$f" -out "$f.sig"
+          done
+          rm -f /tmp/update_signing_key.pem
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ needs.check-version.outputs.version }}
+          name: ${{ github.event.repository.name }} v${{ needs.check-version.outputs.version }}
+          body: ${{ steps.notes.outputs.notes }}
+          files: |
+            artifacts/*-*-x86_64.AppImage
+            artifacts/*-*-windows.zip
+            artifacts/*.sig

.gitignore

@@ -28,3 +28,4 @@ dist/
 # Editor/OS cruft
 .DS_Store
 Thumbs.db
+src/bitflash

Makefile

@@ -0,0 +1,162 @@
+# Bitflash — top-level build
+#
+#   make linux    build Bitflash-*-x86_64.AppImage
+#   make windows  build Bitflash-*-windows.zip (from MSYS2 UCRT64)
+#   make clean    remove build artifacts
+
+ROOT    := $(shell pwd)
+NPROC   := $(shell nproc 2>/dev/null || echo 2)
+SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
+VERSION := $(shell cat VERSION)
+
+ifndef REPO
+$(error REPO is not set. Build with: make linux REPO=owner/repo (or make windows REPO=owner/repo))
+endif
+
+# Release filenames are derived from the repo name (not hardcoded "Bitflash"),
+# so a fork built with REPO=you/your-fork produces distinct filenames from
+# the canonical repo's releases.
+APPNAME := $(word 2,$(subst /, ,$(REPO)))
+
+# ---- Linux ----------------------------------------------------------------
+
+linux: deps-linux
+	$(MAKE) -C src -f Makefile -j$(NPROC) VERSION=$(VERSION) REPO=$(REPO)
+	strip src/bitflash
+	$(MAKE) -f Makefile appimage
+
+deps-linux: deps-apt deps-secp256k1 deps-randomx
+
+deps-apt:
+	@if command -v apt-get >/dev/null 2>&1; then \
+	  $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
+	    libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
+	    libboost-system-dev libglfw3-dev libgl-dev libwebsockets-dev libcurl4-openssl-dev; \
+	else \
+	  echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
+	  echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl libwebsockets"; \
+	fi
+
+deps-secp256k1:
+	@if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
+	  echo "==> building libsecp256k1"; \
+	  rm -rf $(ROOT)/secp256k1-build; \
+	  git clone --depth 1 https://github.com/bitcoin-core/secp256k1 $(ROOT)/secp256k1-build; \
+	  cd $(ROOT)/secp256k1-build && ./autogen.sh && \
+	  ./configure --enable-module-schnorrsig --enable-module-extrakeys \
+	    --disable-shared --with-pic --disable-benchmark --disable-tests && \
+	  make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
+	  echo "==> libsecp256k1 done"; \
+	else \
+	  echo "==> libsecp256k1 already installed"; \
+	fi
+
+deps-randomx:
+	@if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
+	  echo "==> building RandomX"; \
+	  rm -rf $(HOME)/RandomX; \
+	  git clone --depth 1 https://github.com/tevador/RandomX $(HOME)/RandomX; \
+	  mkdir -p $(HOME)/RandomX/build; \
+	  cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+	  make -j$(NPROC) randomx; \
+	  echo "==> RandomX done"; \
+	else \
+	  echo "==> RandomX already built"; \
+	fi
+
+appimage: src/bitflash
+	@echo "==> building AppImage"
+	@if [ ! -x /tmp/appimagetool ]; then \
+	  wget -q "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage" \
+	    -O /tmp/appimagetool && chmod +x /tmp/appimagetool; \
+	fi
+	@rm -rf /tmp/bitflash.AppDir
+	@mkdir -p /tmp/bitflash.AppDir/usr/bin \
+	          /tmp/bitflash.AppDir/usr/lib \
+	          /tmp/bitflash.AppDir/usr/share/applications \
+	          /tmp/bitflash.AppDir/usr/share/icons/hicolor/256x256/apps
+	@cp src/bitflash /tmp/bitflash.AppDir/usr/bin/bitflash
+	@printf '#!/bin/sh\nHERE="$$(dirname "$$(readlink -f "$$0")")"\nexport LD_LIBRARY_PATH="$$HERE/usr/lib:$$LD_LIBRARY_PATH"\nexec "$$HERE/usr/bin/bitflash" "$$@"\n' \
+	  > /tmp/bitflash.AppDir/AppRun && chmod +x /tmp/bitflash.AppDir/AppRun
+	@printf '[Desktop Entry]\nName=Bitflash\nExec=bitflash\nIcon=bitflash\nType=Application\nCategories=Finance;\n' \
+	  > /tmp/bitflash.AppDir/bitflash.desktop
+	@cp /tmp/bitflash.AppDir/bitflash.desktop \
+	    /tmp/bitflash.AppDir/usr/share/applications/
+	@python3 -c "import PIL" 2>/dev/null || pip install --break-system-packages --quiet pillow
+	@python3 -c "\
+from PIL import Image; \
+ico = Image.open('src/rc/bitcoin.ico'); \
+img = ico.convert('RGBA'); \
+img.save('/tmp/bitflash.AppDir/bitflash.png'); \
+import shutil; shutil.copy('/tmp/bitflash.AppDir/bitflash.png', \
+'/tmp/bitflash.AppDir/usr/share/icons/hicolor/256x256/apps/bitflash.png')"
+	@for lib in libsodium.so.23 libdb_cxx-5.3.so libglfw.so.3; do \
+	  path=$$(ldconfig -p | grep " $$lib " | awk '{print $$NF}' | head -1); \
+	  [ -z "$$path" ] && path=$$(find /usr/lib /lib -name "$$lib" 2>/dev/null | head -1); \
+	  [ -n "$$path" ] && cp -L "$$path" /tmp/bitflash.AppDir/usr/lib/ && echo "  bundled $$lib" || echo "  missing $$lib"; \
+	done
+	@ARCH=x86_64 /tmp/appimagetool --no-appstream /tmp/bitflash.AppDir \
+	  $(ROOT)/$(APPNAME)-$(VERSION)-x86_64.AppImage 2>&1 | grep -E "^Built|^Error" || true
+	@echo "Built: $(APPNAME)-$(VERSION)-x86_64.AppImage"
+
+# ---- Windows (MSYS2 UCRT64) -----------------------------------------------
+
+deps-windows:
+	pacman -S --noconfirm --needed \
+	  mingw-w64-ucrt-x86_64-gcc \
+	  mingw-w64-ucrt-x86_64-make \
+	  mingw-w64-ucrt-x86_64-glfw \
+	  mingw-w64-ucrt-x86_64-openssl \
+	  mingw-w64-ucrt-x86_64-db \
+	  mingw-w64-ucrt-x86_64-libsodium \
+	  mingw-w64-ucrt-x86_64-nlohmann-json \
+	  mingw-w64-ucrt-x86_64-boost \
+	  mingw-w64-ucrt-x86_64-libwebsockets \
+	  mingw-w64-ucrt-x86_64-curl \
+	  mingw-w64-ucrt-x86_64-cmake \
+	  autoconf automake libtool
+	@if [ ! -f deps/lib/libsecp256k1.a ]; then \
+	  rm -rf secp256k1-build; \
+	  git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
+	  cd secp256k1-build && ./autogen.sh && \
+	  ./configure --prefix=$(ROOT)/deps \
+	    --enable-module-schnorrsig --enable-module-extrakeys \
+	    --disable-shared --with-pic --disable-benchmark --disable-tests && \
+	  make install; \
+	  echo "==> secp256k1 done"; \
+	else \
+	  echo "==> secp256k1 already built"; \
+	fi
+	@if [ ! -f RandomX/build/librandomx.a ]; then \
+	  rm -rf RandomX; \
+	  git clone --depth 1 https://github.com/tevador/RandomX; \
+	  mkdir -p RandomX/build; \
+	  cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+	  make randomx; \
+	  echo "==> RandomX done"; \
+	else \
+	  echo "==> RandomX already built"; \
+	fi
+
+windows: deps-windows
+	cd src && make -f makefile.mingw VERSION=$(VERSION) REPO=$(REPO)
+	@rm -rf $(APPNAME)-$(VERSION)-windows
+	@mkdir -p $(APPNAME)-$(VERSION)-windows
+	@cp src/bitflash.exe $(APPNAME)-$(VERSION)-windows/$(APPNAME).exe
+	@ldd src/bitflash.exe | grep ucrt64 | awk '{print $$3}' | \
+	  xargs -I{} cp {} $(APPNAME)-$(VERSION)-windows/ 2>/dev/null || true
+	@test -f src/cacert.pem && cp src/cacert.pem $(APPNAME)-$(VERSION)-windows/ \
+	  || echo "WARNING: src/cacert.pem missing, Windows zip will lack a CA bundle (Nostr TLS will fail)"
+	@zip -r $(APPNAME)-$(VERSION)-windows.zip $(APPNAME)-$(VERSION)-windows/
+	@echo "Built: $(APPNAME)-$(VERSION)-windows.zip"
+
+# ---- Clean ----------------------------------------------------------------
+
+clean:
+	$(MAKE) -C src -f Makefile clean 2>/dev/null || true
+	cd src && make -f makefile.mingw clean 2>/dev/null || true
+	rm -f *-*.AppImage *-*-windows.zip
+	rm -rf *-*-windows
+
+.PHONY: linux windows clean appimage \
+        deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx