From b8d987b14589d2cec11046eb43d6eb77782161a2 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Fri, 31 Jul 2026 20:59:52 +0200 Subject: [PATCH] docs(release): the v0.22.3 notes stop claiming one-click updating it never shipped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v0.22.3 tag is `1c836afc`, cut 14:36. The one-click apply work landed on main between 15:01 and 16:28, and this file was then edited at 17:23 (5790a3e3) to announce it — three "New"/"Under the hood" claims about a build that does not contain them. The live release body is still the pre-edit text, so nothing wrong has been published yet; but `announce.yml` re-asserts this file over the release on every announce, and 0.22.3 has not been announced. Announcing it would have published the false version and put its lead-in ("can install it for you where the platform allows") into the Discord embed. Verified against the tag rather than the commit graph: `update.available` is in `1c836afc`, `update.applied` is not, and `mgmt/tests.rs` there literally probes `/api/v1/update/apply-does-not-exist-yet` while `auth.rs` carries the comment "today it is only a check". The Updates card itself (b275e6d3, cc015626) IS in the tag, so that bullet stays; only the apply half goes. The removed material is not lost — it is in docs/releases/v0.23.0.md, which is the release that actually ships it. --- docs/releases/v0.22.3.md | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/docs/releases/v0.22.3.md b/docs/releases/v0.22.3.md index 245c0782..6dccceb9 100644 --- a/docs/releases/v0.22.3.md +++ b/docs/releases/v0.22.3.md @@ -1,14 +1,10 @@ -Wire-compatible with 0.21.x and 0.22.x — nothing about streaming changed, and everything already paired keeps working. This release repairs the Windows installer and gives every host something new: the web console now tells you when a newer Punktfunk is out, and can install it for you where the platform allows. The apps on your phone, tablet, Mac and TV are unchanged. +Wire-compatible with 0.21.x and 0.22.x — nothing about streaming changed, and everything already paired keeps working. This release repairs the Windows installer and gives every host something new: the web console now tells you when a newer Punktfunk is out. The apps on your phone, tablet, Mac and TV are unchanged. **If you stream to a Windows PC, update that PC.** The 0.22.1 and 0.22.2 installers were built without the web console in them at all — not broken, absent. If the tray menu on your PC says "Open web console (not responding)" and the page never loads no matter what you try, that is this, and reinstalling those versions could never have fixed it. ## New -- **The console tells you when a newer host is out.** The Host page has an **Updates** card: the version you're running, the channel you follow (stable or canary), and — once something newer exists — release notes and the exact way to update *your* kind of install. The check is a small signed file the host verifies against keys built into it, so nothing between you and the project can feed it a fake update, and a feed that ever tried to roll you backwards is refused outright. It contacts only the Punktfunk forge, and `PUNKTFUNK_UPDATE_CHECK=0` turns it off entirely. Scripts can react too: the host emits `update.available` and, after a successful update, `update.applied` on its event stream. - -- **On Windows, updating the host is now one click.** The card grows an **Update now** button: it asks for your console password again (a remembered login alone can't restart your PC's host), then downloads the installer, checks it against the signed release manifest *and* its code signature, and runs it silently — the service restarts and the page reconnects by itself. If someone is streaming you're warned first, because updating drops the stream. Every attempt leaves its outcome in the card even across the restart, with the installer's log path when something went wrong — and if a freshly installed version ever crash-loops, the host puts the previous installer back on its own and says so. `PUNKTFUNK_UPDATE_APPLY=0` in `host.env` removes the button on hosts that should never have it. - -- **Linux hosts can opt in to the same button.** apt, Fedora, Bazzite (sysext and rpm-ostree) installs get one-click updating through a deliberately tiny root helper the packages now ship. It's off until you decide otherwise — enabling it is one command, `sudo usermod -aG punktfunk-update $USER`, and that group membership is the entire grant: the button can only ever run your package manager's normal update for the Punktfunk packages, from the same signed repositories you already use, and it never picks versions or URLs. rpm-ostree updates are staged and the card asks you to reboot (it never reboots for you). On Arch the button additionally requires opting into a full `pacman -Syu` in `/etc/punktfunk/update.conf`, because a partial upgrade is how Arch boxes break — we won't run one. Steam Deck on-device installs get the button with no opt-in at all: it runs the same rebuild `update.sh` always did, just from the couch. The full story is on the new [Updating the Host](https://punktfunk.unom.io/docs/updating) docs page. +- **The console tells you when a newer host is out.** The Host page has an **Updates** card: the version you're running, the channel you follow (stable or canary), and — once something newer exists — release notes and the exact way to update *your* kind of install. The check is a small signed file the host verifies against keys built into it, so nothing between you and the project can feed it a fake update, and a feed that ever tried to roll you backwards is refused outright. It contacts only the Punktfunk forge, and `PUNKTFUNK_UPDATE_CHECK=0` turns it off entirely. Scripts can react too: the host emits `update.available` on its event stream. Actually *applying* an update from the card arrives in the next release. ## Fixed @@ -33,6 +29,5 @@ Wire-compatible with 0.21.x and 0.22.x — nothing about streaming changed, and - `PUNKTFUNK_ABR_PROBE_KBPS` sets the startup capacity probe's burst target for embedders. Unset, zero or unparseable keeps the 2 Gbps default, so existing sessions are unchanged; `PUNKTFUNK_ABR_PROBE=0` remains a poor substitute because it pins the climb ceiling at the negotiated ~20 Mbps. - The console's log export serializes the filters' full result rather than the rendered tail — the 1000-row cap is a DOM budget and has no business truncating a file destined for a bug report — and stamps each line with a local ISO 8601 timestamp plus numeric offset. Web Share level 2 is probed at runtime after mount (SSR has no `navigator`, and guessing there would mismatch on hydration), falling back to the clipboard, and the button is omitted only where neither exists. - The update check's truth is a per-channel Ed25519-signed manifest (`…/generic/punktfunk-update/{stable,canary}/manifest.json` + `.sig`), verified against keys pinned in the host binary via the plugin-index machinery, with a persisted monotonic serial as the anti-rollback floor and the channel name bound into the signed document. Stable manifests publish from `announce.yml` — the existing manual fleet-green gate doubles as the gate for the fleet learning about a release; canary rides `windows-host.yml`. TLS and the registry are transport, never trust. -- `/api/v1/update/*` is admin-lane only: whole-prefix denied to the plugin token and absent from the paired-cert allowlist. Apply requests carry no version, URL, or channel — the privileged side derives everything from its own verified state — and the console's BFF re-verifies the console password per apply (sharing the login throttle) while every mutating route now requires a same-origin `Sec-Fetch-Site`. Outcomes survive the host's own restart via an intent record reconciled at boot. -- The Linux packages grow four pieces: the dep-free root helper `/usr/libexec/punktfunk/pf-update`, the fixed-ExecStart oneshot `punktfunk-update.service`, a polkit rule granting exactly that unit's `start` verb to the `punktfunk-update` group, and the group itself — created empty by every postinst, populated by no one. +- `/api/v1/update/*` is admin-lane only: whole-prefix denied to the plugin token and absent from the paired-cert allowlist. This release exposes the check surface only — there is no apply route in it. - No wire, ABI or driver-protocol changes: wire protocol 2, C ABI 13, Windows virtual-gamepad channel 3, virtual-display driver protocol 6 — identical to 0.22.0, 0.22.1 and 0.22.2.