[kitlangton]

▶ Pitch (phone, 39 s):

pr-57218-phone.mp4

Desktop: https://github.com/user-attachments/assets/a34c8c5d-7dcb-4688-9310-ec036cd3a5d5

Head: d569ad1fb95c34a38fa8c3ea27fd56220608057c · Ask: Ship it

Confidence	Size	Affects	API change	Undo	Reviewed by
Medium · CI has only the known beta e2e fails; footage from Storybook	+246/−67 · 9 files	desktop	No: uses existing start times	One revert	Opus 5.5 → no independent review yet

Not verified: a live session in the desktop app. The footage and stills come from the Storybook story, which renders the production capsule and composer with fictional data.

Why

Hex has only ever been released for macOS. Linux and Windows have signed self-updaters and installers, but their feeds were never published, because each release needed an Arch machine and two Windows machines. Luke suggested building them in CI with a matrix, and Kit agreed.

What

• .github/workflows/release-desktop.yml builds one exact commit, given as workflow_dispatch ref or an app-v* tag that must match the crate version:
  • Linux x86_64 in an archlinux:base-devel container
  • Windows x64 on windows-latest, with Vulkan
  • Windows ARM64 on windows-11-arm, with clang-cl and Ninja
• A separate job that compiles nothing signs the three feeds. The build jobs and dependency build scripts never see the key, which is the only secret in the release environment. The environment is limited to main and app-v* tags.
• The workflow validates each signature against the public key embedded in Hex, plus the artifact name, size, SHA-256, and ELF/PE header. It checks that the version is newer than the live feed, and that neither Windows executable imports Visual C++ runtime DLLs.
• The workflow uploads the result as the signed-release artifact.
• Publishing stays on the release Mac, like macOS, using its personal-account Wrangler login: scripts/publish-desktop-release.sh <run-id>.
  • It accepts only successful runs from main or a tag, and re-verifies everything.
  • Artifacts go up first and are never replaced with different bytes. Installers follow, taken from the release commit. Feeds go last, after a fresh version-order check.
  • Every object is re-downloaded from downloads.hex.kitlangton.dev and compared. A rerun after an interruption is safe, because identical feeds are accepted.
• scripts/release-feed.sh is a new, platform-neutral sign/verify/publish script shared by both platforms. release-linux.sh and release-windows.sh gain a build mode and the HEX_RELEASE_SOURCE/HEX_RELEASE_DIST overrides; local prepare and publish still work.
• Fixes found by the dry runs, which would also have hit local Windows releases:
  • cargo ran outside the source root, so .cargo/config.toml was ignored and the executables imported VCRUNTIME140/MSVCP140
  • sha256sum escaped Windows paths
  • Git Bash rewrote CL=/EHsc into a path
  • PowerShell was given a POSIX path to the installer
• Linux now builds with -DGGML_NATIVE=OFF like Windows, so a runner with AVX-512 can't produce a binary that crashes on older CPUs.

Linux glibc floor

The supported host is rolling x86_64 Arch, so the release links current Arch libraries and sonames. The floor is GLIBC_2.44 today and is reported in each run's summary. Older distributions are not a target. Supporting them would need an older build image and a soname audit.

macOS stays local

Moving macOS here would need:

• the Developer ID certificate as a p12 (team QC99C9JE59) imported into a temporary keychain
• an App Store Connect API key for notarytool
• the Sparkle EdDSA key
• a macOS 26 runner with Xcode 26
• a token that can upload the GitHub DMG mirror

Verification

• Dry run of 2.3.0 (cfb4eb4) through a temporary branch trigger, since removed: all builds, signing, and validation passed in https://github.com/anomalyco/hex/actions/runs/39337811840.
• release-feed.sh was tested locally with a throwaway key, including a rejected version mismatch. The Wrangler upload arguments were checked against a stub.

Evidence

Before / after, dark and light (Storybook, production component, fictional data):

Ticking with the panel open:

ticking.mp4