Release-pipeline supply-chain hardening from the audit (F15-3/4, F15-6):
- appimagetool: stop fetching the moving "continuous" AppImageKit tag and
running it unverified on the release builder. Pin appimagetool 1.9.0 and
verify its SHA-256 (46fdd785…83d1) before exec, refusing to package on
mismatch; a system-installed appimagetool (maintainer's own) is still used
as-is. Applied in both build.sh and scripts/create-appimage.sh.
- setup.sh --sapling: the z.cash param download is plain HTTPS with no
signature; verify both params against their fixed canonical SHA-256 (the
same values already pinned in build-lite-backend-artifact.sh) and delete
the file on mismatch.
All three scripts pass bash -n.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Instead of blocking the entire UI with "Activating best chain..." until
the daemon finishes warmup, treat warmup responses as a successful
connection. The wallet now:
- Sets connected=true + warming_up=true when daemon returns RPC -28
- Shows warmup status with block progress in the loading overlay
- Polls getinfo every few seconds to detect warmup completion
- Allows Console, Peers, Settings tabs during warmup
- Shows orange status indicator with warmup message in status bar
- Skips balance/tx/address refresh until warmup completes
- Triggers full data refresh once daemon is ready
Also: fix curl handle/header leak on reconnect, fill in empty
externalDetected error branch, bump version to v1.2.0 in build scripts.
Full-node GUI wallet for DragonX cryptocurrency.
Built with Dear ImGui, SDL3, and OpenGL3/DX11.
Features:
- Send/receive shielded and transparent transactions
- Autoshield with merged transaction display
- Built-in CPU mining (xmrig)
- Peer management and network monitoring
- Wallet encryption with PIN lock
- QR code generation for receive addresses
- Transaction history with pagination
- Console for direct RPC commands
- Cross-platform (Linux, Windows)
DanSandClaude Fable 5