v1.35.0: GPL-3.0-or-later, framework-dependent build, provenance docs - #95
Merged
Conversation
The generator exported every glyph through FormattedText.BuildGeometry, so the committed banners were vector outlines of Segoe UI and Consolas. Windows font terms allow graphic images of text but not converting the fonts themselves, so the banners are now drawn with DrawingContext.DrawText and saved as PNG through RenderTargetBitmap. Nothing but pixels leaves the machine. Rendered at 2560x600 from the same 1280x300 layout, so they are sharper on HiDPI screens than the SVGs were. Layout, colours and copy are unchanged, except that the profiles banner no longer states a model count: a number baked into an image is not covered by the CI counter guard and would drift on every new model.
MIT let anyone take GhostDeck, close the source and sell it. GPL keeps the freedoms attached: forking and selling stay allowed, but a distributed modification has to carry the same rights and ship its source. Releases through v1.34.x stay MIT for the material the project could license that way. The name and the visual assets are deliberately outside the code license, in TRADEMARK.md and LICENSE-ASSETS.md: forks are welcome, wearing this project's face while claiming to be official is not. THIRD-PARTY-NOTICES.md records where the hardware knowledge came from, naming the upstream file and its SPDX header rather than the repository, and separating what was generated from upstream maps from what was researched with them as a reference. Origin and later hardware validation are tracked as different things, because verifying a mapping does not change where it first came from. licenses/ carries the terms of what the executable actually bundles, which is System.Management and the .NET apphost, both MIT. Also: msiec-sync no longer treats charge addresses 0xD7 and 0xEF as interchangeable. Upstream uses 0xEF on G1 and 0xD7 on G2, and all 35 G1 entries set it explicitly, so the waiver never fired - it could only ever have masked a G1 entry losing its address and silently inheriting the G2 default. The supported-models doc now says fan and temperature registers were the part cross-checked against MControlCenter, which is what actually happened.
Matches the rename in the release workflow. The comment above the constant explains why the name differs from the executable, so it does not get "fixed" back later: an installed v1.34.x looks for an asset called exactly GhostDeck.exe, and not finding one is what stops it from replacing a self-contained copy with a build that needs a runtime the machine may not have. Verified end to end against the v1.34.0 code rather than by reading it: a build from that tag, differing only in the API URLs, was pointed at a release carrying only the new asset name. It detected the update, offered Install, and on click fell back to the release page - no .update.exe, no .bak, the running exe byte-identical afterwards.
Targeted at maxVersion 1.34.0, so only the people who have to act see it and anyone already on 1.35.0 does not. The wording follows the behaviour the migration test actually produced rather than a guess: clicking Install in v1.34.x reports a failed download and opens the releases page, because the asset it looks for no longer exists. Left unexplained that reads as a bug, so the notice says it in advance, states that the installed copy is untouched, and points at the file to download. All 15 languages.
The release page is where someone lands after the updater opens it, so the upgrade note goes at the top of the section rather than buried in a bullet. The licensing entry claimed the MIT grant "still applies to" the older releases. Narrowed to material the project had the right to license that way, matching the wording already used in README - the point of documenting provenance is not to then make broad claims about third-party rights.
Dated 2026-08-17. [Unreleased] stays as an empty heading so the next change has somewhere to go. The release workflow extracts its notes with a regex over this file, and that is the one release step the signed dry-run does not exercise, so it was checked against the final text: the match starts at the 1.35.0 heading, stops before 1.34.0, and picks up neither the empty Unreleased section nor the previous release.
wygodad
marked this pull request as ready for review
August 17, 2026 11:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Working branch for v1.35.0. Draft on purpose - not ready to merge, opened so CI runs against the changes.
What is in here
Licensing. The code moves from MIT to GPL-3.0-or-later. MIT let anyone close the source and sell it; GPL keeps the freedoms attached to whatever gets redistributed. Releases through v1.34.x stay MIT for material the project had the right to license that way.
Name and artwork are outside the code license (
TRADEMARK.md,LICENSE-ASSETS.md). Forks are welcome; shipping a modified build wearing this project's identity is not.Provenance (
THIRD-PARTY-NOTICES.md). Where the hardware knowledge came from, per structure, naming the specific upstream file and its SPDX header rather than the repository, and separating what was generated from upstream maps from what was researched with them as a reference. Origin and later hardware validation are recorded as different things, because verifying a mapping does not change where it first came from.Distribution changes from self-contained to framework-dependent. The download goes from ~160 MB to ~2.5 MB and the .NET 8 Desktop Runtime becomes a requirement. The release asset is renamed to
GhostDeck-win-x64.exe, which is what stops the in-app updater in v1.34.0 from swapping a self-contained install for a build that needs a runtime the user may not have.Banners are raster now. The generator used to export every glyph as Bezier paths, so the committed SVGs were vector outlines of Segoe UI and Consolas. They are drawn to a bitmap instead, at twice the previous resolution.
Two fixes found while auditing.
msiec-syncno longer treats charge addresses0xD7and0xEFas interchangeable - the waiver never fired and could only have masked a G1 entry silently inheriting the G2 default. The supported-models doc now says fan and temperature registers were the part cross-checked against MControlCenter, which is what actually happened.Verified, not just reasoned about
The migration path. A build from the
v1.34.0tag, differing only in the three API URLs, was pointed at a release carrying only the new asset name. It detected the update, offered Install, and on click fell back to the release page: no.update.exe, no.bak, no updater script in%TEMP%, and the running exe byte-identical afterwards. This is the failure that would have hurt - an update swapping a working install for an exe that cannot start - so it was tested against the code users actually have rather than read.The signed artefact. A
dry-runof the release workflow producedGhostDeck-win-x64.exe, 2.4 MB, version 1.35.0.0, Authenticode Valid, signed by WYGODA DAWID FENIX INSPIRE, and it runs. Worth recording: the unsigned framework-dependent single-file is deleted on sight by Defender asBehavior:Win32/Execution.A!ml, and once took GhostDeck's own scheduled task with it. The signed one is not touched. Local builds of this shape are not a valid test.The release notes. The workflow extracts them from
CHANGELOG.mdwith a regex, and that is the one release stepdry-runskips, so it was checked against the final text.Checks
Build 0 warnings, 699 translation keys x 15 languages, model database consistent and signature valid, README counters, supported-models doc regenerated from the code. CI green on every push to this branch.
Not in this release
The
announcements.jsonentry is gated tomaxVersion: 1.34.0, so only the people who have to act see it. Winget is untouched because the package was never published: the manifests exist locally at 1.28.0 and no submission was ever made.