v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.

2 files changed, 93 insertions, 28 deletions

diff --git a/web/README.md b/web/README.md
index e79abd4..bd87e11 100644
--- a/web/README.md
+++ b/web/README.md
@@ -1,15 +1,15 @@
 # Download page
 
-`index.php` scans `bin/client` and `bin/server` on every request and renders
-whatever builds it finds, with version, size and SHA-256. No database, no
-JavaScript, no CSS, no dependencies. The page is plain browser defaults:
-black text, blue links, monospace checksums. PHP 8.0+.
+`index.php` scans `bin/gui`, `bin/client` and `bin/server` on every request and
+renders whatever builds it finds, with version, size and SHA-256. No database, no JavaScript, no CSS, no dependencies. The page is plain
+browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ## Layout
 
 ```
 web/
   index.php
+  bin/gui/       served at /bin/gui/... (app and installers)
   bin/client/    served at /bin/client/...
   bin/server/    served at /bin/server/...
 ```
@@ -22,13 +22,22 @@ The page only lists files that match the release pattern; anything else in
 those directories is ignored.
 
 ```
-zagan-bet-client-<version>-<platform>-<arch>[.exe]
-zagan-bet-server-<version>-<platform>-<arch>
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
 
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
+The installers are generated next to their app. They embed the app's SHA-256,
+check the file (or download it) and install it for the current user: Linux
+writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The source
+archives satisfy the GPL's corresponding-source requirement.
+
 ## Publishing a build
 
 From the repository root:
@@ -37,15 +46,21 @@ From the repository root:
 ./scripts/publish.sh
 ```
 
-It reads the version from `Cargo.toml`, builds all four artifacts and installs
-them under `web/bin` with the names above. Override the destination with
-`DEST=/srv/www/bin ./scripts/publish.sh`.
+It reads the version from `Cargo.toml`, builds every artifact and installs
+them under `web/bin` with the names above. The GUI is built with the
+workspace's `gui-release` profile (LTO, stripped) and the installers are
+rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+the release commit is the source the page links to. Override the destination
+with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
+into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
+`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only.
+dependency; the client is rustls-only. The GUI needs Python 3 at publish time
+for the installer templates in `scripts/installers/`.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
@@ -100,8 +115,9 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists and
-compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+half-written binary, then fetches the live page and every artifact it lists —
+GUI apps, installers, terminal clients and servers — and compares the
+downloaded bytes with the local SHA-256. `--verify-only` skips the
 upload and only checks the live site. Old versions are left on the server;
 prune them by hand.
 
@@ -124,3 +140,6 @@ php -S 127.0.0.1:8899 -t /srv/staging
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as
   `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
+- The page links <https://git.2137697.xyz/zagan-bet.git> for the GPL
+  corresponding source; publish only from a committed release so that link
+  contains the exact source.
diff --git a/web/index.php b/web/index.php
index 7ed79da..77edf95 100644
--- a/web/index.php
+++ b/web/index.php
@@ -4,20 +4,23 @@ declare(strict_types=1);
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/client and ./bin/server and renders every build it finds, with
- * its version, size and SHA-256. No database, no JavaScript, no dependencies.
+ * Scans ./bin/{gui,client,server} and renders every build it finds, with its
+ * version, size and SHA-256. The GPL source link points at the public git
+ * repository. No database, no JavaScript, no dependencies.
  *
  * Expected file names (anything else is ignored):
  *
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>.exe
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
  *
  * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
  * <arch> is x86_64|i686|aarch64. Example:
  *
- *   bin/client/zagan-bet-client-3.1.1-linux-x86_64
- *   bin/server/zagan-bet-server-3.1.1-linux-x86_64
+ *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
+ *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
  *
  * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
  * is only re-read when it changes. The cache lives in the system temp
@@ -26,6 +29,10 @@ declare(strict_types=1);
  */
 
 const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
     'client' => [
         'title' => 'Client',
         'hint' => 'Needs a terminal of at least 80×24 cells.',
@@ -163,7 +170,7 @@ function read_release(
     bool &$dirty
 ): ?array {
     $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
     if (preg_match($pattern, $entry, $matches) !== 1) {
         return null;
     }
@@ -192,10 +199,14 @@ function read_release(
         return null;
     }
 
+    $suffix = strtolower($matches[4] ?? '');
+    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
+
     return [
         'version' => $matches[1],
         'platform' => strtolower($matches[2]),
         'arch' => strtolower($matches[3]),
+        'variant' => $variant,
         'file' => $entry,
         'size' => $size,
         'mtime' => $mtime,
@@ -257,6 +268,10 @@ foreach (KINDS as $kind => $meta) {
         if ($byArch !== 0) {
             return $byArch;
         }
+        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
+        if ($byVariant !== 0) {
+            return $byVariant;
+        }
         return strcmp($a['file'], $b['file']);
     });
 
@@ -280,18 +295,41 @@ if ($cacheDirty) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>żagań.bet</title>
-<meta name="description" content="Official zagan.bet client and server downloads.">
+<meta name="description" content="Official zagan.bet desktop app, terminal client and server downloads.">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'">
 </head>
 <body>
 
 <h1>żagań.bet</h1>
-<p>Official client and server builds.</p>
+<p>Official desktop app, terminal client and server builds.</p>
 <?php if ($newest > 0): ?>
 <p>Builds published <?= e(gmdate('j M Y H:i', $newest)) ?> UTC.</p>
 <?php endif; ?>
 
-<h2>Client</h2>
+<h2>Desktop app</h2>
+<p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
+<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
+<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
+<?php if ($guiBinaries === []): ?>
+<p>Nothing published yet.</p>
+<?php else: ?>
+<ul>
+<?php foreach ($guiBinaries as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+<?php if ($guiInstallers !== []): ?>
+<h3>Installers</h3>
+<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<ul>
+<?php foreach ($guiInstallers as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+
+<h2>Terminal client</h2>
 <p>Needs a terminal of at least 80×24 cells.</p>
 <?php if ($releases['client'] === []): ?>
 <p>Nothing published yet.</p>
@@ -315,7 +353,7 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['client'], $releases['server']); ?>
+<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -329,8 +367,17 @@ echo e($sums);
 ?></pre>
 <?php endif; ?>
 
+<h2>Source</h2>
+<p>Zagan-Bet is free software under the GNU GPL v3 or later. The source for these builds is at <a href="https://git.2137697.xyz/zagan-bet.git">https://git.2137697.xyz/zagan-bet.git</a>.</p>
+
 <h2>Running it</h2>
-<p>Client:</p>
+<p>Desktop app on Linux:</p>
+<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
+./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<p>Desktop app on Windows (PowerShell):</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
+<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
 <p>Server, first run creates <code>identity.p12</code>, <code>key.pem</code> and <code>cert.pem</code>:</p>
@@ -338,8 +385,7 @@ echo e($sums);
 ./&lt;downloaded-server&gt; --init
 ./&lt;downloaded-server&gt; -i 0.0.0.0 -p 11525</code></pre>
 
-<p>Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
-
-<p>When lost, execute <code>help</code> command inside zagan.bet client. Server binary supports <code>--help</code> flag</p>
+<p>Terminal client on Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
+<p>Run <code>help</code> inside the terminal client; the server binary supports <code>--help</code>.</p>
 </body>
 </html>