Repository: wizardsardine/liana
Pull request #490 (2023-05-09 15:36:56)

Release 1.0 preparation

darosior: Note to self: let's not forget to remove the `-dev` suffix after branch-off/

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a53c067..3d880b64 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,43 @@
 # Liana daemon and GUI release notes
 
+## 1.0
+
+This is the first non-beta release of Liana.
+
+Improvements were concentrated on the GUI. The UI was entirely overhauled.
+
+### Features
+
+- The `createspend` command now allows you to not provide any destination. In this case it will
+  create a send-to-self transaction containing a single change output.
+
+#### GUI-specific
+
+- Overall there is a new layout and color scheme. The "draft transactions" menu was renamed to
+  the more common "PSBTs".
+- The homepage now features a list of payments, instead of transactions.
+- The spend transaction creation process is now contained in a single screen. It allows you to
+  easily create a send-to-self transaction by not specifying any recipient.
+- The homepage will now feature an approximation of the remaining time before the first recovery
+  path becomes available.
+- The homepage now features a button to refresh all coins whose recovery path is available (or close
+  to be), if there is any.
+- Entries in the coins list now features a button to refresh a coin (create a send-to-self
+  transaction in order to restart the timelock).
+- You can now generate multiple receive addresses in a row.
+- We now display the alias of signing devices (if any) in the final installer step.
+
+### Fixes
+
+#### GUI-specific
+
+- Send-to-self transactions are now displayed as such instead of being affected a "0.00000BTC"
+  value.
+- The installer will not present a step to register the descriptor on the signing device if there
+  isn't any.
+- Some wording improvements all around.
+- The slider to configure timelocks in the installer now has a step of 144 (instead of 1).
+
 ## 0.4
 
 This fourth release brings support for descriptors with multiple recovery path as well as several
diff --git a/Cargo.lock b/Cargo.lock
index 4ecdd725..9a76c036 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -216,7 +216,7 @@ dependencies = [
 
 [[package]]
 name = "liana"
-version = "0.4.0"
+version = "1.0.0"
 dependencies = [
  "backtrace",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index 8a4a21ac..79d948ae 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "liana"
-version = "0.4.0"
+version = "1.0.0"
 authors = ["Antoine Poinsot <darosior@protonmail.com>"]
 edition = "2018"
 repository = "https://github.com/wizardsardine/liana"
diff --git a/README.md b/README.md
index 591c4593..a096b64c 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 <div align="center">
-<img src="gui/ui/static/logos/liana-app-icon.svg" width="140px" />
+  <a href="https://wizardsardine.com/liana" target="_blank">
+    <img src="gui/ui/static/logos/liana-app-icon.svg" width="140px" />
+  </a>
 
 # Liana
 
@@ -14,22 +16,9 @@ Liana is a simple Bitcoin wallet that features a timelocked recovery path for al
 is, your coins are spendable as with a regular wallet but a secondary key becomes available after a
 configurable period of time should the primary one not be accessible anymore.
 
-Liana can be used for inheritance, where the owner of the coins is holding the primary key and the
-heir the secondary one. It can also be leveraged for recovery where a single person is holding both
-but different tradeoffs can be made between the backup(s) of the directly accessible and timelocked
-keys.
-
-Learn more about Liana from our [announcement blog
-post](https://wizardsardine.com/blog/liana-announcement/) and about how it was enhanced with
-Multisig from our [second release post](https://wizardsardine.com/blog/liana-0.2-release/).
-
-Liana is still under heavy development. Multisig support was implemented in the second release and
-the possibility for having multiple timelocked recovery paths was in the fourth release.  Regular
-wallet features (RBF, coin selection, ..) are planned. We also intend to switch to using Taproot as
-soon as possible, for enhanced privacy.
-
-**As such please consider Liana to be beta software.**
+Liana can be used for inheritance, decaying multisigs or safer backups.
 
+**[https://wizardsardine.com/liana](https://wizardsardine.com/liana)**
 
 ## Usage
 
@@ -48,13 +37,14 @@ your machine yet, you can download it [there](https://bitcoincore.org/en/downloa
 
 ### Installing the software
 
-The recommended installation method for regular users is to download an executable software release. If you prefer to
-build the project from source, see [`doc/BUILD.md`](doc/BUILD.md) instead.
+The recommended installation method for regular users is to download [an executable software
+release](https://github.com/wizardsardine/liana/releases). If you prefer to build the project from
+source, see [`doc/BUILD.md`](doc/BUILD.md) instead.
 
 Head to the [release page](https://github.com/wizardsardine/liana/releases) and download the right
 executable for your platform. If you are not sure what is the "right" executable for your platform,
-choose `liana-0.4.exe` if you are on Windows, `liana-0.4.dmg` if you are on MacOS and
-`liana-0.4-x86_64-linux-gnu.tar.gz` if you are on Linux.
+choose `liana-1.0.exe` if you are on Windows, `Liana.zip` if you are on MacOS and
+`liana-1.0-x86_64-linux-gnu.tar.gz` if you are on Linux.
 
 For every file available on the release page, there is an accompanying `.asc` file with the same
 name. This is a GPG signature made with Antoine Poinsot's key:
@@ -63,29 +53,19 @@ as on [his Twitter profile](https://twitter.com/darosior) or his [personal
 website](http://download.darosior.ninja/darosior.pub). It is recommended you verify your download
 against this key.
 
-Note that we do not codesign ("notarize") the released binaries for now. Windows or MacOS may
-prevent you from installing the software. On MacOS, you would get a warning saying the developer of
-this application couldn't be verified. This is because we didn't register with Apple prior to
-releasing the application. Make sure you verified the GPG signature of the download, then add an
-exception for Liana by following the steps from [this Apple support
+#### Apple, Windows, codesigned and notarized binaries
+
+We distribute both a non-codesigned and a codesigned-and-notarized MacOS application
+(`Liana-noncodesigned.zip` and `Liana.zip`).  To run the non-codesigned app, see [this Apple support
 guide](https://support.apple.com/en-us/HT202491) (section "If you want to open an app that hasn’t
 been notarized or is from an unidentified developer").
 
-Releases of Liana are reproducibly built. See [`contrib/reproducible`](contrib/reproducible) for
-details and instructions if you want to check a release.
+We do not yet distribute codesigned binaries for Windows at this time.
 
-### Setting up a wallet
 
-If you are using the graphical user interface (GUI), you can just start the program. It will spawn an installer that will guide
-you through the process of setting up a new wallet.
+### Wallet usage tips and tricks
 
-If you are using the daemon, you will need to specify its configuration as a TOML file. There is a
-documented example of such a configuration file in the [`contrib/` folder](contrib/lianad_config_example.toml).
-Then you can start the daemon like so:
-```
-lianad --conf /path/to/your/conf.toml
-```
-#### The script descriptor
+#### Script descriptor backup
 
 In Bitcoin, the conditions for spending a certain amount of coins are expressed using
 [Script](https://en.bitcoin.it/wiki/Script). In order to be able to recover your coins, you need to
@@ -105,13 +85,20 @@ Therefore you may afford a greater number of backups of your descriptor(s) and u
 mediums than for storing your private key(s).
 
 
-### Using a wallet
+#### On refreshing coins
 
-You can use Liana just like a regular wallet. Just be aware that if you are using a relative
+You can use Liana just like a regular wallet. Simply be aware that if you are using a relative
 timelock (the only type of timelocks supported for now), time starts ticking when you receive a
 payment. That is if you want the recovery path to never be available, each coin must be spent
 at least once every `N` blocks. (With `N` the configured value of the timelock.)
 
+The GUI provide simple shortcuts to refresh one or more coin(s) if the recovery path is close to
+become available. This is achieved by making a transaction to yourself (if you don't need to make a
+payment.)
+
+
+#### Signing devices and "hot" keys
+
 Liana can be used as a hot wallet. Note that mnemonics would be stored in clear on your drive. We
 strongly recommend using a hardware signing device for any non-trivial amount.
 
@@ -120,12 +107,14 @@ of the signer is a must. More signing devices are expected to implement Miniscri
 near future. For more information (such as minimum supported versions, please read the [signing
 devices documentation](./doc/signing_devices.md).
 
-If you are using the GUI, it should be intuitive what menu to use depending on your intention. If it
-is not, bug reports are very welcome so [feel free to report it](https://github.com/wizardsardine/liana/issues)! :)
 
-If you are using the daemon, you can use the `liana-cli` binary to send commands to it. It will need
-the path to the same configuration as the daemon. You can find a full documentation of the JSONRPC
-API exposed by `lianad` at [`doc/API.md`](doc/API.md). For instance:
+#### Using the daemon
+
+Liana can be run as a headless server using the `lianad` program.
+
+You can use the `liana-cli` program to send commands to it. It will need the path to the same
+configuration as the daemon. You can find a full documentation of the JSONRPC API exposed by
+`lianad` at [`doc/API.md`](doc/API.md). For instance:
 ```
 $ liana-cli --conf ./signet_config.toml getinfo
 {
@@ -141,20 +130,19 @@ $ liana-cli --conf ./signet_config.toml getinfo
     "network": "regtest",
     "rescan_progress": null,
     "sync": 1.0,
-    "version": "0.4.0"
+    "version": "1.0.0"
   }
 }
-
 ```
 
 Note also that you might connect the GUI to a running `lianad`. If the GUI detects a daemon is
 already running, it will plug to it and communicate through the JSONRPC API.
 
 
-### Using the recovery path
+#### Using the recovery path
 
 You may sweep the coins whose timelocked recovery path is available. You will need to sign the
-transaction using the recovery key, hence make sure to connect the appropriate signing device.
+transaction using the recovery key(s), hence make sure to connect the appropriate signing device(s).
 
 In the GUI, this option is available in the "Settings" menu at the "Recovery" section. Click on the
 "Recover funds" button, enter the destination for the sweep and the feerate you want to use for the
@@ -164,6 +152,16 @@ For the daemon, see the [`createrecovery`](doc/API.md#createrecovery) command. I
 sweep PSBT to the requested address with the specified feerate, filled with all available coins.
 
 
+### Reproducible builds
+
+Releases of Liana are reproducibly built. Linux binaries are also bootstrappable. See
+[`contrib/reproducible`](contrib/reproducible) for details and instructions if you want to check a
+release.
+
+Note you necessarily won't be able to reproduce codesigned binaries. We may provide detached
+signatures in the future.
+
+
 ## About the software project
 
 Liana is an open source project. It is [hosted at Github](https://github.com/wizardsardine/liana).
@@ -187,6 +185,11 @@ a graphical interface to the daemon using the [`iced`](https://github.com/iced-r
 
 The code for the GUI can be found in the [`gui/src/`](gui/src) folder.
 
+## Security
+
+See [`SECURITY.md`](SECURITY.md) for details about reporting a security vulnerability or any bug
+that could potentially impact the security of users' funds.
+
 ## License
 
 Released under the BSD 3-Clause Licence. See the [LICENCE](LICENCE) file.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..e90f388e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,10 @@
+# Security policy
+
+Please report any vulnerability or any bug that could potentially affect the security of users'
+funds by mail to [`antoine@wizardsardine.com`](mailto:antoine@wizardsardine.com).
+
+You may use my GPG public key to encrypt your mail: `590B7292695AFFA5B672CBB2E13FC145CD3F4304`. You
+can get it from:
+- [`keys.openpg.org`](https://keys.openpgp.org/search?q=darosior%40protonmail.com): `gpg --keyserver hkps://keys.openpgp.org --receive 590B7292695AFFA5B672CBB2E13FC145CD3F4304`.
+- [My personal website](http://download.darosior.ninja/darosior.pub)
+- [Bitcoin Core's `guix.sigs` Github repository](https://github.com/bitcoin-core/guix.sigs/blob/main/builder-keys/darosior.gpg)
diff --git a/contrib/release/release.sh b/contrib/release/release.sh
index 179492aa..7cbfcfa8 100755
--- a/contrib/release/release.sh
+++ b/contrib/release/release.sh
@@ -7,7 +7,7 @@
 
 set -ex
 
-VERSION="${VERSION:-"0.4"}"
+VERSION="${VERSION:-"1.0"}"
 LIANA_PREFIX="liana-$VERSION"
 LINUX_DIR_NAME="$LIANA_PREFIX-x86_64-linux-gnu"
 LINUX_ARCHIVE="$LINUX_DIR_NAME.tar.gz"
diff --git a/contrib/reproducible/guix/build.sh b/contrib/reproducible/guix/build.sh
index 6b2b2656..8969f82f 100755
--- a/contrib/reproducible/guix/build.sh
+++ b/contrib/reproducible/guix/build.sh
@@ -20,7 +20,7 @@ replace-with = "vendored_sources"
 
 [source."https://github.com/wizardsardine/liana"]
 git = "https://github.com/wizardsardine/liana"
-branch = "0.4-lianad"
+branch = "master"
 replace-with = "vendored_sources"
 EOF
 
diff --git a/doc/BUILD.md b/doc/BUILD.md
index 4ea8e38b..214274bd 100644
--- a/doc/BUILD.md
+++ b/doc/BUILD.md
@@ -1,7 +1,7 @@
 # Building Liana
 
 We use [Cargo](https://doc.rust-lang.org/stable/cargo/), the ubiquitous Rust package manager.
-Cargo takes care of downloading and compiling the projects dependencies, as well as compiling the
+Cargo takes care of downloading and compiling the project's dependencies, as well as compiling the
 project itself. Dependencies are specified in a [`Cargo.toml`](../Cargo.toml) file at the root of
 this repository. They are pinned in a [`Cargo.lock`](../Cargo.lock) file at the same place.
 
diff --git a/doc/TRY.md b/doc/TRY.md
index a7e674e0..9bf3a053 100644
--- a/doc/TRY.md
+++ b/doc/TRY.md
@@ -131,19 +131,16 @@ name it Alice but choose whatever. Set any timelock you want but preferably some
 you want to try the timelocked recovery feature! I'll go for "2" as the timelock. Click on "Set" for
 the recovery key, and choose "This computer" again.
 
-Of course, it wouldn't make sense for a real to use the same signing device to derive both the
-primary and recovery keys. Or even to use hot keys at all with a non-trivial amount of coins. We
+Of course, it wouldn't make sense for a real wallet to use the same signing device to derive both
+the primary and recovery keys. Or even to use hot keys at all with a non-trivial amount of coins. We
 only do this for convenience in testing Liana on Signet. If you'd like to try out signing with a
 hardware wallet you can use the "testnet" mode of a Specter, the "Bitcoin testnet" app of a Ledger,
 or the simulator of any of them (see the links at the top of this document).
 
 Click on next. If you want to try restoring from wallet backup later on, make sure to backup the
 mnemonic as well as the descriptor in the next two screens. Otherwise just make them happy by
-ticking the boxes.
-
-On the "Register descriptor" step you can (confusingly, i know) click on "i have registered the
-descriptor on my device(s)". If you are using a simulator make sure to register the descriptor
-though!
+ticking the boxes. If you are using a signing device simulator you'll have a step for registering
+the descriptor on it.
 
 Finally, configure the connection to `bitcoind`. The default should work for what we did in this
 guide. Click on continue and finalize the installation.
diff --git a/doc/signing_devices.md b/doc/signing_devices.md
index 2d5251e2..e4dff4ea 100644
--- a/doc/signing_devices.md
+++ b/doc/signing_devices.md
@@ -13,5 +13,5 @@ repository](https://github.com/wizardsardine/async-hwi).
 
 ## Ledger
 
-Minimum supported version of the Bitcoin application is 2.1.0 (the first version to have  full
+Minimum supported version of the Bitcoin application is 2.1.0 (the first version to have full
 Miniscript descriptors support).
diff --git a/gui/Cargo.lock b/gui/Cargo.lock
index 27252cbb..393e2149 100644
--- a/gui/Cargo.lock
+++ b/gui/Cargo.lock
@@ -1861,7 +1861,7 @@ dependencies = [
 
 [[package]]
 name = "liana_gui"
-version = "0.4.0"
+version = "1.0.0"
 dependencies = [
  "async-hwi",
  "backtrace",
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 8e79db47..6444d973 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "liana_gui"
-version = "0.4.0"
+version = "1.0.0"
 readme = "README.md"
 description = "Liana GUI"
 repository = "https://github.com/wizardsardine/liana"
diff --git a/gui/src/lib.rs b/gui/src/lib.rs
index 6a1cc4f8..2e0de280 100644
--- a/gui/src/lib.rs
+++ b/gui/src/lib.rs
@@ -11,7 +11,7 @@ pub mod utils;
 use liana::Version;
 
 pub const VERSION: Version = Version {
-    major: 0,
-    minor: 4,
+    major: 1,
+    minor: 0,
     patch: 0,
 };
diff --git a/src/lib.rs b/src/lib.rs
index 0b73c008..3041c1dd 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -78,8 +78,8 @@ impl fmt::Display for Version {
 }
 
 pub const VERSION: Version = Version {
-    major: 0,
-    minor: 4,
+    major: 1,
+    minor: 0,
     patch: 0,
 };
 


Test patch:
diff --git a/tests/test_rpc.py b/tests/test_rpc.py
index cc25b4be..4d1cf06b 100644
--- a/tests/test_rpc.py
+++ b/tests/test_rpc.py
@@ -20,7 +20,7 @@ from test_framework.utils import (
 
 def test_getinfo(lianad):
     res = lianad.rpc.getinfo()
-    assert res["version"] == "0.4.0-dev"
+    assert res["version"] == "1.0.0-dev"
     assert res["network"] == "regtest"
     wait_for(lambda: lianad.rpc.getinfo()["block_height"] == 101)
     res = lianad.rpc.getinfo()