-
Halkyon Learn 0.19.0
Stableraisondetredev released this
2026-10-23 18:46:31 +02:00 | 479 commits to main since this releaseGPG key ID: 07F6FCF405488B64Halkyon Learn 0.19.0 for Android and Linux. Both connect to learn.halkyon.eu, the project's instance.
Features
- ways in for accounts without a working password
- change the password and the recovery phrase while signed in
- the basics say when GitHub sign-in ends
- sign in with a password and TOTP on the device
- codes by mail no longer sign in
- a session ended for its wrong proofs warns its owner
- the warning that a session was ended for its proofs
- secrets kept out of screenshots on macOS and Windows too
- the instance's side of private studysets (ADR 0019)
- content sealed with data keys, and an anonymous person's device keys (ADR 0019)
- every synced payload sealed and opened through one envelope (ADR 0019)
- the device tells the instance whether to count the person, and what their copies come from (ADR 0019, D3)
- make a studyset private or not, and what a locked one shows (ADR 0019)
- offer once to make every studyset from before private (ADR 0019, D4)
- a private studyset's files are sealed with its key (ADR 0019, D5)
- a studyset's marker says what the instance sees of it (ADR 0019)
- the Publish sheet lists the tag names a release sends (ADR 0019)
- Finish takes in edits nobody signed once the person agrees (ADR 0019)
- no hand-off and no connector; the field searches the web (ADR 0022)
- SimpleLogin's forwarding page and Learn's App Links statement (ADR 0020, step 1)
Fixes
- a new recovery phrase takes the password too
- a device refuses Argon2id costs beyond the register's ceiling
- the password alone calls off an account's reset waiting
- the recovery phrase is proved by a key of its own
- decoy encryption keys are keys a device could have made
- proofs are bound to the instance the device addresses
- new passwords have at least 12 characters
- a sealed data key is signed by whoever sealed it
- a capped wait, a long instance secret, writes of their own columns
- limits by address and network, so nobody holds an owner out
- codes wait after ten wrong in a row, and the owner is told
- an IPv6 visitor counts by their /64
- an account with a password deletes itself only with it and a code
- a code is counted before it is checked
- every proof counts toward the address as it is checked
- a session's wrong codes end the session, not the account's codes
- every call with a code after the password takes the address
- a reset forgets the codes refused before it
- a code by mail serves only what it was asked for
- an account whose second factor doesn't work deletes itself
- a member behind the register's clock says the password changed
- a session alone never gets a code checked
- every change of how an account is secured asks for the password
- a code's mail names its purpose in the subject
- a first password takes a fresh proof of the account's way in
- the first authenticator takes the password, and a reset ends every session
- a proof the register couldn't answer counts; the sign-up mail says it gives a password
- a reset not carried out lapses a week after it took effect
- codes after the recovery phrase count apart from the password's
- a reset waits while its owner is held out, and devices show it
- GitHub-only accounts go at GitHub's end; only the anonymous add an address
- members learn of ended sessions in the background
- only a session made since dismisses the owner's warning
- a setup's password replaced ends the account's other sessions
- a member asks the register before deleting an account
- a member's clock running ahead of the register's is refused too
- proofs are bound to the instance's whole base URL
- the owner's proof is bound to what it approves
- every owner's proof binds the change it approves
- the phrase is never copied, codes leave the clipboard a minute later
- instances over plain HTTP are refused, but on this machine
- no sheet is left busy by an error nothing expected
- saved files are the own user's alone, and iOS's copy goes
- no state logs an authenticator's key, codes or the address
- keyboards learn nothing of a password, a code or the phrase
- only an otpauth URI is shown as a QR code or opened
- on Apple's systems the account's keys stay on this device
- no copy of a key left on the way, and the README says what is wiped
- secrets are kept out of screenshots and the recent apps
- a hold-out moves a reset on only by its own time, and a reset lives 30 days at most
- a member's clock off the register's ends the sessions of its gap, waiting for nothing
- a member asks the register whose account it is before a deletion's proof counts
- GitHub-only accounts go 30 days after GitHub's end, on the register alone, one failure holding back none
- the reading of the fixes' nits
- nothing secret is copied
- a saved file is the own user's from the start, and replaces the one chosen whole
- the phrase typed back is kept out of screenshots too
- an Apple device's keychain gives the keys only while it is unlocked
- http:// and https:// on one host are one account on the device
- no address in debug logs, and deleting goes on whatever reading the account met
- what a password unlocked is wiped once done with
- a reset takes effect 14 days after it was asked at the latest
- a refusal past an address's ceiling answers before its resets move
- a member keeps the session a reset signed in when its notice comes late
- a member deletes nobody while the register is out of reach
- GitHub's end deletes what it says, when it says
- a saved secret is 0600 on Apple's Arm too, and macOS saves at all
- the phrase typed back is pasted into its fields, never copied out
- a phrase field keeps its focus as the app goes and comes back
- keys an earlier build kept go too, and a locked keyring stops nothing
- Windows keeps secrets out of captures by its real version
- the short reading's nits on the device
- a GitHub account someone has is theirs to switch to where passwords are offered too
- GitHub's refusals say why, and no hint adds GitHub where passwords are offered
- no Add GitHub where people sign in with a password
- signing out or deleting the account keeps the person's app until it is done
- a sign-out or deletion that failed says so, its tile showing it under way
- the instance's side of the reading of private studysets (ADR 0019)
- privacy is a signed fact the instance can't take back (ADR 0019)
- what the app shows and adds keeps private studysets private (ADR 0019)
- the short reading of the reading's fixes (ADR 0019)
- publishing and suggestions after the short reading (ADR 0019)
- a suggestion takes along only its own tree's sealed files (ADR 0019)
- the tag names' list reads its names without catchError
- what decides a row's key is bound into its seal (ADR 0019)
- a release sends exactly the tag names the sheet showed (ADR 0019)
- Finish shows what it would take in, and takes in exactly that (ADR 0019)
- sweeps cost what a merge brought, and a rewrite holds only its tree (ADR 0019)
- a device without the keys writes no content where the account has keys (ADR 0019)
- what the hostile instance found (ADR 0019)
- a newest settings row taken away leaves out what it outweighed (ADR 0019)
- Material's icon font where serverpod_auth_idp_flutter asks for it
Installing
- Android:
halkyon-learn-0.19.0.apk, one APK for every phone, signed with the app's key; the SHA-256 of its certificate is27e243fcbdc826ff98ab7dbb10436c98c3bea24b2a015e94e4cfc7d1fc2a006c. - F-Droid: the same APK in the repository https://halkyon.app/fdroid/repo?fingerprint=E8082788756F6B7E682AA22FCEAD24B53E2A8B0912AD66D65E8C2D4F07BB94B0
- Linux:
halkyon-learn_0.19.0_amd64.snap, also in the Snap Store:snap install halkyon-learn --edge.
SHA256SUMSlists the files' checksums, signed with the GPG keyB172B9ED76A32EBCABA24A9F07F6FCF405488B64(SHA256SUMS.asc).Downloads