Skylight Wallet

This is a routine version-2.1.0 bug-fix merge for the Skylight Monero wallet. The visible changes fix small packaging and platform-detection issues, add a new automated TLS test suite, and update pinned internal library versions. There is no direct evidence in the commit of a security vulnerability being patched, but the TLS-related test additions and library bumps suggest the release is hardening how the app validates encrypted connections. The patch is best treated as a maintenance/hardening update rather than a confirmed fix for an exploitable flaw.

This is a large feature merge that adds a desktop user interface, re-enables Linux and Windows release builds, and makes several Android build and security-related changes. The most notable security-relevant change is a fix in the Android MainActivity that prevents external apps or links from launching the app straight into a specific screen, which could have bypassed the app lock. The rest of the diff is UI/UX refactoring, localization updates, and build plumbing.

This commit fixes a UI bug where mobile users were incorrectly shown a 'create wallet password' screen that should only appear on desktop. On mobile, the app now skips that screen and creates or restores the wallet directly, relying on the device's own lock instead. Most of the changes are just code formatting.

This is a large merge commit that brings a new desktop user interface into the Skylight Wallet app. Most of the changes are UI layout, new desktop-specific screens, updated text strings, and build script tweaks. There is no obvious security bug in the diff, but the commit is a merge of two feature branches and the diff is huge, so a complete security review of every line is not practical from the supplied excerpt alone.

This commit only updates version pins (commit hash references) for two external code libraries used by the Skylight Wallet app: monero_c and wallet-core. The actual code changes in those libraries are not shown in this commit. There is no description of any security fix, bug fix, or feature change. Based on this commit alone, we cannot determine whether the update fixes a security issue, introduces one, or is a routine maintenance change.

This commit only changes which version of an internal software library (wallet-core) the Skylight Wallet app depends on. It updates a reference code (a Git commit hash) in two package-management files. The commit message does not say why the update was made, and no security-related explanation is provided. Without seeing what actually changed inside the wallet-core library between the two referenced versions, we cannot tell whether this fixes a security problem, adds a feature, or is just routine maintenance.

This commit only changes how the app pulls in its shared wallet library. It switches from a local folder reference to a pinned Git commit from the same project's online repository, and updates that pinned version to a newer commit. There is no visible code change in the app itself, and nothing in the commit message or diff indicates a security fix or vulnerability.

This commit updates a dependency pin for the core Monero library used by the Skylight Wallet app and switches several wallet helper packages from remote Git downloads to local file paths. The change itself is a routine dependency bump and local development path change. There is no direct evidence in the commit that this fixes a security vulnerability, but updating a pinned cryptographic/wallet library can sometimes include security fixes from upstream. We cannot confirm that without inspecting the upstream library changes, which are not provided.

This commit fixes a Monero wallet bug where the app could accidentally save a private 'view key' to a regular Monero node instead of a lightweight wallet server (LWS). The fix separates saved server addresses for the two connection modes so that switching modes doesn't leave the wrong server address in the settings field. If the wrong address were saved, the user's private view key could be exposed to a node operator, allowing them to see all incoming transactions for that wallet.

This commit only updates the app's version number and switches its internal wallet-core library to a newer pinned commit. No actual code changes are shown, and the commit message does not say anything about fixing a security problem. On its own, this diff does not demonstrate any vulnerability or security fix.

This commit fixes a security bug in how the Skylight Wallet app copies sensitive information to the clipboard. Previously, some screens copied wallet addresses and secret keys using the regular system clipboard, which could leave that data exposed in the clipboard history. The patch makes those screens use the app's secure clipboard helper instead, which marks the data as sensitive and clears it automatically. It also adjusts Android 13+ so the app doesn't show a duplicate 'copied' confirmation when the operating system already shows one.

This commit is a build-maintenance change, not a security fix. It creates one central file (rust-toolchain.toml) that declares which Rust compiler version to use, and updates build scripts and Docker configuration to read from that file instead of hard-coding an older version. There is no change to wallet logic, cryptography, or user-facing behavior.

This commit is a routine code cleanup. It removes several unused or dead utility files, widgets, and tests, and moves one small status icon definition into the screen that uses it. There is no change to how the app handles money, keys, network connections, or user data, and nothing in the commit suggests a security fix.

This is a large user-interface refresh for the Skylight Monero wallet. Most changes are cosmetic: new logo, fonts, colors, labels, and screen flows. The only functional security-relevant change visible in the diff is that the app now derives whether a server connection uses HTTPS automatically from the address type (routable vs. onion/local), instead of letting the user toggle an 'useSsl' switch. This is a hardening move, not a vulnerability. There is no evidence in the commit of an exploit, backdoor, or data leak.

This commit changes two wallet setup screens so that users running a 'full node' mode skip a 'wallet details' screen that is only relevant to users relying on a third-party light wallet service. It also moves the start of a fiat-rate service earlier in the flow. There is no direct security vulnerability in the diff; it is a UI/routing correction that may reduce user confusion and avoid exposing unnecessary setup steps.

This is a large feature/refactoring commit that introduces a new shared wallet-core integration path behind a compile-time flag, while keeping the existing legacy wallet code intact. It also removes the old in-tree openalias_ffi plugin and switches OpenAlias resolution to a new wallet_openalias package. There is no direct evidence in the diff of a security vulnerability, malicious change, or undisclosed fix. The work appears to be a normal architectural migration.

This commit improves build reliability and supply-chain consistency for the Skylight Wallet. It switches the source of a key Monero-related library from a personal GitHub account (vtnerd) to the project's own organization (magicgrants), and it replaces a script that pinned the Rust compiler version for only the Tor plugin with a script that also pins the version for the OpenAlias plugin. There is no direct evidence of a security vulnerability being fixed; the changes are best described as hardening build reproducibility and reducing trust in an external repository.

This is a large feature update for the Skylight Monero wallet that brings in improvements from another project called Spice. It adds support for connecting directly to a full Monero node (not just a light wallet server), background and continuous syncing, a more secure clipboard for copying sensitive data, QR-code wallet restoration, and a new OpenAlias resolver. The changes are mostly defensive: they improve privacy, reduce clipboard leaks, and make transaction sending more precise. There is no clear security vulnerability introduced by the patch, but because it is a very large change touching many security-sensitive areas (wallet files, network connections, background services, and clipboard handling), it deserves careful review and testing before release.

This commit fixes the mobile wallet's automated build process so it always uses the same Rust compiler version when building a privacy-sensitive networking component (the Tor plugin). Without the fix, the build could silently use whatever the latest 'stable' Rust release is at the time, making releases non-reproducible and potentially introducing unexpected behavior or compiler-related issues. It also copies a pre-installed Rust toolchain into the build container so the build does not fail from a missing rustup. This is a build-hardening and reliability change, not a direct fix for an active security vulnerability in the wallet itself.

This commit updates the versions of third-party GitHub Actions used in the project's automated build and release pipelines and locks them to specific, unchangeable commit hashes. It also adds a minor workaround for a Homebrew warning. The change is a routine supply-chain hardening measure; it does not introduce any obvious security vulnerability and likely reduces the risk of a compromised or malicious action update silently affecting future builds.

This commit only adds documentation to the README explaining how users can verify that downloaded release files are genuine using GPG signatures. It does not change any code, build process, or signing keys, and it does not fix or introduce any security vulnerability.

This commit is a routine iOS build-configuration update for a Flutter wallet app. It adds Apple code-signing settings, migrates the app to use the newer iOS scene-delegate API, and registers Flutter plugins in a slightly different way. None of these changes introduce a security vulnerability or fix one; they are standard project maintenance needed to keep the app building and running on modern iOS.

This commit removes a Docker command-line flag that made the build container run as the current host user instead of the container's default user. The stated goal is to fix build permission problems. In itself, the change does not add a known vulnerability, but it means the build will now run as whatever user is configured inside the builder image. If that image runs as root, files created in the mounted workspace could end up owned by root, and any build-time scripts or tools will execute with the container user's privileges. There is no direct evidence in the commit that this is a security fix or that it introduces an exploitable flaw.

This commit adds user-configurable Tor settings to the Skylight Wallet app. Users can now choose between built-in Tor, an external Tor proxy, or disabling Tor entirely. It also updates how the app fetches exchange rates and blockchain heights so they respect the new Tor setting. There is no clear security bug in the patch itself, but it introduces a 'Tor disabled' mode and changes how network traffic is routed, which could affect user privacy if the settings are mishandled or bypassed.

This commit fixes a GitHub Actions release workflow that was supposed to sign Android and Linux app files with GPG. Before the fix, the signing command likely failed because it could not unlock the GPG private key without a passphrase. The change passes the GPG passphrase from a GitHub secret into the signing step so the automated signing can complete. It is a build-pipeline fix, not a vulnerability in the wallet application itself.