PR from forks: https://github.com/WazeJinx/AltKeeperPlus, https://github.com/pingpingjinping/altkeeper and https://github.com/SalehAlSalem/altkeeper

.github/workflows/docker.yml

@@ -1,9 +1,9 @@
 # Prova il codice e pubblica l'immagine Docker su GitHub Container Registry (ghcr.io).
 #
-# - Pull request: prova i test e la compilazione dell'immagine (amd64), senza pubblicare.
-# - Push su main: pubblica `latest` e `sha-<commit>` (solo amd64: è la compilazione veloce).
+# - Pull request: esegue i test Linux e Windows, senza pubblicare immagini.
+# - Push su main: pubblica `latest` e `sha-<commit>` per amd64 e arm64.
 # - Tag `vX.Y.Z` (per esempio `git tag v0.2.0 && git push --tags`): pubblica `X.Y.Z`, `X.Y` e
-#   `latest`, per amd64 e arm64 (l'arm64 gira sotto emulazione: richiede parecchi minuti).
+#   `latest`, per amd64 e arm64 (build nativi paralleli, senza QEMU).
 #
 # L'immagine: ghcr.io/<utente>/altkeeper. Se il repo è privato lo è anche il pacchetto: per
 # usarlo da un server serve `docker login ghcr.io` con un token che possa leggere i pacchetti,
@@ -28,6 +28,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
+      - name: Check localized web UI
+        run: node scripts/check-web-ui.cjs
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
@@ -44,6 +46,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
+      - name: Check localized web UI
+        run: node scripts/check-web-ui.cjs
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
@@ -61,25 +65,79 @@ jobs:
           if ($LASTEXITCODE -ne 0 -or -not ($output -match '^uso: altkeeper')) { throw "Italian CLI help failed: $output" }
 
   image:
-    needs: test
-    runs-on: ubuntu-latest
+    # Build architectures concurrently on native runners; PRs run tests only.
+    if: github.event_name != 'pull_request'
+    needs: [test, test-windows]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v7
-
-      - uses: docker/setup-qemu-action@v4
+      # No QEMU: Rust is compiled natively for each target.
       - uses: docker/setup-buildx-action@v4
-
-      # Il login serve solo per pubblicare: le pull request non hanno il permesso di scrivere.
       - uses: docker/login-action@v4
-        if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository }}
+      - id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          # Immutable per-arch pushes; only the final manifest receives tags.
+          outputs: type=image,name=ghcr.io/${{ github.repository }},push-by-digest=true,name-canonical=true,push=true
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=altkeeper-${{ matrix.arch }}
+          cache-to: type=gha,scope=altkeeper-${{ matrix.arch }},mode=max
+      - name: Export image digest
+        run: |
+          mkdir -p "${RUNNER_TEMP}/digests"
+          digest="${{ steps.build.outputs.digest }}"
+          test -n "${digest}"
+          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
 
+  image-manifest:
+    # Publish tags only after both architecture builds succeed.
+    if: github.event_name != 'pull_request'
+    needs: [image]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
         uses: docker/metadata-action@v6
         with:
@@ -89,14 +147,18 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
             type=sha
-
-      - uses: docker/build-push-action@v7
-        with:
-          context: .
-          # I tag di versione pubblicano anche arm64; il resto solo amd64 (più rapido).
-          platforms: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create multi-platform manifest
+        working-directory: ${{ runner.temp }}/digests
+        env:
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+        run: |
+          # Never publish a partial multi-architecture manifest.
+          test "$(find . -maxdepth 1 -type f | wc -l)" -eq 2
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)
+      - name: Inspect published manifest
+        env:
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+        run: |
+          docker buildx imagetools inspect "$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")"

.github/workflows/release.yml

@@ -0,0 +1,105 @@
+# Compila AltKeeper per Windows, Linux e macOS e pubblica tutto in una GitHub Release.
+#
+# - Windows: `altkeeper.exe` + `altkeeper.exe.sha256`. L'aggiornamento dall'icona nella barra di
+#   sistema scarica proprio questi due file: i nomi non vanno cambiati.
+# - Linux (x86-64 e arm64) e macOS (Apple Silicon e Intel): `altkeeper-<tag>-<sistema>-<arch>.tar.gz`
+#   con il suo `.sha256`. Sono download manuali: l'auto-aggiornamento è solo per Windows.
+#
+# Si lancia con un tag, per esempio: git tag v0.3.1 && git push origin v0.3.1
+# Il numero del tag deve coincidere con `version` in Cargo.toml.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - name: windows
+            runner: windows-latest
+            test: true
+          # ubuntu-22.04: glibc 2.35, così il binario gira anche su distribuzioni non recentissime.
+          - name: linux-x86_64
+            runner: ubuntu-22.04
+            test: true
+          - name: linux-aarch64
+            runner: ubuntu-22.04-arm
+            test: true
+          - name: macos-aarch64
+            runner: macos-latest
+            test: false
+          - name: macos-x86_64
+            runner: macos-15-intel
+            test: false
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Check that the tag matches Cargo.toml
+        run: |
+          version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
+          if [ "v$version" != "${GITHUB_REF_NAME}" ]; then
+            echo "tag ${GITHUB_REF_NAME} != Cargo.toml v$version"; exit 1
+          fi
+      - name: Test
+        if: matrix.test
+        run: cargo test --locked
+      - run: cargo build --release --locked
+      - name: Package (Windows)
+        if: matrix.name == 'windows'
+        run: |
+          mkdir dist
+          cp target/release/altkeeper.exe dist/altkeeper.exe
+          cd dist
+          hash=$(sha256sum altkeeper.exe | cut -d' ' -f1)
+          printf '%s  altkeeper.exe' "$hash" > altkeeper.exe.sha256
+      - name: Package (Linux, macOS)
+        if: matrix.name != 'windows'
+        run: |
+          pkg="altkeeper-${GITHUB_REF_NAME}-${{ matrix.name }}"
+          mkdir -p "dist/$pkg"
+          cp target/release/altkeeper LICENSE README.md README.it.md "dist/$pkg/"
+          cp -r examples "dist/$pkg/examples"
+          cd dist
+          tar -czf "$pkg.tar.gz" "$pkg"
+          rm -rf "$pkg"
+          if command -v sha256sum >/dev/null; then
+            sha256sum "$pkg.tar.gz" > "$pkg.tar.gz.sha256"
+          else
+            shasum -a 256 "$pkg.tar.gz" > "$pkg.tar.gz.sha256"
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist-${{ matrix.name }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    # Una sola release, creata solo se tutte le build sono riuscite.
+    needs: [build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: dist-*
+          merge-multiple: true
+      - name: List files
+        run: ls -l dist
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          fail_on_unmatched_files: true

.gitignore

@@ -23,3 +23,6 @@ notify.conf
 renew.log
 .ultimo-errore
 /profili-salvati/
+altkeeper.log
+altkeeper.log.1
+altkeeper.new.exe

CHANGELOG.md

@@ -1,8 +1,11 @@
 # Changelog
 
-## Unreleased
+## 0.3.0
 
 ### Fixed
+- **USB on Windows without configuration.** When `USBMUXD_SOCKET_ADDRESS` is not set, Windows now
+  uses the usbmuxd of iTunes / Apple Devices on `127.0.0.1:27015` instead of failing to find the
+  phone. Ported from the USB-fix branch.
 - **Install hung forever over USB on iOS 27.** On USB, installing an IPA now goes through AFC + installation_proxy via usbmuxd (same path as `pymobiledevice3 apps install`) instead of the CoreDeviceProxy software tunnel, and the profile client prefers the lockdown service too. App install and profile install now have timeouts, so a stuck phone produces an error instead of a silent hang. The status line says "over USB" or "over Wi-Fi" according to the real transport. Not compiled in this environment: please run `cargo build` and test.
 
 ### Changed
@@ -17,6 +20,20 @@
   unattended renewals (profiles + App IDs) work again.
 
 ### Added
+- **Windows tray icon (`altkeeper tray`, also what a double-click on `altkeeper.exe` starts).**
+  AltServer and the web page run without a terminal, with an icon next to the clock (AltKeeper
+  logo, grey while the iPhone is unreachable), a menu (*Open AltKeeper*, *Show logs*, *Start with
+  Windows*, *Check for updates*, *Quit*), a window with the web page (WebView2) and toast
+  notifications for renewed profiles, installed apps and failures. Ported from AltKeeperPlus.
+- **Updates from the tray and `release.yml`.** The icon checks the fork's GitHub releases once a
+  day; *Update now* verifies the SHA-256, restarts and rolls back if the new version does not
+  start. `release.yml` builds `altkeeper.exe` for Windows on a `v*` tag. Ported from AltKeeperPlus.
+- **Persistent logs.** Server lines (AltServer, web page, DNS-SD) carry a timestamp and are
+  also written to `altkeeper.log` (rotated at 5 MB) and shown in a new **Logs** section of the
+  web page (`/api/logs`). Ported from AltKeeperPlus.
+- **AltKeeper logo as the icon of `altkeeper.exe`** (embedded by the new `build.rs` on Windows builds, from `assets/altkeeper.ico`), besides the tray and window icons.
+- **App / App ID counters** next to "Your apps" in the web page (3 active apps and 10 App IDs for
+  a free account; an estimate from the profiles on the phone). Ported from the USB-fix branch.
 - **USB when the iPhone is plugged into the machine running AltKeeper.** Every connection (check, renew, sign and install, AltServer) first looks for an iPhone on USB through the local `usbmuxd` (or the one in `USBMUXD_SOCKET_ADDRESS`) and talks to it through the CoreDeviceProxy tunnel; if there is none, or it fails, it falls back to Wi-Fi as before. Much faster for installing IPAs. Needs the phone to already trust the computer (the usual "Trust" prompt), not the remote pairing. `--phone <ip:port>` forces Wi-Fi; `ALTKEEPER_NO_USB=1` turns USB off. In Docker the usbmuxd socket must be mounted into the container.
 - `ALTKEEPER_REVOKE_CERTS=1`: when installing an IPA from the web page fails with Apple error 7460 (the Apple ID already has a development certificate, e.g. from AltStore/SideStore), AltKeeper can revoke it and create its own. Off by default; without it you now get a clear explanation instead of a generic error.
 - **Windows support (native, no Docker).** `cargo build --release` on Windows 10/11 produces