v1.0.0

[marcus-crane]

This marks the first "official" release, although certainly not the last.

Included in this release are the following new additions:

• Add the ability to upload cover images (NOTE: This requires some presetup with Calibre)
  • Cover uploading is off by default as it will result in confusing output for the user (blue covers) if they haven't followed the required steps
  • These aren't documented yet but will be shortly
• Add a button to check connectivity with Readwise
• Forward SourceURL which is the source file for a book. This is used in deduplication so eg; a different copy of the same book would result in different highlights.
  • This is used under the hood to map existing Readwise books to titles on device in order to upload covers from the device
  • This will result in existing Readwise uploads being duplicated one time! This is reflected in the jump to 1.0.0 to indicate a "breaking" change
• Enable the ability to load in locally stored Kobo sqlite databases. Mainly this is useful for myself when debugging so I don't have to plug in a Kobo all the time but it might be handy for any users as well.

In general, the app is solid enough to use hence why I'm marking it ready for v1.0.0 now despite it not being perfect. It's stable as far as what the user expects anyway, beyond the one breaking change here. I don't expect to change any upload code in future, besides say; a v2 of the Readwise API

As always, please file any bugs you discover

What's Changed

• Refactor October into separate packages by @marcus-crane in Refactor October into separate packages #31

Special Thanks

I'd like to say a special thanks to @jasondemeter for taking this project for a spin and pointing out some bugs along the way

Full Changelog: v0.9.4...v1.0.0

---

This discussion was created from the release v1.0.0.

[Desertzune]

I have a Kobo on the way and was uncertain whether I would keep it, until I saw this project on Readwise. Thank you! I'm not very familiar with Github, and cannot find the installation files for 1.0. I see the installation files for previous releases. Am I not looking in the right place? Thanks very much for your work.

[marcus-crane]

Ah, thanks for bringing this to my attention!

The short version is that when I create a release on Github, some automation kicks in and adds the installation files to that release so what you saw was the automation failing which is why you saw an empty release 😅

It turns out that 1.0.0 failed to build (the build automation treats warnings as hard errors) which was my bad so I've published v1.0.1: https://github.com/marcus-crane/october/releases/tag/v1.0.1

Admittedly, I just sort of pushed out v1.0.0 to get something out there finally since this has been my on-off project for like a year now (switching technologies, banging my head against dumb issues) so I rushed a bit and embarrasingly, my first official release is empty 😭

Anyway, now that there are some users apparently, it's a good incentive to review my practices and put a bit more rigour into the release pipeline.

I also need to get around to fleshing out the documentation at https://october.utf9k.net which is currently placeholder. That said, October is pretty straight forward I think (there are only a handful of things to click) but feel free to ask any questions and definitely file reports for any bugs you see.

Thanks!

[Desertzune]

Thanks for the explanation, and thanks again for the app. I think you will have a lot of happy Kobo users once word gets around.

[osteotek]

Looks like a nice tool, but is there any reason VirusTotal finds malware in windows packages?
https://www.virustotal.com/gui/file/35d18694d8759778246466d2d72bfc62210c63ab9278b32c599c2a14a1a5f844/detection

[marcus-crane]

Hi there,

Thanks for pointing this out.

I'm at work currently so I'll need some time to properly understand what VirusTotal is reporting here (I'm not hugely familiar with the UI). The following is just my brief observations from poking around.

For starters, 2/35 (+2 unknown) is not a particular strong score so I could just pass it off as a false positive but I'd like to properly understand what it's saying.

I took a quick look around in the meantime and it seems to mostly be triggering on this entry: https://www.virustotal.com/gui/file/3d44ae53c52991a36e642be5d13c953bff196a09df26b9b456310adce0382859/relations

As a bit of background, October uses Wails.io as a framework which spits out a Golang binary that serves a small UI (making up the desktop app).

In order to render the UI aspect (which is a React application) without pulling in an entire browser like Electron, it makes use of the natively included webview to render HTML + JS.

On the macOS side of things, it has a native webview system library so it works out of the box but for Windows, we make use of WebView2, which is powered by Microsoft Edge.

There are a couple of options such as embedding the Windows webview dependencies by default (which based on this, I probably should) but for now, we just prompt the user to download it at runtime.

If we analyse the WebView2 Evergreen Bootstrapper, we don't get exactly the same file (different hashes) but we get a subset of the IP addresses and files which would indicate they're the same: https://www.virustotal.com/gui/file/c87d64ced6de7135eb497c6a21dc9cefb9235fec702b93a64ffcc04e5913a4d0/relations

In fact, we can even see the results for October under "Execution Parents" with a 5/69 score yet the very file it's executing has a clean 0 score? Unless I'm misreading the VirusTotal UI, this seems kind of contradictory and it's why I'm leaning towards a false positive here.

Anyway, as mentioned though, there is definitely more investigation to be done and the "fix" here might just be embedding WebView directly into the application to see if that resolves any false positives.

As far as the possibility of something being injected, the entire CI/CD process is open source so you're welcome to inspect it yourself and compile the application manually if you have any concerns.

In the meantime, I'll give the Wails maintainers a heads up since the Windows NSIS Installer is relatively new as well so perhaps there's something to look at here as well that might affect other Wails applications.

Anyway, thanks again for the heads up 🙂

[osteotek]

Thanks for the detailed response! I'm leaning towards false positive too.

[marcus-crane]

I've created an issue to track this here: #41

Surprisingly, Windows Defender is picking up the latest installer as malware which wasn't the case with 0.9.4-post2 for example. I'll review the changes in between and see if I can isolate whatever is triggering that reading.

I use the macOS version day to day so I haven't directly reviewed the Windows build for a little while

[marcus-crane]

Following up on this issue, I made a submission to the Windows Defender team as aside from handful of AVs in VirusTotal, v1.0.1 was seemingly quarantined in my Windows VM.

Apparently this is pretty standard since there's a learning period for Windows SmartScreen:

The warning you experienced indicates that the application had not established reputation with the Microsoft Defender Smart Screen Application Reputation feature at that time. We can confirm that the application "october.exe", (SHA256-"c0d25673e712364601b4e1a462e8373a46eba338aefa87960aa49831d33e1c95”) has since established reputation and attempting to download or run the application should no longer show any warnings.

In general, I probably need to invest in a signing certificate for Windows (macOS builds are already signed) in order to establish trust with Windows SmartScreen or else there's a learning process for each release.

The full response from the Windows Defender team is in the linked issue but yeah, I guess time for me to do a crash course in Windows publishing hah

[manikoutai]

As I am not familiar with the github platform, I have opened an issue regarding the fact that I received an error "Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work. This is a stub.".

Was it ok to open an issue, or should I have simply post a comment here?

[marcus-crane]

Ah yeah, you should open an issue so I can track it easily. Can you also include what platform you're running on?

[manikoutai]

Issue #40 was actually created 15 minutes before I post a comment here. You should have received a notification earlier.

[marcus-crane]

Ah ok, I'll have a look later today since I'm at work currently. Generally I try not to look at side projects during the day but the VirusTotal issue is something I wanted to address.