BoltClam 1.0.0: ClamAV desktop protection with Bolt sign-in

Adds the PyQt6 Windows client (Homepage, Scan & results, About & updates, Settings), ClamAV scanning and quarantine, browser-download watch with an exclusive scan gate, Bolt loopback/PKCE sign-in with DPAPI key storage, Gitea release feed with checksum verification, opt-in diagnostics, and Windows/portable build tooling. Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-10-25 16:21:14 -06:00
commit addd00364d
76 changed files with 12503 additions and 0 deletions
@@ -0,0 +1,85 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [string]$Tag = "",
+    [string]$Token = ""
+)
+
+$ErrorActionPreference = "Stop"
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+$repo = $env:GITHUB_REPOSITORY
+if (-not $repo) { $repo = "TheMajesticNetwork/BoltClam" }
+$server = $env:GITHUB_SERVER_URL
+if (-not $server) { $server = "https://git.themajesticnetwork.com" }
+$server = $server.TrimEnd("/")
+$api = "$server/api/v1/repos/$repo"
+
+if (-not $Tag) {
+    $Tag = $env:GITHUB_REF_NAME
+}
+if (-not $Tag) { $Tag = "v1.0.0" }
+if (-not $Token) { $Token = $env:GITEA_TOKEN }
+if (-not $Token) { $Token = $env:GITHUB_TOKEN }
+if (-not $Token) {
+    throw "Set GITEA_TOKEN (a Gitea token with repo write access) before publishing."
+}
+
+$headers = @{
+    Authorization = "token $Token"
+    Accept = "application/json"
+}
+$releaseBody = @{
+    tag_name = $Tag
+    name = "BoltClam $Tag"
+    body = "BoltClam $Tag`n`nSee SHA256SUMS.txt for checksums."
+    draft = $false
+    prerelease = ($Tag -match "-")
+} | ConvertTo-Json
+
+try {
+    $release = Invoke-RestMethod -Method Post -Uri "$api/releases" `
+        -Headers $headers -ContentType "application/json" -Body $releaseBody
+    Write-Host "Created release $($release.tag_name)"
+} catch {
+    $status = $_.Exception.Response.StatusCode.value__
+    if ($status -ne 409) { throw }
+    $release = Invoke-RestMethod -Uri "$api/releases/tags/$Tag" -Headers $headers
+    Write-Host "Release $Tag already exists; adding assets"
+}
+
+$existing = @()
+try {
+    $existing = @(Invoke-RestMethod -Uri "$api/releases/$($release.id)/assets" -Headers $headers)
+} catch {
+    $existing = @()
+}
+foreach ($asset in $existing) {
+    if ($asset.name -match '^BoltClam-.*\.(exe|zip)$' -or $asset.name -eq "SHA256SUMS.txt") {
+        Invoke-RestMethod -Method Delete `
+            -Uri "$api/releases/$($release.id)/assets/$($asset.id)" -Headers $headers | Out-Null
+        Write-Host "Removed old asset $($asset.name)"
+    }
+}
+
+$files = Get-ChildItem -Path (Join-Path $Root "dist") -File | Where-Object {
+    $_.Name -match '^BoltClam-.*\.(exe|zip)$' -or $_.Name -eq "SHA256SUMS.txt"
+}
+if (-not $files) { throw "No release artifacts found in dist." }
+
+foreach ($file in $files) {
+    $name = [uri]::EscapeDataString($file.Name)
+    # Gitea's attachment endpoint is multipart/form-data, unlike GitHub's
+    # binary upload. Windows 10/11 ships curl.exe; use it for the file field.
+    & curl.exe --fail --silent --show-error -X POST `
+        -H "Authorization: token $Token" `
+        -F "attachment=@$($file.FullName)" `
+        "$api/releases/$($release.id)/assets?name=$name"
+    if ($LASTEXITCODE -ne 0) {
+        throw "Upload failed for $($file.Name)."
+    }
+    Write-Host "Uploaded $($file.Name)"
+}
+
+Write-Host "Release published: $($release.html_url)"