Ashigaru Desktop 1.4.5

*Released 2026-09-07*

Everything since 1.1.2. Versions 1.3.0, 1.4.0 and 1.4.1 exist in the repository but were never announced, so this covers the whole span in one document - a guided tour and dice-based passphrases, hardening of how Dojo nodes are verified, a Logs tool, in-app update checking, and a typeface of its own.

You will need to download this one by hand. In-app updating did not exist before 1.3.0, so if you are on 1.1.2 there is nothing to check for it. And 1.3.0's updater cannot reach GitHub at all - see the first item below - so it will not find this release either. From 1.4.5 onward, in-app updates work.

Connectivity

• Published builds could not make an HTTPS connection. Anything reaching a normal https://

address failed with Received fatal alert: handshake_failure - the update check most visibly, but the cause was general. The packaged runtime is assembled with jlink, and it was being built without jdk.crypto.ec, the module providing the SunEC security provider. SunEC is a *service* provider, so nothing in the module graph requires it and jlink had no reason to include it. Without it the runtime cannot complete the elliptic-curve key exchange that essentially every modern server needs.

Two things hid it. Onion addresses were unaffected, since onion HTTP is not TLS, so mixing, fee rates and server connections all kept working. And running from source was unaffected, because that uses the full JDK - the fault only ever existed in the builds published here.

Updates

• Ashigaru checks for new releases. A new Settings Update screen shows the version you

are running and the latest published release, and can check on demand or once a day. Checking is off until you say yes: you are asked once, on first run, and the request goes through your proxy when one is configured. It reveals only that someone asked for a version number, never anything about your wallets.

• Downloads are verified before you are offered them. Choosing an update fetches it and then

checks four things in order, showing each as it passes: the release message was signed by the Ashigaru release key, the published checksums match what that signed message commits to, the release is the one being offered and is newer than the one you run, and the file you downloaded matches its published checksum. These are the same checks the README asks you to perform by hand.

• A failed check deletes the download. If any link in that chain does not hold, the file is

removed rather than left somewhere it could be opened by accident, and the screen says which check failed. A release published without its signature is refused outright rather than trusted.

• Then you install it. Ashigaru does not update itself. On Windows and macOS it hands the

verified file to the system installer and steps aside; on Linux it shows you the file, since package installs need root and the right format depends on your distribution. The package matching how you installed is preselected, with the rest available if the guess is wrong.

• The portable Windows build is offered. The updater only ever offered .exe and .msi, so

anyone running the portable .zip was shown an installer instead of the build they actually use.

Getting started

• Guided tour. A new in-app tour walks you through the app by pointing at the real controls -

the wallet selector, opening and creating wallets, your balance and accounts, receiving, mixing, and the Settings screens. It appears on first launch and is available any time from Tools Guided Tour, so you can replay it whenever you like.

• The tour waits for you. Start it before you have a wallet and it covers what it can, then

picks up automatically with the wallet-specific steps as soon as you open your first wallet.

• Every step looks the same, and Back works. The tour bubbles took on the styling of whatever

control they happened to point at, so the "Your balance" step rendered oversized and the Settings steps came out a different colour from the rest. Each bubble is now styled in its own right, independent of where it is anchored, and stepping back through the tour behaves.

Creating a wallet

• Dice-first passphrase creation. When adding a passphrase to a new wallet, Ashigaru can now

walk you through generating one with physical dice, using the EFF large wordlist. Rolling real dice takes the entropy out of the computer's hands entirely - useful if you would rather not trust software randomness for the one secret that is never written to your wallet file.

• Weak-passphrase warning. The passphrase step now tells you when what you have typed is weak,

at the point where you can still do something about it.

• Dice passphrases are joined with dashes. A rolled passphrase reads

abandon-ability-able-... rather than using spaces. The passphrase has to be copied off the screen by hand and typed back in later, possibly into another wallet, and a space is the one separator you cannot verify you reproduced: one space or two look identical on paper, and a trailing one is invisible. The advisory now says the dashes are part of the passphrase, and explains that the master fingerprint is how you check you typed it back correctly.

Existing wallets are unaffected - you type your own passphrase when restoring, and nothing re-derives it.

• The setup dialogs are the right size again. Every step of + New / Restore had grown far

taller than its content, in some cases running off the bottom of the screen with the second option out of reach. They size to their content properly now.

Dojo discovery and security

• Signatures are verified before Ashigaru authenticates. Discovery previously authenticated to

every reachable Dojo - spending its apikey and building an onion circuit - and only checked the signed block afterwards. Verification is pure local cryptography with no network I/O, so it now happens first: only listings whose signature verifies are contacted at all.

• Signed identity is bound to the advertised payment code. A valid signature on its own only

proves a block is self-consistent. Without binding, a hostile directory could display an honest operator's identity while embedding a block validly signed by the attacker's own payment code. Verification now requires the advertised payment code to resolve to the same notification address as the embedded one.

• Simpler, quieter discovery. Per-Dojo /auth/login and /support/services authentication is

gone, along with the thread pool, per-node timeouts, version gate and reachability probe. The only network request is the single directory fetch; the indexer endpoint is taken from the directory listing directly.

• Discovered servers are ephemeral. Dojo Electrum servers and explorers are now cleared at

shutdown and again at startup, and repopulated by a fresh, verified discovery once you connect. Stale or removed nodes no longer linger, and their onion addresses are not left on disk while the app is closed.

Mixing

• Deleting a wallet stops its mixing. The Whirlpool engine for a deleted wallet was left running

indefinitely, against a wallet file that no longer existed, with no way to see it or stop it again

• and without unlinking it from any other wallet that had it configured as a Mix To

destination. Deleting a wallet now shuts its engine down and clears those links. Locking a wallet is deliberately unchanged: remixing continues while a wallet is locked, so the anonymity set keeps building.

• The mixing button no longer sticks. Start/Stop Mixing could sit on "Starting..." or "Stopping..."

indefinitely - most easily by starting a mix with nothing currently eligible, or after a start that failed. It now follows the mixing state directly rather than waiting for an event that may never arrive, and recovers on its own.

• Fewer Tor circuit rotations. A sustained coordinator outage used to force a new Tor circuit on

every single failed connection. Ashigaru now changes identity on the first failure and then every third, resetting once a connection succeeds.

• Accurate retry logging. During a coordinator outage, mix sessions reported their retry delay

in milliseconds while labelling it seconds - "retrying in 90000s". The delay itself was always correct; now the log says so too.

Startup

• A second launch no longer starts a second Ashigaru. Opening the app while it was already

running started a whole second process. Both then pointed Tor at the same data directory, which Tor refuses - It looks like another Tor process is running with the same data directory - and the second window died during startup. Launching again now brings the running window to the front and exits, which is what it always appeared to do. Opening a .psbt or a bitcoin: link while Ashigaru is running is unchanged.

• The window opens where you can reach it. The title bar could land above the top of the screen,

leaving no way to click minimise or maximise without dragging the window down first. It is now pulled inside the usable area of whichever screen it opens on.

• The splash reports real progress. It used to show a bar that spun regardless and one of four

fixed messages. It now follows the startup as it happens - Tor, then the server connection, then wallet loading - marking each step as it completes, and moving with Tor's own reported percentage during bootstrap. A Tor bootstrap that fails or a server that cannot be reached is marked failed with the reason kept on screen, rather than leaving a bar spinning until something times out.

Tools

• Logs. A new Tools Logs screen shows recent application activity without leaving the

app. Filter to warnings or errors, or search the text; either way stack traces stay attached to the entry they belong to rather than being cut in half.

• Safe to share. Bitcoin addresses, extended public keys, BIP47 payment codes, transaction ids,

onion hostnames, derivation paths and the names of your open wallets are replaced with placeholders before anything is shown. That is the default, so the text you are looking at is already the text that is safe to send. A Show raw log toggle turns redaction off and tells you what it exposes.

• Built for bug reports. Copy and Save emit exactly what is on screen, with a short

header carrying the version, operating system, Java version, network and whether a proxy is active - the things a developer asks for first, and nothing about your wallets. Open Folder takes you to the log directory if you would rather handle the file yourself.

• The BIP47 verifier takes a PayNym handle. Enter +linkinparkrulz and press Look up to

fill in the payment code, instead of pasting 116 characters from somewhere. The lookup goes over Tor when it is configured, runs only when you press the button, and shows the name it resolved rather than changing the field silently. For checking an Ashigaru release, Use Release Signing Code remains the button to press - it uses the code compiled into the app and depends on nothing external. The payment code field is a single line rather than a three-row box.

• The sidebar reads Guided Tour, Verifier, Statistics and Logs, so the four entries scan as a list.

Settings

• The settings file can no longer be left half written. config was saved by truncating it and

writing over the top, so a crash - or a second process writing at the same moment - could leave it cut off mid-value. Ashigaru would then fail to read it at the next start, fall back to defaults, and overwrite it, losing every setting. It is now written alongside the real file and moved into place in one step.

• An unreadable settings file is kept as config.corrupt-<date> rather than silently

overwritten, with the log naming the path, so the settings can still be recovered by hand.

Appearance

• A typeface of its own. Ashigaru is set in Nikkyou Sans, a display face drawn from wartime

propaganda poster lettering. Anything that has to line up or be read character by character - amounts, addresses, transaction ids, the log view, typed input - stays monospaced.

• The icons are drawn. None of the Font Awesome icons in the app were rendering: the fonts ship

with the application but were never registered as providers of the glyph service, so every icon that asked for one came out as empty space. Separately, the Statistics icon had been drawn from an older icon set whose character position is empty in the font actually loaded. Both are fixed, so the sidebars, buttons and status indicators show their icons.

• Text wraps instead of disappearing. Wizard subtitles, body copy and hints, the public-server

warning in Server Settings, and the help text behind every ? were clipping to an ellipsis or running off the side of the screen rather than wrapping. They now show in full at any window size.

• Bundled fonts are attributed. Roboto Mono and the two Font Awesome faces had shipped inside

every release without appearing in THIRD_PARTY_NOTICES.md, though both licences ask for their notices to travel with the binaries. They are recorded now, along with the new typeface.

this release and it was never actually built - Fedora, RHEL and openSUSE users were quietly left with the tarball. Both the desktop and headless builds now produce one.

• .msi installers are published. Same story on Windows: advertised, never built. The .exe

installer remains the recommended route, with the .msi alongside it.

• Both Linux tarballs ship. The desktop and headless Linux builds were producing tarballs with

the same filename, so only one of the two ever reached the release page. The headless build is now published as Ashigaru-server-..., matching the naming already used for its .deb and .rpm packages.

• The Linux launcher shows its icon. The desktop entry asked for the icon by bare name, which

only resolves if the icon has been installed into the system icon theme - it is not, so app