fix: make branded icon generation deterministic

README.md

@@ -232,6 +232,7 @@ Each vault is connected separately. The local vault remains the primary copy of
 * Node.js 20 or newer with npm;
 * Python 3;
 * Git;
+* ImageMagick (`magick`) to generate the branded tray and application icons;
 * Wails v2 build dependencies;
 * WebKitGTK development packages on Linux.
 

README.ru.md

@@ -232,6 +232,7 @@ sha256sum -c SHA256SUMS --ignore-missing
 * Node.js 20 или новее и npm;
 * Python 3;
 * Git;
+* ImageMagick (`magick`) для генерации фирменных значков трея и приложения;
 * зависимости для сборки Wails v2;
 * пакеты разработки WebKitGTK в Linux.
 

internal/shell/tray/icon_linux_test.go

@@ -2,7 +2,13 @@
 
 package tray
 
-import "testing"
+import (
+	"bytes"
+	"image"
+	"image/color"
+	_ "image/png"
+	"testing"
+)
 
 func TestDefaultIconUsesPlatformResource(t *testing.T) {
 	icon := DefaultIcon()
@@ -15,4 +21,23 @@ func TestDefaultIconUsesPlatformResource(t *testing.T) {
 	if string(icon[:8]) != "\x89PNG\r\n\x1a\n" {
 		t.Fatal("DefaultIcon() is not PNG data on Linux")
 	}
+	assertVerstakBrand(t, icon)
+}
+
+func assertVerstakBrand(t *testing.T, icon []byte) {
+	t.Helper()
+	image, _, err := image.Decode(bytes.NewReader(icon))
+	if err != nil {
+		t.Fatalf("decode tray icon: %v", err)
+	}
+
+	want := color.NRGBA{R: 0x1c, G: 0x2f, B: 0x4a, A: 0xff}
+	for y := image.Bounds().Min.Y; y < image.Bounds().Max.Y; y++ {
+		for x := image.Bounds().Min.X; x < image.Bounds().Max.X; x++ {
+			if color.NRGBAModel.Convert(image.At(x, y)) == want {
+				return
+			}
+		}
+	}
+	t.Fatal("tray icon does not contain the Verstak navy brand color")
 }

release-notes/v0.1.0-alpha.6.md

@@ -0,0 +1,27 @@
+## Highlights
+
+- Replaced the generic Wails image in the Linux tray and Windows application
+  resources with the current Verstak workbench icon.
+- The desktop build now generates its PNG and multi-resolution ICO resources
+  from the committed Verstak SVG before packaging, preventing a generic icon
+  from returning in a clean build.
+- The Windows ICO contains 16, 20, 24, 32, 48, and 256 pixel variants; Linux
+  uses the matching transparent PNG tray image.
+
+## Главное
+
+- Стандартный знак Wails в Linux-трее и ресурсах Windows заменён на актуальный
+  фирменный значок Верстака.
+- Перед упаковкой desktop-сборка создаёт PNG и многомасштабный ICO из SVG,
+  хранящегося в репозитории. Это не позволяет стандартному значку вернуться в
+  чистой сборке.
+- Windows ICO содержит варианты 16, 20, 24, 32, 48 и 256 пикселей; Linux
+  использует соответствующий прозрачный PNG для трея.
+
+## Packages / Пакеты
+
+This prerelease provides a portable Windows archive, a Debian package, and an
+AppImage for Linux.
+
+В этот prerelease входят переносимый архив для Windows, Debian-пакет и AppImage
+для Linux.

release-notes/v0.1.0-alpha.7.md

@@ -0,0 +1,22 @@
+## Highlights
+
+- Made branded tray and application icon generation deterministic: repeated
+  local builds no longer leave timestamp-only changes in the working tree.
+- The packaging checks now verify that all PNG and ICO icon outputs are stable
+  across consecutive generations.
+
+## Главное
+
+- Генерация фирменных значков трея и приложения стала детерминированной:
+  повторная локальная сборка больше не оставляет в рабочем дереве изменения,
+  отличающиеся только временной меткой.
+- Проверки упаковки теперь убеждаются, что PNG и ICO остаются одинаковыми при
+  последовательных генерациях.
+
+## Packages / Пакеты
+
+This prerelease provides a portable Windows archive, a Debian package, and an
+AppImage for Linux.
+
+В этот prerelease входят переносимый архив для Windows, Debian-пакет и AppImage
+для Linux.

scripts/build-windows.sh

@@ -35,6 +35,8 @@ fi
 cd "$ROOT"
 echo "=== verstak desktop Windows amd64 build ==="
 
+"$ROOT/scripts/generate-brand-icons.sh"
+
 if [[ ! -d "$ROOT/frontend/node_modules" ]]; then
   if [[ -f "$ROOT/frontend/package-lock.json" ]]; then
     (cd "$ROOT/frontend" && npm ci --no-audit --no-fund)

scripts/build.sh

@@ -6,6 +6,8 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 echo "=== verstak-desktop build ==="
 echo ""
 
+"$ROOT/scripts/generate-brand-icons.sh"
+
 # ── Dependency checks ──
 echo "[deps]"
 if ! command -v go &>/dev/null; then

scripts/generate-brand-icons.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+MAGICK="${MAGICK_BIN:-magick}"
+SOURCE="$ROOT/packaging/linux/verstak.svg"
+
+if ! command -v "$MAGICK" >/dev/null; then
+  echo "ImageMagick is required to generate Verstak application icons: $MAGICK not found" >&2
+  exit 1
+fi
+if [[ ! -f "$SOURCE" ]]; then
+  echo "Verstak SVG icon source is missing: $SOURCE" >&2
+  exit 1
+fi
+
+render_png() {
+  local size="$1"
+  local target="$2"
+  mkdir -p "$(dirname "$target")"
+  "$MAGICK" -background none "$SOURCE" -resize "${size}x${size}" -strip "PNG32:$target"
+}
+
+render_ico() {
+  local target="$1"
+  shift
+  local temporary
+  temporary="$(mktemp -d)"
+  local images=()
+  for size in "$@"; do
+    local image="$temporary/${size}.png"
+    render_png "$size" "$image"
+    images+=("$image")
+  done
+  mkdir -p "$(dirname "$target")"
+  "$MAGICK" "${images[@]}" "$target"
+  rm -rf "$temporary"
+}
+
+render_png 256 "$ROOT/internal/shell/tray/verstak.png"
+render_ico "$ROOT/internal/shell/tray/verstak.ico" 16 20 24 32 48 256
+
+# Wails consumes this PNG while it prepares the Windows executable resources.
+# Both files are generated build inputs and therefore deliberately ignored by Git.
+render_png 1024 "$ROOT/build/appicon.png"
+render_ico "$ROOT/build/windows/icon.ico" 16 32 48 64 128 256
+
+echo "generated Verstak tray and application icons from $SOURCE"

scripts/test-brand-icons.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ICONS=(
+  "$ROOT/internal/shell/tray/verstak.png"
+  "$ROOT/internal/shell/tray/verstak.ico"
+  "$ROOT/build/appicon.png"
+  "$ROOT/build/windows/icon.ico"
+)
+
+"$ROOT/scripts/generate-brand-icons.sh"
+first="$(sha256sum "${ICONS[@]}")"
+"$ROOT/scripts/generate-brand-icons.sh"
+second="$(sha256sum "${ICONS[@]}")"
+
+if [[ "$first" != "$second" ]]; then
+  echo "brand icon generation is not deterministic" >&2
+  exit 1
+fi
+
+echo "desktop brand icon generation is deterministic"

scripts/test-package-formats.sh

@@ -53,6 +53,9 @@ grep -Fq 'LinkId=2124701' "$ROOT/README.md"
 grep -Fq 'WebView2 Runtime' "$ROOT/README.md"
 grep -Fq 'package-deb.sh' "$ROOT/scripts/release.sh"
 grep -Fq 'package-appimage.sh' "$ROOT/scripts/release.sh"
+grep -Fq 'generate-brand-icons.sh' "$ROOT/scripts/build.sh"
+grep -Fq 'generate-brand-icons.sh' "$ROOT/scripts/build-windows.sh"
+test -x "$ROOT/scripts/test-brand-icons.sh"
 grep -Fq 'package-windows-portable.sh' "$ROOT/scripts/release.sh"
 git -C "$ROOT" check-ignore -q verstak-desktop-res.syso
 grep -Fq 'chmod -R a+rX' "$ROOT/scripts/build-linux-bundle.sh"

scripts/test.sh

@@ -39,6 +39,10 @@ OUTPUT=$(cd "$ROOT" && go test -count=1 -v ./... 2>&1) || GO_TEST_STATUS=$?
 echo "$OUTPUT" | grep -E '(FAIL|PASS|---)' || true
 report "go test" "$GO_TEST_STATUS"
 
+BRAND_ICONS_STATUS=0
+(cd "$ROOT" && ./scripts/test-brand-icons.sh) || BRAND_ICONS_STATUS=$?
+report "desktop brand icon generation" "$BRAND_ICONS_STATUS"
+
 WAILS_BINDINGS_STATUS=0
 (cd "$ROOT" && node frontend/tests/wails-bindings-test.mjs) || WAILS_BINDINGS_STATUS=$?
 report "Wails notification bindings" "$WAILS_BINDINGS_STATUS"