Add verified official firmware downloads

CHANGELOG.md

@@ -5,9 +5,16 @@ All notable changes to Touch Manager will be documented here. The project follow
 
 ## Unreleased
 
+### Added
+
+- On-demand, checksum-verified downloads for licensed official firmware.
+- Content-addressed firmware cache in the application data directory.
+- Curated community-directory and upstream-source links opened in the system browser.
+- Official firmware redistribution notices.
+
 ### Planned
 
-- Signed remote catalog and content-addressed firmware cache.
+- Signed remote catalog updates.
 - Maintained firmware builds with the TouchLink update protocol.
 - Signed and notarized release automation.
 - Windows and Linux hardware packaging.

README.md

@@ -12,9 +12,10 @@ BOOT/RESET recovery path.
 > connected during an installation and retain a known-good firmware binary. Automated
 > tests never write to a connected device.
 
-## What works in 0.1
+## What works in 0.2
 
 - Bundled metadata for 23 official and community Touch 2 instruments.
+- On-demand downloading and verified local caching for redistributable official firmware.
 - Searchable firmware library with trust, provenance, target, and checksum information.
 - Raw `.bin` import and local Cortex-M vector-table analysis.
 - SHA-256, size, Thumb-vector, stack-pointer, and execution-layout validation.
@@ -38,9 +39,14 @@ Apple-notarized, so first launch may require Control-clicking the app, choosing
 or approving it in **System Settings → Privacy & Security**. Install `dfu-util` with
 `brew install dfu-util` before writing firmware.
 
-Release builds contain the firmware catalog but do not redistribute upstream firmware
-binaries. Users can import a `.bin` directly or provide the Synthux firmware workspace
-described below.
+Release builds can download the eight official firmware binaries whose upstream MIT
+licenses permit redistribution. Every download is checked against its catalog SHA-256 and
+target profile before it enters the local cache. TouchBass 1.0.2 remains source-only until
+its upstream repository includes a redistribution license.
+
+Community entries link to their upstream source and the
+[community-maintained Simple Touch 2 directory](https://github.com/Synthux-Academy/awesome-synthux#simple-touch-2),
+rather than mirroring binaries with unspecified licenses.
 
 ## Safety model
 
@@ -75,11 +81,11 @@ Frontend-only preview:
 npm run dev
 ```
 
-## Firmware workspace
+## Optional firmware workspace
 
-Firmware binaries are intentionally not copied into this repository. The bundled catalog
-contains metadata, approved target profiles, paths, and SHA-256 values. At runtime the app
-resolves artifacts from a Synthux workspace containing `Firmware/SHA256SUMS.txt`.
+Developers can additionally resolve staged binaries from a Synthux workspace containing
+`Firmware/SHA256SUMS.txt`. Normal users do not need this workspace to download the eight
+licensed official releases or import their own `.bin` file.
 
 Resolution order:
 

docs/OFFICIAL_FIRMWARE_NOTICES.md

@@ -0,0 +1,60 @@
+# Official firmware notices
+
+The official firmware binaries distributed through Touch Manager remain the work of
+their upstream authors. Touch Manager verifies their published SHA-256 values before
+making them available for installation.
+
+## Audrey Touch
+
+Source: <https://github.com/Synthux-Academy/AudreyTouch>
+
+MIT License
+
+Copyright (c) 2022 Infrasonic Audio, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the "Software"), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or
+substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+## Simple Touch instruments
+
+Applies to TouchBass Classic, TouchString, TouchFX, TouchDrone, TouchDrumMachine,
+TouchLooper, and TouchSlicer.
+
+Source: <https://github.com/Synthux-Academy/simple-touch-instruments>
+
+Copyright 2024 Stichting PTM Academy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the “Software”), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or
+substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+## TouchBass 1.0.2
+
+TouchBass 1.0.2 is listed in the catalog as official, but its current upstream repository
+does not contain a redistribution license. Touch Manager therefore links to its source
+and does not mirror or download that binary.

package.json

@@ -1,11 +1,17 @@
 {
   "name": "touch-manager",
   "private": true,
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A safe firmware library, installer, and diagnostic console for Synthux Touch 2.",
   "license": "MIT",
   "author": "Ali Bross",
-  "keywords": ["synthux", "touch-2", "firmware", "dfu", "tauri"],
+  "keywords": [
+    "synthux",
+    "touch-2",
+    "firmware",
+    "dfu",
+    "tauri"
+  ],
   "engines": {
     "node": ">=20.19"
   },
@@ -21,6 +27,7 @@
   "dependencies": {
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-opener": "^2.5.4",
     "lucide-react": "^0.468.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"