feat: embed canonical branded DIG icon in Windows binaries (#2917)

.github/workflows/ci.yml

@@ -237,3 +237,18 @@ jobs:
       # by hand at each call site.
       - name: Workspace dependency versions track the workspace version
         run: bash scripts/check-workspace-dep-versions.sh
+
+  # The vendored branded icon is byte-pinned; see scripts/check-icon.sh for why
+  # drift is made loud rather than impossible. Cheap and dependency-free, so it
+  # runs as its own job and reports independently of the compile gates.
+  icon:
+    name: icon asset (sha256 pin)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      # Invoked through `bash` rather than relying on the file mode: a checkout
+      # that loses the executable bit would otherwise fail this gate for a
+      # reason that has nothing to do with the icon.
+      - run: bash scripts/check-icon.sh

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project are documented here.
 This project adheres to [Semantic Versioning](https://semver.org) and
 [Conventional Commits](https://www.conventionalcommits.org).
 
+## [Unreleased]
+
+### Features
+- **icon:** Embed the canonical branded DIG icon in `digs`/`dig-store`, `dig-resolver` and `dighost` on Windows, gated on a vendored sha256 pin (#2917)
+
 ## [0.29.6] - 2026-09-06
 
 ### Bug Fixes

Cargo.toml

@@ -5,7 +5,7 @@ exclude = ["crates/digstore-prover/guest", "crates/dig-client-wasm"]
 
 [workspace.package]
 edition = "2021"
-version = "0.29.9"
+version = "0.29.10"
 license = "GPL-2.0-only"
 
 [workspace.dependencies]
@@ -28,17 +28,17 @@ license = "GPL-2.0-only"
 # The version MUST equal `[workspace.package].version`, because every member inherits
 # that value. `scripts/check-workspace-dep-versions.sh` enforces it in CI, so a release
 # bump can never silently leave a published crate pointing at the previous version.
-digstore-core = { path = "crates/digstore-core", version = "0.29.9" }
-digstore-chain = { path = "crates/digstore-chain", version = "0.29.9" }
-digstore-chunker = { path = "crates/digstore-chunker", version = "0.29.9" }
-digstore-crypto = { path = "crates/digstore-crypto", version = "0.29.9" }
-digstore-store = { path = "crates/digstore-store", version = "0.29.9" }
-digstore-prover = { path = "crates/digstore-prover", version = "0.29.9" }
-digstore-host = { path = "crates/digstore-host", version = "0.29.9" }
-digstore-stage = { path = "crates/digstore-stage", version = "0.29.9" }
-digstore-remote = { path = "crates/digstore-remote", version = "0.29.9" }
-digstore-cli = { path = "crates/digstore-cli", version = "0.29.9" }
-digstore-subscription = { path = "crates/digstore-subscription", version = "0.29.9" }
+digstore-core = { path = "crates/digstore-core", version = "0.29.10" }
+digstore-chain = { path = "crates/digstore-chain", version = "0.29.10" }
+digstore-chunker = { path = "crates/digstore-chunker", version = "0.29.10" }
+digstore-crypto = { path = "crates/digstore-crypto", version = "0.29.10" }
+digstore-store = { path = "crates/digstore-store", version = "0.29.10" }
+digstore-prover = { path = "crates/digstore-prover", version = "0.29.10" }
+digstore-host = { path = "crates/digstore-host", version = "0.29.10" }
+digstore-stage = { path = "crates/digstore-stage", version = "0.29.10" }
+digstore-remote = { path = "crates/digstore-remote", version = "0.29.10" }
+digstore-cli = { path = "crates/digstore-cli", version = "0.29.10" }
+digstore-subscription = { path = "crates/digstore-subscription", version = "0.29.10" }
 
 sha2 = "0.10"
 proptest = "1"

assets/dig.rc

@@ -0,0 +1,18 @@
+// Windows resource script for digs (dig-store / digs, dig-resolver, dighost).
+//
+// Windows shows the LOWEST-ORDINAL icon resource as an executable's icon in
+// Explorer, the taskbar and the Alt-Tab switcher, so the branded DIG mark must
+// be ordinal 1 and must stay the only ICON statement in this file.
+//
+// `dig.ico` is the canonical, byte-pinned DIG icon (10 frames: 16/20/24/32/40/
+// 48/64/96/128/256, with hardened alpha at <=32 so the D's counter does not
+// bleed shut at taskbar size). It is vendored verbatim and gated on its sha256
+// by `scripts/check-icon.sh` — never re-save or "optimize" it, as any rewrite
+// changes the hash and breaks the gate in this repo and in every sibling repo
+// that vendors the same bytes.
+//
+// Deliberately NOT declared here: an RT_MANIFEST resource. None of this repo's
+// branded binaries embed a manifest, and declaring one in the .rc would collide
+// with a manifest embedded elsewhere via the linker (CVT1100/LNK1123).
+
+1 ICON "dig.ico"

crates/dig-resolver/Cargo.toml

@@ -9,6 +9,9 @@ description = "Resolve a DIG store's current (tip) root from coinset.org by walk
 name = "dig-resolver"
 path = "src/main.rs"
 
+[target.'cfg(windows)'.build-dependencies]
+embed-resource = "3"
+
 [dependencies]
 digstore-chain = { workspace = true }
 chia-protocol = "0.36.1"

crates/dig-resolver/build.rs

@@ -0,0 +1,26 @@
+//! Build script: compile the branded DIG icon into `dig-resolver`.
+//!
+//! `embed_resource::compile` links the compiled `.res` with
+//! `cargo:rustc-link-arg-bins`, which reaches every bin this crate ships —
+//! here, just `dig-resolver` — so no `compile_for` scoping is needed.
+//!
+//! The result is checked rather than discarded: an environment that cannot
+//! compile a resource would otherwise silently produce an unbranded binary,
+//! which is precisely the failure this build step exists to prevent.
+//!
+//! No-op on non-Windows.
+
+fn main() {
+    #[cfg(windows)]
+    embed_icon();
+}
+
+#[cfg(windows)]
+fn embed_icon() {
+    embed_resource::compile("../../assets/dig.rc", embed_resource::NONE)
+        .manifest_required()
+        .expect("failed to compile assets/dig.rc — no usable Windows resource compiler?");
+
+    println!("cargo:rerun-if-changed=../../assets/dig.rc");
+    println!("cargo:rerun-if-changed=../../assets/dig.ico");
+}

crates/digstore-cli/Cargo.toml

@@ -24,6 +24,9 @@ path = "src/bin/digs.rs"
 name = "digstore_cli"
 path = "src/lib.rs"
 
+[target.'cfg(windows)'.build-dependencies]
+embed-resource = "3"
+
 [dependencies]
 digstore-core = { workspace = true }
 digstore-chain = { workspace = true }

crates/digstore-cli/build.rs

@@ -0,0 +1,28 @@
+//! Build script: compile the branded DIG icon into `dig-store` and `digs`.
+//!
+//! `embed_resource::compile` links the compiled `.res` with
+//! `cargo:rustc-link-arg-bins`, so it reaches every `[[bin]]` this crate ships
+//! (`dig-store` AND its `digs` alias) without needing `compile_for`. This crate
+//! also has a `digstore_cli` lib target, but `-bins` link args never touch a
+//! lib, so the library build is unaffected.
+//!
+//! The result is checked rather than discarded: an environment that cannot
+//! compile a resource would otherwise silently produce an unbranded binary,
+//! which is precisely the failure this build step exists to prevent.
+//!
+//! No-op on non-Windows.
+
+fn main() {
+    #[cfg(windows)]
+    embed_icon();
+}
+
+#[cfg(windows)]
+fn embed_icon() {
+    embed_resource::compile("../../assets/dig.rc", embed_resource::NONE)
+        .manifest_required()
+        .expect("failed to compile assets/dig.rc — no usable Windows resource compiler?");
+
+    println!("cargo:rerun-if-changed=../../assets/dig.rc");
+    println!("cargo:rerun-if-changed=../../assets/dig.ico");
+}

crates/digstore-host/Cargo.toml

@@ -5,6 +5,9 @@ version.workspace = true
 edition = "2021"
 description = "wasmtime runtime for serving compiled Digstore WASM modules (paper 6.3, 6.4, 18)."
 
+[target.'cfg(windows)'.build-dependencies]
+embed-resource = "3"
+
 [dependencies]
 digstore-core = { workspace = true }
 digstore-crypto = { workspace = true }