diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f0603b3..caa54cd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,7 +9,7 @@ # - Environment `release` (Settings -> Environments) with a deployment rule that allows # only tags matching v*. # - Configure verified Azure signing variables and a repository/environment-bound -# OIDC identity; pin the published reviewed builder, enable sign and declare +# OIDC identity; pin the reviewed builder, enable sign and declare # the owned-file catalog. See docs/release-signing.md. Unsigned publication is blocked. # - winget (optional, stable releases only): the package must already exist in # microsoft/winget-pkgs. Submit it once by hand with @@ -95,7 +95,7 @@ jobs: release: needs: [verify, gates, security, codeql, scripts, fuzzing] - uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@fdf5ed029603c938615a32b1beca3628b8787945 # v0.1.2 + uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@93b1d6163a4c466ae443e98b62786fc4d80d33bd # v1.1.0 permissions: contents: write # create and publish the GitHub release id-token: write # sign attestations; Azure OIDC when signing @@ -112,7 +112,14 @@ jobs: coverage-packages: MarkdownViewr.Windows.Core test-projects: | tests/MarkdownViewr.Windows.Core.Tests - sign: false # Preflight blocks publication until the reviewed signing builder is published and configured. + sign: true + signing-files: | + app/MarkdownViewr.Windows.exe + app/MarkdownViewr.Windows.dll + app/MarkdownViewr.Windows.Core.dll + app/KofTwentyTwo.AppKit.dll + app/KofTwentyTwo.AppKit.Updates.dll + app/KofTwentyTwo.AppKit.WinUI.dll # winget lives here, not in the shared workflow, because its token belongs to this # repository's `release` environment. It runs only for stable releases, and only when diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 1376a53..93ba935 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -1,6 +1,5 @@ # Releasing MarkdownViewr - Releases follow the [KofTwentyTwo release standard](https://github.com/KofTwentyTwo/standards/blob/main/standards/releases.md). Pushing a protected `v*` tag on `main` runs [`.github/workflows/release.yml`](../.github/workflows/release.yml), @@ -8,7 +7,7 @@ which calls the shared `release-velopack.yml` workflow in KofTwentyTwo/standards ## Workflow baseline -Shared workflows are pinned to published standards v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication. +The signing release builder is pinned to standards v1.1.0 (`93b1d6163a4c466ae443e98b62786fc4d80d33bd`); other shared gates retain v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication. The AppKit dependency locks now match the published 0.1.0 packages. Before changing any package version, regenerate the affected locks and verify a locked restore with a clean package cache. ## Versioning and channels diff --git a/docs/SESSION-STATE.md b/docs/SESSION-STATE.md index 8207115..5611cf0 100644 --- a/docs/SESSION-STATE.md +++ b/docs/SESSION-STATE.md @@ -2,6 +2,33 @@ Updated: 2026-10-12 +## Current release status - 2026-10-12 + +Owner explicitly authorizes publication and confirms review/resolved findings for +standards PR31/e3aaed4, PR39/0f46568 and PR41/1e2179a. All are merged. The +reproduced PSScriptAnalyzer metadata race is fixed without dropping rules/tests +or deadlines: 20 fresh-process probes and every hosted signing gate pass. +Standards1.1.0 is published immutably at93b1d6163a4c466ae443e98b62786fc4d80d33bd, +releaseCI38275622522 green. All five asset attestations, checksums and exact +reviewed builder/module/composite bytes verify; evidence remains in AppKit/ +artifacts/standards-1.1.0-93b1d61. Checklist40 shipping proof is prepared. + +The app's final delta enables signing with the published SHA and explicit six-file +catalog. Nine preflight tests, actual protected-variable preflight and workflow +syntax/online security pass. Tested application code remains321816c: current +313d258 acceptance passes published111, stable/dev110 each with zero skips, +actual updates/restarts, registrations, default preservation and coexistence. +Local final installer/portable/update signatures and payload checks pass; +production CI OIDC and 1.0/dev publication still need the release run. + +Keep scope to publication: no redesign, new feature work or repeated unchanged +acceptance runs. Owner previews/profiles remain untouched. Final app review record, +actual Windows OpenSSF URL and prepared inventory PR36 review remain required. +The process-only Scorecard assessment is explicit; no invented badge, reviewer, +90-day history or vulnerability statement. Final caller/docs commit will run the +required unchanged CI; avoid additional commits while it runs unless a real failure +or required owner enrollment result changes the candidate. + ## Azure configured and representative local signatures verified - 2026-10-12 Browser login completes successfully. Authenticated account/ARM readback verifies diff --git a/docs/TODO.md b/docs/TODO.md index 39be480..1ee22be 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -45,8 +45,9 @@ Full product scope remains in PRODUCT.md; unsigned fixtures are not release proo - [ ] Push the renderer correction after the preceding terminal run and verify the extended actual browser case plus all native/published/installed suites. - [ ] Obtain owner acceptance of the toolbar, icon and native Settings layout, including Windows11 scaling. Actual user-selected Default Apps/Open With/Explorer behavior remains unverified; read-only status/registration tests do not replace it. - [ ] Complete remaining reference rendering/extension/image/link fidelity review. Preserve pinned document CSS and the explicit native-pane CSS boundary; representative tests do not certify arbitrary documents or CSS. -- [ ] Obtain the required shared maintainer decisions: standards signing builder PR31, AppKit-only tooling license proposal PR32, inventory PR36 and shared Help PRs AppKit29/windows-app-template4. Prior permission covers draft pushes only. -- [ ] After signing builder31 is reviewed/published, adopt its published full-SHA pin and required six-file signing catalog; preserve fail-closed publication. +- [x] Owner review and release authority supplied for standards signing31, reference correction39 and analyzer fix41; all merged and builder1.1.0 published. +- [ ] Obtain the prepared inventory PR36 human review for registration. AppKit-only tooling license32 and shared Help AppKit29/windows-app-template4 remain separate follow-ups. +- [x] Standards1.1.0 is actually published/verified at93b1d616; final caller enables signing and its required six-file catalog, retaining fail-closed verification. - [x] Authenticated Azure readback verifies actual subscription/tenant, East US endpoint, Active releases/PublicTrust profile and full James Maes subject. Separate secretless CI identity, exact immutable release-environment trust, profile-scoped signer role and all seven protected release variables are configured/read back; existing gclo setup preserved. - [x] Local representative321816c six-binary signing test passes SignTool /pa /all /v and strict SHA256/publisher/trust/timestamp checks; owner previews untouched. - [ ] Prove the new CI identity through the protected release job; verify final installer/archive signatures after adopting the published reviewed builder. diff --git a/docs/azure-signing-admin.md b/docs/azure-signing-admin.md index 60b35fa..4f3d879 100644 --- a/docs/azure-signing-admin.md +++ b/docs/azure-signing-admin.md @@ -190,7 +190,8 @@ verified values through `gh variable set NAME --repo KofTwentyTwo/MarkdownViewr. `AZURE_SUBSCRIPTION_ID`, `ARTIFACT_SIGNING_ENDPOINT`, `ARTIFACT_SIGNING_ACCOUNT`, `ARTIFACT_SIGNING_PROFILE` and `ARTIFACT_SIGNING_SUBJECT` (full subject). -The reviewed/published catalog builder remains a dependency (standards PR#31). +The release caller now uses the reviewed standards v1.1.0 catalog builder; +PRs #31, #39 and #41 provide its implementation and verified CI corrections. Current verified official pins are azure/login@v3.1.0 commit `a641126d1b8aa4d1fa005f4f92df94a3a4c4c906` and azure/artifact-signing-action@v2.0.0 commit diff --git a/docs/release-signing.md b/docs/release-signing.md index 1c19e1f..51ad5b2 100644 --- a/docs/release-signing.md +++ b/docs/release-signing.md @@ -1,10 +1,9 @@ # Windows release signing -Application releases require Authenticode signing. The generated caller starts -with `sign: false` so it remains compatible with its currently published builder, -but its preflight blocks publication until the reviewed signing builder is -published, pinned and configured. The source template's content-only NuGet package -does not contain application binaries and uses a separate release workflow. +Application releases require Authenticode signing. The caller enables `sign: true` +with an explicit six-file ownership catalog and pins the reviewed standards v1.1.0 +builder. Configuration and final-signature checks stop publication on failure. +The source template's content-only NuGet package uses a separate release workflow. ## Configure the protected environment @@ -36,11 +35,10 @@ signing service. Never export a PFX or put administrative passwords in CI. ## Enable the reviewed builder -Pin a published shared builder that supports an explicit `signing-files` catalog -and verifies the final shipped bytes/signatures. Standards v1.0.0 contains gclo's -Velopack signing fix, but lacks this catalog interface; do not enable a partial -path or pin unpublished commits. After the prepared builder is reviewed and -published, update the caller's full commit SHA/version comment and add: +The release caller pins standards v1.1.0 at +`93b1d6163a4c466ae443e98b62786fc4d80d33bd`. Its reviewed builder supports the +explicit ownership catalog and verifies final shipped bytes/signatures. The +configured catalog is: ```yaml sign: true @@ -73,7 +71,8 @@ and the installed SignTool/dlib paths with an authorized identity. MarkdownViewr-specific verified OIDC claims and the precise remaining Azure administrator steps are in [azure-signing-admin.md](azure-signing-admin.md). This repository uses immutable owner/repository IDs in its subject; a copied -name-only trust from gclo would not match. Azure resource/identity/role and protected release variables are verified; the -representative six-binary local signing test passes. CI OIDC and exact final -installer/distribution signing still require the protected release integration. +name-only trust from gclo would not match. Azure resource/identity/role and protected release variables are verified. The +local six-binary and final installer/portable/update-package signing proofs pass. +The new CI identity and production artifacts still require the protected release +run; local administrative signing does not prove CI OIDC. See the administrator runbook for actual evidence and remaining dependencies. diff --git a/docs/security/scorecard-dispositions.md b/docs/security/scorecard-dispositions.md new file mode 100644 index 0000000..09d740a --- /dev/null +++ b/docs/security/scorecard-dispositions.md @@ -0,0 +1,49 @@ +# Scorecard process finding assessment + +Prepared 2026-10-12 for the first Windows release. These findings describe +repository processes; they do not identify an exploitable shipped component. +This assessment does not fabricate a vulnerability waiver, independent reviewer, +90-day maintenance history or a passing Best Practices badge. + +## Single-maintainer review and branch controls + +The owner selected the single-maintainer policy. Approved +[EX-0001](https://github.com/KofTwentyTwo/standards/blob/main/exceptions/register.md#ex-0001) +applies to every KofTwentyTwo repository and records the missing non-author +human approval as an accepted risk, with compensating controls. + +[Code-Review #8](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/security/code-scanning/8) +correctly counts no independently approved changesets. The main ruleset has +no bypass actors, requires PRs, signed commits, linear history, resolved threads +and seventeen Actions-bound checks, including the maintainer-owned automated +review record. The current application PR remains blocked until that actual +record exists; this assessment cannot supply it. + +[Branch-Protection #5](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/security/code-scanning/5) +identifies the same unavailable independent approver, code-owner approval and +last-push approval. Keep the chosen policy and existing controls intact. +Reassess when a second maintainer joins; require independent approval then. +This is an accepted review gap under the existing exception, not maximal +Scorecard protection or proof that every historical change was reviewed. + +## Repository-age finding + +[Maintained #9](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/security/code-scanning/9) +explicitly reports creation within the last90 days. GitHub reports creation on +2026-10-11; recent issues, signed feature commits and actual CI evidence show +current activity. The age-based score does not establish abandonment, nor does +current activity prove long-term maintenance. Reassess on2027-01-09, after the +90-day boundary, and investigate any remaining maintenance finding honestly. + +## Remaining findings and actions + +Retain the current alert state until the assessment is reviewed and any authorized +disposition is recorded. Do not disable Scorecard or invent changesets to raise +its score. Fuzzing and SAST scores on the scaffold main revision must be +reassessed after the tested application is merged; native fuzz/property targets +may not be recognized by Scorecard. The actual Windows-specific Best Practices +enrollment/assessment remains open in issue#31. No earned badge is claimed. + +No OpenVEX statement is fabricated for process findings without a vulnerable +component. Actual exploitable code/dependency findings still need remediation +or a reviewed, precisely scoped exception before shipping.