chore(main): release 1.1.2 (#46)

Release proposal generated from reviewed changes on main. Review the
version, changes, and validation before merging.
---


## 1.1.2 (2026-10-13)

<!-- Release notes generated using configuration in .github/release.yml
at main -->

## What's Changed
### Changes
* fix(releases): scope bootstrap parameters under Actions pwsh by
@KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/45


**Full Changelog**:
https://github.com/KofTwentyTwo/standards/compare/v1.1.1...v1.1.2

---
Generated by [Release
Please](https://github.com/googleapis/release-please) using this
repository's release configuration.

Co-authored-by: koftwentytwo-standards-releases[bot] <340613191+koftwentytwo-standards-releases[bot]@users.noreply.github.com>

.github/workflows/release-velopack.yml

@@ -366,6 +366,37 @@ jobs:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
+      # The pinned official action installs this tool with --add-source, which
+      # conflicts with NuGet package source mapping. Stage its verified package
+      # in the action's own dependency directory without changing caller policy.
+      - name: Prepare pinned Artifact Signing CLI dependency
+        if: inputs.sign
+        shell: pwsh
+        run: |
+          & {
+             param(
+                [string]$PackageDirectory = $env:RUNNER_TEMP,
+                [string]$InstallRoot = $env:LOCALAPPDATA
+             )
+             $ErrorActionPreference = 'Stop'
+             $version = '0.9.1-beta.26227.3'
+             $package = Join-Path $PackageDirectory "sign.$version.nupkg"
+             $destination = Join-Path $InstallRoot "ArtifactSigning/sign/sign.$version"
+             if (Test-Path -LiteralPath $destination) { throw 'Artifact Signing CLI directory already exists; use a fresh release runner.' }
+             Invoke-WebRequest -Uri "https://api.nuget.org/v3-flatcontainer/sign/$version/sign.$version.nupkg" -OutFile $package
+             if ((Get-FileHash -LiteralPath $package -Algorithm SHA256).Hash -ne '34FD0D4AEABDBC363A48883881865B4DD65E6C11BA916028082FA23F3E1B1BA1')
+             {
+                throw 'Artifact Signing CLI package checksum mismatch.'
+             }
+             dotnet nuget verify $package --all
+             if ($LASTEXITCODE -ne 0) { throw 'Artifact Signing CLI NuGet signature verification failed.' }
+             [IO.Compression.ZipFile]::ExtractToDirectory($package, $destination)
+             if (-not (Test-Path -LiteralPath (Join-Path $destination 'tools/net8.0/any/sign.dll') -PathType Leaf))
+             {
+                throw 'Artifact Signing CLI package is missing its executable.'
+             }
+          } @args
+
       # Signs the app's own executables and DLLs (and the CLI) before packing, so the
       # binaries inside the installer, the portable zip, and the update packages are
       # all signed (K22-REL-05).

.release-please-manifest.json

@@ -1 +1 @@
-{".":"1.1.0"}
+{".":"1.1.2"}

CHANGELOG.md

@@ -3,6 +3,29 @@
 <!-- Generated by Release Please and GitHub; permit native spacing, links and repeated categories. -->
 <!-- markdownlint-disable MD012 MD022 MD024 MD032 MD034 -->
 
+## 1.1.2 (2026-10-13)
+
+<!-- Release notes generated using configuration in .github/release.yml at main -->
+
+## What's Changed
+### Changes
+* fix(releases): scope bootstrap parameters under Actions pwsh by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/45
+
+
+**Full Changelog**: https://github.com/KofTwentyTwo/standards/compare/v1.1.1...v1.1.2
+
+## 1.1.1 (2026-10-12)
+
+<!-- Release notes generated using configuration in .github/release.yml at main -->
+
+## What's Changed
+### Changes
+* docs(inventory): register MarkdownViewr and the Windows starter by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/36
+* fix(releases): bootstrap verified Artifact Signing dependency by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/44
+
+
+**Full Changelog**: https://github.com/KofTwentyTwo/standards/compare/v1.1.0...v1.1.1
+
 ## 1.1.0 (2026-10-12)
 
 <!-- Release notes generated using configuration in .github/release.yml at main -->

MAINTAINERS.md

@@ -24,6 +24,8 @@ conformance version in its README once it passes the conformance checker.
 | --- | --- | --- | --- |
 | [standards](https://github.com/KofTwentyTwo/standards) | These policies, standards, configs, and reusable workflows | Product | Not yet: rulesets and CI being added |
 | [AppKit](https://github.com/KofTwentyTwo/AppKit) | Shared foundation packages for Windows desktop apps | Product | Adoption in progress |
+| [MarkdownViewr.Windows](https://github.com/KofTwentyTwo/MarkdownViewr.Windows) | Windows Markdown reader based on Darin Kelkhoff's macOS markdownViewr and AppKit | Product | Adoption in progress: release acceptance, signing and maintainer review pending |
+| [windows-app-template](https://github.com/KofTwentyTwo/windows-app-template) | Reusable AppKit Windows app starter with optional CLI and stable/dev release workflows | Product | Adoption in progress: shared defaults and release controls in review |
 | [gclo](https://github.com/KofTwentyTwo/gclo) | Clone and update every repository of a GitHub organization (Windows app and CLI) | Product | Adoption in progress: standards gates, governance files, and the Kingsrook layout are in review (gclo #62); settings and exceptions pending |
 
 ### Awaiting classification

tools/VelopackSigning.Tests.ps1

@@ -14,6 +14,14 @@ BeforeAll `
    if($start -lt 0 -or $end -ge $lines.Count) { throw 'Cannot locate the actual Velopack signing wrapper.' }
    $script:Wrapper = Join-Path $TestDrive 'sign-one.ps1'
    [IO.File]::WriteAllLines($script:Wrapper, @($lines[($start + 1)..($end - 1)] | ForEach-Object { $_.Substring(10) }))
+   $dependencyStart = [Array]::IndexOf($lines, '      - name: Prepare pinned Artifact Signing CLI dependency')
+   if($dependencyStart -lt 0) { throw 'Cannot locate the actual signing dependency bootstrap.' }
+   $dependencyStart += 4
+   $dependencyEnd = $dependencyStart
+   while($dependencyEnd -lt $lines.Count -and $lines[$dependencyEnd].StartsWith('          ')) { $dependencyEnd++ }
+   $script:Bootstrap = Join-Path $TestDrive 'sign-dependency.ps1'
+   # GitHub's default pwsh shell prepends this statement to every inline run body.
+   [IO.File]::WriteAllLines($script:Bootstrap, @('$ErrorActionPreference = "stop"') + @($lines[$dependencyStart..($dependencyEnd - 1)] | ForEach-Object { $_.Substring(10) }))
    $script:OldTool = $env:K22_VPK_SIGN_TOOL
    $env:K22_VPK_SIGN_TOOL = 'Invoke-WrapperTool'
 
@@ -31,6 +39,69 @@ BeforeAll `
    }
 }
 
+Describe 'The actual Artifact Signing dependency bootstrap' `
+{
+   BeforeEach `
+   {
+      $script:InstallRoot = Join-Path $TestDrive ([guid]::NewGuid().ToString('N'))
+      $script:PackageDirectory = Join-Path $script:InstallRoot 'downloads'
+      [void][IO.Directory]::CreateDirectory($script:PackageDirectory)
+      $script:Destination = Join-Path $script:InstallRoot 'ArtifactSigning/sign/sign.0.9.1-beta.26227.3'
+      Mock Invoke-WebRequest `
+      {
+         $fixture = Join-Path (Split-Path -Parent $OutFile) 'fixture'
+         [void][IO.Directory]::CreateDirectory((Join-Path $fixture 'tools/net8.0/any'))
+         [IO.File]::WriteAllText((Join-Path $fixture 'tools/net8.0/any/sign.dll'), 'fixture')
+         [IO.Compression.ZipFile]::CreateFromDirectory($fixture, $OutFile)
+      }
+      Mock Get-FileHash { [pscustomobject]@{ Hash = '34FD0D4AEABDBC363A48883881865B4DD65E6C11BA916028082FA23F3E1B1BA1' } }
+      Mock dotnet { $global:LASTEXITCODE = 0 }
+   }
+
+   It 'stages the verified tool where the official action finds it' `
+   {
+      & $script:Bootstrap -InstallRoot $script:InstallRoot -PackageDirectory $script:PackageDirectory
+      Get-Content -LiteralPath (Join-Path $script:Destination 'tools/net8.0/any/sign.dll') | Should -Be 'fixture'
+      Should -Invoke dotnet -Exactly 1
+   }
+
+   It 'rejects a changed download before verification or extraction' `
+   {
+      Mock Get-FileHash { [pscustomobject]@{ Hash = 'bad' } }
+      { & $script:Bootstrap -InstallRoot $script:InstallRoot -PackageDirectory $script:PackageDirectory } | Should -Throw '*checksum mismatch*'
+      Test-Path -LiteralPath $script:Destination | Should -BeFalse
+      Should -Invoke dotnet -Exactly 0
+   }
+
+   It 'rejects an invalid NuGet signature before extraction' `
+   {
+      Mock dotnet { $global:LASTEXITCODE = 1 }
+      { & $script:Bootstrap -InstallRoot $script:InstallRoot -PackageDirectory $script:PackageDirectory } | Should -Throw '*signature verification failed*'
+      Test-Path -LiteralPath $script:Destination | Should -BeFalse
+   }
+
+   It 'preserves a preexisting dependency directory' `
+   {
+      [void][IO.Directory]::CreateDirectory($script:Destination)
+      $marker = Join-Path $script:Destination 'marker.txt'
+      [IO.File]::WriteAllText($marker, 'preserve')
+      { & $script:Bootstrap -InstallRoot $script:InstallRoot -PackageDirectory $script:PackageDirectory } | Should -Throw '*already exists*'
+      Get-Content -LiteralPath $marker | Should -Be 'preserve'
+      Should -Invoke Invoke-WebRequest -Exactly 0
+   }
+
+   It 'rejects a package without the expected executable' `
+   {
+      Mock Invoke-WebRequest `
+      {
+         $emptyFixture = Join-Path (Split-Path -Parent $OutFile) 'empty'
+         [void][IO.Directory]::CreateDirectory($emptyFixture)
+         [IO.Compression.ZipFile]::CreateFromDirectory($emptyFixture, $OutFile)
+      }
+      { & $script:Bootstrap -InstallRoot $script:InstallRoot -PackageDirectory $script:PackageDirectory } | Should -Throw '*missing its executable*'
+   }
+}
+
 AfterAll `
 {
    $env:K22_VPK_SIGN_TOOL = $script:OldTool

version.txt

@@ -1 +1 @@
-1.1.0
+1.1.2