Release stable 1.0.3 and dev 1.0.3-beta.1 with signed EXE/MSI downloads #33
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#33
Reference in new issue
Block a user
Release 1.0.0 stable and 1.0.0-beta.1 dev
Use the accepted reader implementation and the published, verified standards1.1.0 signing builder. Keep this release bounded to configuration, required verification and publication.
Conformance
Security assessment
Test and signing evidence
b1dc874CI38276579007 passes without narrowing cases or deadlines.baee14fCI38285775463 and identical-treee605df6CI38290542691 pass. Retained TRXs: focused29, published111, installed stable110/dev110; zero failures/skips. Core line coverage100%, branches98.86%.Publish
Final delivered versions
Published and verified: stable v1.0.3 and dev v1.0.3-beta.1. Both public immutable releases include signed Setup.exe, MSI and portable ZIP downloads, update packages/feed, CycloneDX SBOM and SHA256SUMS.
Production runs 38410286325 and 38410289420 succeeded on main
a44449b991, using standards v1.2.1 at 70b555bd5658273090769991bfc4c9b6681dde18. Each of the eight actual downloaded assets has strict source/builder/tag provenance; all seven checksum entries verify. Native Authenticode publisher/trust/timestamp verification and exact shipped payload checks pass. Each MSI installed, opened the application, closed and uninstalled successfully in hosted Windows; downloaded MSI payloads also match the signed build. All 18 original branch requirements are restored and verified.Receipts: AppKit/artifacts/release-verification/v1.0.3/verified.json and v1.0.3-beta.1/verified.json. User README and installation guide link the actual downloads. Failed historical tags remain preserved. OpenSSF remains an honest 70% assessment; no passing badge is claimed.
Final application code and signing caller
b1dc874passed CI38276579007, including published111/stable110/dev110 acceptance with zero failures/skips and actual lifecycle receipts. Standards inventory36 is merged. Windows OpenSSF project15417 is enrolled and its actual badge/evidence is recorded; no passing status is claimed. Requested user-first docs/screenshots are now signed/pushed inbaee14f(#34), with unchanged application/release code. Final-head checks and genuine maintainer review remain required before the protected merge and signed stable/dev publication. No production app release exists yet.Final
baee14fCI38285775463 passes every gate; actual downloaded published111/stable110/dev110 and focused29 TRXs have zero failures/skips. Added/read back only the required Actions-bound fuzzing context; live setup verifies18 checks and preserves all prior protections. GitHub then refused the historical signed commits due to unassociated committer identities. Replacement PR35/e605df6 preserves the exact owner-approved tree and has a GitHub-valid single signature; all checks rerun without bypass. OpenSSF70% is now genuinely saved. Production releases remain pending.Replacement PR35 merged normally at GitHub-verified38dd5c1 after every required check passed and the duplicate already-assessed workflow recommendation was resolved. No admin bypass or weakened protection. Main checks now run; signed1.0.0/stable and1.0.0-beta.1/dev publication is next after their success. OpenSSF70% is saved; no passing badge or production release is claimed.
MainCI38294895221 passed. Actual retained TRXs confirm published111/stable110/dev110, zero failures/skips. Both authorized signed tagsv1.0.0 andv1.0.0-beta.1 now point to reviewed main38dd5c1; GitHub verifies both signatures.
Initial stable run38298628970 and dev38298629306 stopped at startup before any job. GitHub explicitly rejects the reviewed builder's pinned Syft SBOM container because it is missing from this repository's selected-action allowlist. Prepared a one-entry addition matching the exact published builder image; all existing patterns/settings remain unchanged.
Automatic approval review rejected the remote allowlist update: release publication approval did not clearly cover this exact persistent security-boundary change. No settings change or rerun occurred. Awaiting precise maintainer approval for this one image, then rerun the unchanged signed tags and verify production signing/distributed assets. Neither app release is published yet.
Owner explicitly approved the exact digest-pinned Syft entry. Added/read back only that entry; all existing action restrictions preserved. GitHub cannot retry startup-only failures, so restored the same two unpublished signed tag objects after verifying no job or release existed; tag object hashes/commit/signatures are unchanged.
Both replacement release runs are active:
Release preflight/scripts/security pass in both. Production OIDC and exact distributed-artifact verification remain pending. Source setup-plan correction is isolated from the released tree, with23 existing tests/no skips, clean script analysis and live18-check configuration validation; it will be included in the post-release documentation follow-up.
Release checkpoint: neither stable nor dev is published. Latest owner decision is EXE/portable ZIP first, MSI next release (#36).
Dev38299469062 passed required acceptance and Azure OIDC login, then failed the official Artifact Signing action's pinned Sign CLI dependency install: --add-source conflicts with NuGet source mapping. Standards PR44 (8a3fc7e) stages the exact checksum/NuGet-signature-verified dependency without changing caller policy;40 signing tests and genuine package bootstrap pass locally, and all hosted PR checks pass.
Stable38299469141 attempt2 completed110/111 published tests without a reported test failure before its600-second suite cutoff. The successful main suite took572 seconds. App PR37 (
13ff108) allows900 seconds per full suite and60 minutes for three suites/packaging, with unchanged individual deadlines/assertions/filters.19 boundary tests pass; real child hangs/nonzero exits still fail. Fresh hosted full acceptance is running, not yet claimed successful.Both fixes are signed/DCO and submitted as draft PRs for genuine owner review under K22-AI-01. Next: green checks and review, merge/fix immutable app builder pin, publish new signed candidates and verify exact downloaded signatures/publisher/timestamps/checksums/SBOM/provenance. Existing failed release tags remain preserved. No current runs cancelled, no tests skipped, no unsigned release published.
Current check result: app PR37 CI38307179655 completed with all checks passing except installed-updates. The published suite now completes and reports111 tests:110 passed,1 failed,0 skipped. ReadingKeys_FindAndTextFocus_PreserveLiteralInput expected search text jkg but observed jk. Installed-channel phases are correctly blocked by that failure. Native UI and focused reader regression jobs both passed; no release exists.
Standards PR44 remains all-green and awaits genuine owner review. No merge, release retry or publication has occurred. The keyboard result needs a focused diagnosis; neither input loss nor observation timing is established yet. MSI remains next release per the latest owner instruction.
Owner personally confirmed reviewing signing PR44 at8a3fc7e and instructed merging/fixing/full publication. PR44 merged normally atb3e4b49; generated version/changelog-only PR42 merged at96cbdf2. Signed standardsv1.1.1 published immutably in successful38322016784 after protected deployment approval. All five actual assets verify SHA256 and strict provenance; bundled hosted builder bytes match the personally reviewed source.
App PR37 final signed/DCO head is
a3cab85916. It retains the exact jkg assertion with bounded native-state waiting, adds the case to focused hosted testing, pins published standards1.1.1 and persists the previously approved exact Syft entry in setup.42 process/registration/setup boundaries pass, zero skips; builds/format/configured analysis/medium security gate/hooks pass. Temporary diagnostics removed. Desktop reservation ended; local original/changed runs both stopped before jkg at missing FindText, so no local keyboard success claimed. Exact-head CI38322328976 running; genuine final-head app review requested.No app release published yet. Preserve failed1.0.0 tags; new first public candidates will be1.0.1/stable and1.0.1-beta.1/dev after actual green protected app merge. EXE/ZIP first, MSI next release (#36). Final verifier now accepts exact new tags and explicit merged source SHA with strict pinned builder96cbdf2.
Owner personally confirmed: I reviewed PR #37 at
a3cab85and resolved all findings. Genuine exact-head review record posted on PR37 (6134739333), with no independent-review claim. Current source remainsa3cab85916.Downloaded actual focused hosted TRX confirms30/30,zero failures/skips; the exact previously blocking literal keyboard test passes in6.5802129sec. Full native and published/installed stable/dev acceptance is still running in38322328976. No source changed after owner review, no tests restarted/skipped, and no app release is public yet. Next is normal protected merge when every required check succeeds, followed by new signed1.0.1 stable/dev candidates and exact final download verification.
App PR37 merged normally at4c0ccc71f388686f19d794ee3ec1b150033a3209 after genuine exact-head owner review and every required check passed. GitHub verifies its signature; merged tree5e26020a2aaad77a3f1a4c219272ba0aa35af40d equals reviewed/tested
a3cab85.Actual retained reports: focused30/native111/published111/installed stable110/dev110, zero failures/skips. Coexistence receipts verify simultaneous windows, distinct profiles, isolated updates, stable uninstall preserving dev, and existing Windows defaults preserved. Both actual AppKit download/apply/restart probes and portable channel checks pass.
New signed tagsv1.0.1 andv1.0.1-beta.1 atomically pushed on4c0ccc7 using existing configured maintainer tag-creation authority; no rules changed and no old tags replaced. Production stable38325589209 and dev38325588498 run, with preflight/allowed-action checks successful and protected full gates underway. No app public release yet. No new owner confirmation required for merge/signing/publication; actual shipped signing and final downloads still require verification.
Standards1.1.1 remains published immutable with verified hashes/provenance and exact reviewed builder bytes. Follow-up#38 tracks duplicate CI latency; MSI remains next release#36.
Both 1.0.1 release runs have completed with failure: stable38325589209 and dev38325588498. Required acceptance/build gates pass and Azure OIDC login succeeds. Packaging stops before signing because GitHub's pwsh preamble precedes a top-level param block. This was my implementation error; standalone tests missed the actual Actions wrapper.
Corrected in standards PR45 at aa6b0f6: https://github.com/KofTwentyTwo/standards/pull/45. Tests now reproduce GitHub's wrapper: five bootstrap cases fail before the fix, all40 signing tests pass afterward; real pinned-package verification/CLI startup and hosted PR checks pass. Genuine owner review is requested before normal merge under K22-AI-01. Release authorization remains valid. No app release is public; preserve failed tags and use new candidate refs after updating the builder pin. EXE/ZIP first; MSI next release.
The existing unchanged-source main validation run38325540268 completed attempt2 successfully. Downloaded TRXs prove published111/111, installedstable110/110 and installeddev110/110, with zero failures or unexecuted tests. DocsCI38327071773 also passes. No additional runs restarted. Standards PR45 aa6b0f6 remains the release blocker: all hosted checks pass, genuine maintainer review is pending. No app release public.
The owner personally approved signing-wrapper PR45, now merged at261a005. Standards1.1.2 is published immutably at083d903; all five actual assets verify SHA256, strict source/workflow/tag provenance and exact bundled builder bytes.
Final app PR39 is now63b5024: corrected immutable builder pin, new1.0.2 stable/dev download links and next development prefix1.0.3. Application behavior, dependencies, Azure trust and all technical tests remain unchanged. Five actual source Markdown files and workflow syntax pass. Full exact-head CI38388605723 is live; do not restart it.
Owner explicitly instructed "no more human review re - get this released". A truthful release-specific waiver is recorded in PR39; no fabricated personal-read acknowledgement. All17 technical checks must pass, and the one manual acknowledgement requirement will be exempted only for the merge then restored immediately. Failed1.0.0/1.0.1 refs are preserved. No public app installers yet. Signed EXE/ZIP first; MSI next per latest owner instruction.
All17 exact-head technical checks passed. PR39 merged normally at18d8ae950cab445672d216d387a956b964d2c6c1, identical final63b5024 tree and GitHub-verified signature. The owner's explicit no-more-human-review instruction was implemented as a bounded exemption of only the manual acknowledgement context for this merge; the exact original protection, including all18 checks and no bypass actors, was immediately restored and read back successfully. No fabricated acknowledgement.
New signed tags v1.0.2 and v1.0.2-beta.1 were pushed atomically using the configured maintainer tag-creation authority. Failed historical refs remain unchanged. Production runs: stable https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38392743207 ; dev https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38392743312 . They are live; do not restart them. Pipeline42190 waits for actual success, verifies exact shipped signatures/publisher/trust/timestamps, checksums, SBOM, source/builder provenance and updater metadata, then updates user release descriptions. No public installer verification claimed yet. Signed EXE/ZIP first, MSI next.
The maintainer renewed MSI delivery: "please please please release the exe and MSI files"; this supersedes the earlier deferral. Stable1.0.2 and dev1.0.2-beta.1 signed EXEs/ZIPs are now public and their actual downloaded signatures/timestamps/payloads/checksums/SBOM/provenance/updater feeds verify. No production MSI is published yet.
Minimal native MSI builder is signed8463119 on standards feat/signed-msi. It adds optional per-user MSI through the existing pinned Velopack/signing hook, verifies exact MSI payload bytes, gates actual install/launch/uninstall before publication, and includes MSI SBOM subjects. Syntax/security and40 signing regressions pass; real MSI compilation/extraction preserves all6 signed fixture inputs. App caller is being prepared for1.0.3 stable/dev and exact-source CI proof so release tags reuse genuine17-check PR validation instead of repeating unchanged full Windows suites. No further human-review request; keep original branch gates and truthful bounded waiver records.
Published and verified: stable v1.0.3 and dev v1.0.3-beta.1. Both public immutable releases include signed Setup.exe, MSI and portable ZIP downloads, update packages/feed, CycloneDX SBOM and SHA256SUMS.
Production runs 38410286325 and 38410289420 succeeded on main
a44449b991, using standards v1.2.1 at 70b555bd5658273090769991bfc4c9b6681dde18. Each of the eight actual downloaded assets has strict source/builder/tag provenance; all seven checksum entries verify. Native Authenticode publisher/trust/timestamp verification and exact shipped payload checks pass. Each MSI installed, opened the application, closed and uninstalled successfully in hosted Windows; downloaded MSI payloads also match the signed build. All 18 original branch requirements are restored and verified.Receipts: AppKit/artifacts/release-verification/v1.0.3/verified.json and v1.0.3-beta.1/verified.json. User README and installation guide link the actual downloads. Failed historical tags remain preserved. OpenSSF remains an honest 70% assessment; no passing badge is claimed.