From da4a0dc4e2bd2a2d342af8aaa04b7f81e77225d5 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Wed, 14 Oct 2026 00:27:11 -0400 Subject: [PATCH] feat: fill-manifest-sha256.ps1 + CERT local font-face first Hash helper for DOWNLOADS-MANIFEST; certificate.html prefers fonts/*.woff2 when present. --- docs/COMMERCIAL-INSTALLER-BACKLOG.md | 6 +- docs/PACKAGING.md | 13 +- .../windows/scripts/fill-manifest-sha256.ps1 | 152 +++++++++++++++++ platform/windows/wix/CI-SIGN-NOTARY.md | 2 +- platform/windows/wix/DUAL-SHIP.md | 27 ++- platform/windows/wix/README.md | 2 + .../windows/wix/VM-DUAL-SHIP-CHECKLIST.md | 2 +- site/printit.verae.ai/DOWNLOADS-MANIFEST.md | 19 ++- site/printit.verae.ai/DOWNLOADS-MANIFEST.txt | 1 + site/printit.verae.ai/certificate.html | 58 ++++++- site/printit.verae.ai/fonts/README.md | 158 +++++++++++------- .../fonts/fetch-fonts.example.sh | 8 +- 12 files changed, 366 insertions(+), 82 deletions(-) create mode 100644 platform/windows/scripts/fill-manifest-sha256.ps1 diff --git a/docs/COMMERCIAL-INSTALLER-BACKLOG.md b/docs/COMMERCIAL-INSTALLER-BACKLOG.md index 1e8970c..29d02eb 100644 --- a/docs/COMMERCIAL-INSTALLER-BACKLOG.md +++ b/docs/COMMERCIAL-INSTALLER-BACKLOG.md @@ -35,6 +35,7 @@ Repo now includes **authoring/docs scaffolds** for the two commercial gaps that | [`.github/workflows/windows-msi.yml`](../.github/workflows/windows-msi.yml) unsigned MSI on `windows-latest` + artifact upload | Wire org secrets and enable sign step; publish signed assets to site | | [`ci-notarize.yml.example`](../platform/macos/menubar/ci-notarize.yml.example) menubar GHA/Forgejo sketch (unsigned default; secret names) | Promote example → live workflow; automate `build-menubar-app.sh` sign when `SIGNING_ENV` set | | **0.3.6 Windows NSIS+MSI placeholder rows** ([`DOWNLOADS-MANIFEST.txt`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.txt) + [`DOWNLOADS-MANIFEST.md`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.md); sha256 **TBD**) | Build/upload signed 0.3.6 blobs; replace TBD with real digests | +| [`fill-manifest-sha256.ps1`](../platform/windows/scripts/fill-manifest-sha256.ps1) local hash → DOWNLOADS-MANIFEST rows (linked from DUAL-SHIP + manifest.md; **no upload**) | Operator still must upload first, then paste digests over TBD | | **Printable VM A/B/C sheet** [`VM-DUAL-SHIP-CHECKLIST.md`](../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) | Operator sign-off on clean VMs (C blocked until CAs uncommented) | **Still use for day-to-day presence (no WiX / no Apple certs):** @@ -73,6 +74,7 @@ Related but out of scope for “done” above (still backlog-adjacent): Linux `. | **Dual-ship runbook** | [`wix/DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md) | **Docs** — NSIS + MSI clean-VM matrix; CI artifact section; **thin-NSIS exit checklist** (A–E) | | **Printable VM checklist** | [`wix/VM-DUAL-SHIP-CHECKLIST.md`](../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) | **Docs** — tick boxes for shared pre-checks + VM A/B/C + side-by-side | | **0.3.6 download placeholders** | [`site/.../DOWNLOADS-MANIFEST.md`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) + `.txt` TBD rows | **Docs** — NSIS setup + full MSI filenames reserved; digests TBD until publish | +| **Manifest SHA-256 row helper** | [`scripts/fill-manifest-sha256.ps1`](../platform/windows/scripts/fill-manifest-sha256.ps1) | **Tool** — local `Get-FileHash` → SHA256SUMS / MD rows; does **not** upload or rewrite site files | | Shared version helper | [`platform/windows/scripts/common.ps1`](../platform/windows/scripts/common.ps1) `Get-VeraePackageVersion` | Aligns tray/full MSI/NSIS drivers with `HelperVersion` | | End-user Windows readme | [`platform/windows/README-WINDOWS.txt`](../platform/windows/README-WINDOWS.txt), [`README.txt`](../platform/windows/README.txt) | Documents NSIS flow; states **no elevated MSI** for tray | | Packaging policy doc | [PACKAGING.md](PACKAGING.md) | “**No elevated MSI**” for tray presence by design | @@ -86,7 +88,7 @@ NSIS product already covers much of the *install experience* (files under Progra | Gap | Why it matters | Suggested work | |-----|----------------|----------------| | **Full-product WiX authoring + StageFull driver** | **Exists** — `Product-Full.wxs` + `build-full-msi.ps1` | MSI binary only on hosts with candle/light; still dual-ship NSIS | -| **MSI output when WiX present** | `wix/out/VeraePrintStamp-windows--.msi` via `build-full-msi.ps1` | Not yet published to `dist/` / site downloads; no SHA256 release job | +| **MSI output when WiX present** | `wix/out/VeraePrintStamp-windows--.msi` via `build-full-msi.ps1` | Not yet published to `dist/` / site downloads; local hash helper `fill-manifest-sha256.ps1` (no upload/CI publish job yet) | | **No Authenticode signing pipeline** in-repo | SmartScreen / enterprise trust | `signtool` (or Azure Trusted Signing) for EXE/DLL **and** MSI; store certs in CI secrets only — never in git. **Not shipped.** | | **Silent / unattended install contract** | Fleet deploy | Props documented (`SILENT_PROPS.md`); wire scheduled CAs to honor them | | **Upgrade / repair / ARP metadata** | Clean major-upgrade, Add/Remove Programs | WiX `UpgradeCode` present; migrate ARP fully from NSIS `UNINST_KEY` after dual-ship | @@ -104,7 +106,7 @@ NSIS product already covers much of the *install experience* (files under Progra 4. **Uncomment** + test printer/helper deferred CAs on clean VM (DUAL-SHIP VM C); keep NSIS primary until parity. 5. Authenticode on binaries + MSI (**not shipped** — enable commented sign step; secret names in workflow + `CI-SIGN-NOTARY.md`). 6. Honor silent props in live CAs + Intune sample command line proof. -7. Publish 0.3.6 artifacts; refresh site `DOWNLOADS-MANIFEST` checksums; keep smoke on HelperVersion drift. +7. Publish 0.3.6 artifacts; refresh site `DOWNLOADS-MANIFEST` checksums via `fill-manifest-sha256.ps1` (hash-only; no upload); keep smoke on HelperVersion drift. 8. Deprecate or thin NSIS once MSI is the primary download (**thin-NSIS exit checklist** A–D in DUAL-SHIP.md — all boxes). --- diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md index 70ca7cc..e1e6bef 100644 --- a/docs/PACKAGING.md +++ b/docs/PACKAGING.md @@ -182,15 +182,16 @@ Site page: [`site/printit.verae.ai/certificate.html`](../site/printit.verae.ai/c | Item | Status | |------|--------| -| CERT-01 layout | **Shipped** — plum/gold double frame, Fraunces title via Google Fonts, gold rule, final banner, mono digests, digests-only footer | +| CERT-01 layout | **Shipped** — plum/gold double frame, Fraunces title (local woff2 else CDN), gold rule, final banner, mono digests, digests-only footer | | Brand kit | Uses `brand/tokens.css`, `verae-ui-kit.css`, `brand/logo/verae-mark.svg` | | Multihash / BLAKE3 | Shown **only when present** (query, sidecar, or sample); never invented | | Load paths | Query string (`?sha256=&receipt=&…`), optional `.verae.json` sidecar drop, “Sample data” button | | Print CSS | Letter page, toolbar hidden, frame colors preserved | | Live verify | Link to `explorer.verae.ai/time?receipt=&sha256=` (same as `pdfcert.LookupURL`) | | Live QR (web) | **Shipped** — final + receipt/digest paints QR via qrcode.js CDN → data-URL; offline/provisional keeps SVG placeholder (print-safe) | -| Residual gap | Full **CERT-01.html** pixel match (self-hosted design-kit Fraunces/Cantarell, Substrate extrinsic polish) still **not** claimed — web title ships CDN Fraunces + Georgia/serif offline fallback; issued artifact remains PDF (`internal/pdfcert` + `platform/registration-pdf/build.mjs`) | -| Self-host fonts plan | [`site/printit.verae.ai/fonts/README.md`](../site/printit.verae.ai/fonts/README.md) — woff2 placeholder dir (empty + `.gitkeep`); binaries/CDN cutover not started | +| Residual gap | Full **CERT-01.html** pixel match (self-hosted design-kit Fraunces/Cantarell, Substrate extrinsic polish) still **not** claimed — web title prefers local `fonts/*.woff2` else CDN Fraunces + Georgia/serif offline fallback; issued artifact remains PDF (`internal/pdfcert` + `platform/registration-pdf/build.mjs`) | +| Self-host fonts plan | [`site/printit.verae.ai/fonts/README.md`](../site/printit.verae.ai/fonts/README.md) — drop-in woff2 dir (empty + `.gitkeep`); local-first probe in `certificate.html` | +| Local-first fonts (Issue 7) | `certificate.html` probes planned `fonts/*.woff2` (magic `wOF2`); any hit → `@font-face` only; none → Google Fonts CDN. No proprietary binaries downloaded or committed | | Font fetch scaffold (TODO-7 A7) | [`site/printit.verae.ai/fonts/fetch-fonts.example.sh`](../site/printit.verae.ai/fonts/fetch-fonts.example.sh) — curl **placeholders only** (commented URLs, OFL reminder, `--check`); no licensed binaries downloaded or committed | | Layout spacing (TODO-7 A7) | `certificate.html` padding/margins nudged toward CERT-01 mock: sheet **56×64**, column **816px**, logo **40px**, title block **26/6/14**, gold rule **2×120**, banner **18** / check **34** / title **16px**, kv **20**, verify gap **22**, QR **130**; plum **1.5px** + gold **0.5px** inset frame. Still **not** full pixel match | @@ -201,9 +202,9 @@ Cross-product siblings (not owned here): Sign `certificate.html` (SG-P1), Verify | Done this slice | Still left | |-----------------|------------| -| `fetch-fonts.example.sh` example + `--check` | Real woff2 + `OFL.txt` committed; `@font-face` cutover; drop Google Fonts CDN links | -| CERT sheet spacing closer to CERT-01 | Full CERT-01.html pixel match (Fraunces opsz, Cantarell body if required, Substrate extrinsic polish) | -| PACKAGING rows above | PDF Fraunces embed in `internal/pdfcert` / `registration-pdf/build.mjs` (system Times/Helvetica only today) | +| Local-first `@font-face` else CDN; fonts drop-in README | Real OFL woff2 + `OFL.txt` **committed** (operator drop-in only today) | +| `fetch-fonts.example.sh` example + `--check` | Full CERT-01.html pixel match (Fraunces opsz, Cantarell body if required, Substrate extrinsic polish) | +| CERT sheet spacing closer to CERT-01 | PDF Fraunces embed in `internal/pdfcert` / `registration-pdf/build.mjs` (system Times/Helvetica only today) | ## statuslang notify titles diff --git a/platform/windows/scripts/fill-manifest-sha256.ps1 b/platform/windows/scripts/fill-manifest-sha256.ps1 new file mode 100644 index 0000000..857e579 --- /dev/null +++ b/platform/windows/scripts/fill-manifest-sha256.ps1 @@ -0,0 +1,152 @@ +#Requires -Version 5.1 +<# +.SYNOPSIS + Compute SHA-256 of built MSI/NSIS (or companion EXE) and print DOWNLOADS-MANIFEST rows. + +.DESCRIPTION + Given one or more paths to release artifacts (setup.exe, .msi, bare helper .exe), + prints SHA256SUMS-style lines matching site/printit.verae.ai/DOWNLOADS-MANIFEST.txt: + + + + Optionally prints a Markdown table row for DOWNLOADS-MANIFEST.md. + + Does NOT upload, rewrite the site manifests, or sign. Operator order remains: + build → sign (when required) → upload → hash → paste digests over TBD. + +.EXITCODES + 0 At least one path hashed successfully. + 1 No paths, missing file, or terminating error. + +.PARAMETER Path + One or more artifact paths (MSI, NSIS setup.exe, optional bare helper). + Also accepts leftover positional args and pipeline input (strings or FileInfo). + +.PARAMETER Format + txt — SHA256SUMS lines only (default; paste into DOWNLOADS-MANIFEST.txt). + md — Markdown table rows for DOWNLOADS-MANIFEST.md. + both — txt then md (md after a blank line). + +.PARAMETER AsName + Override the leaf name written in the row (single Path only). Use when the + local build name differs from the CDN filename reserved in the manifest. + +.EXAMPLE + powershell -NoProfile -ExecutionPolicy Bypass -File fill-manifest-sha256.ps1 ` + -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, + .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi + +.EXAMPLE + .\fill-manifest-sha256.ps1 -Path .\out\product.msi -AsName VeraePrintStamp-windows-amd64-0.3.6.msi -Format both +#> +param( + [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)] + [Alias("FullName", "PSPath")] + [string[]]$Path = @(), + + [ValidateSet("txt", "md", "both")] + [string]$Format = "txt", + + [string]$AsName = "" +) + +begin { + $ErrorActionPreference = "Stop" + $collected = New-Object System.Collections.Generic.List[string] +} + +process { + foreach ($p in @($Path)) { + if ($null -eq $p) { continue } + $s = "$p".Trim() + if (-not $s) { continue } + # Pipeline FileInfo often arrives as Microsoft.PowerShell.Core\FileSystem::path + if ($s -match '^Microsoft\.PowerShell\.Core\\FileSystem::(.+)$') { + $s = $Matches[1] + } + [void]$collected.Add($s) + } +} + +end { + # Leftover unbound args (powershell -File script.ps1 a.msi b.exe) + if ($args -and $args.Count -gt 0) { + foreach ($a in $args) { + $s = "$a".Trim() + if ($s) { [void]$collected.Add($s) } + } + } + + if ($collected.Count -eq 0) { + Write-Error "No artifact paths given. Pass -Path (does not upload)." + } + + if ($AsName -and $collected.Count -gt 1) { + Write-Error "-AsName applies to a single -Path only." + } + + $rows = New-Object System.Collections.Generic.List[object] + foreach ($raw in $collected) { + if (-not (Test-Path -LiteralPath $raw)) { + Write-Error "Artifact not found: $raw" + } + $item = Get-Item -LiteralPath $raw + if ($item.PSIsContainer) { + Write-Error "Path is a directory (need file): $raw" + } + $hash = (Get-FileHash -LiteralPath $item.FullName -Algorithm SHA256).Hash.ToLowerInvariant() + $leaf = if ($AsName) { $AsName.Trim() } else { $item.Name } + if (-not $leaf) { + Write-Error "Empty leaf name for $raw" + } + [void]$rows.Add([pscustomobject]@{ + Hash = $hash + Name = $leaf + FullName = $item.FullName + Length = $item.Length + }) + } + + function Write-TxtRows { + param($Items) + foreach ($r in $Items) { + # Two spaces between digest and name — same as DOWNLOADS-MANIFEST.txt / shasum -a 256 + Write-Output ("{0} {1}" -f $r.Hash, $r.Name) + } + } + + function Write-MdRows { + param($Items) + foreach ($r in $Items) { + $role = "artifact" + $channel = "file" + $n = $r.Name + if ($n -match '\.msi$') { + $channel = "Full MSI" + $role = "Dual-ship / fleet path" + } elseif ($n -match '-setup\.exe$') { + $channel = "NSIS" + $role = "Windows setup" + } elseif ($n -match '^verae-print-windows-.*\.exe$') { + $channel = "Bare helper" + $role = "Optional companion EXE" + } + Write-Output ("| `{0}` | {1} | {2} | `{3}` | hashed locally (not uploaded by this script) |" -f $n, $channel, $role, $r.Hash) + } + } + + Write-Host "# fill-manifest-sha256: local hash only — does not upload or edit site manifests." -ForegroundColor DarkGray + Write-Host "# Paste over TBD in DOWNLOADS-MANIFEST.txt only after the blob is on the CDN." -ForegroundColor DarkGray + + switch ($Format) { + "txt" { Write-TxtRows $rows } + "md" { Write-MdRows $rows } + "both" { + Write-TxtRows $rows + Write-Output "" + Write-MdRows $rows + } + } + + exit 0 +} diff --git a/platform/windows/wix/CI-SIGN-NOTARY.md b/platform/windows/wix/CI-SIGN-NOTARY.md index 848a001..65001fa 100644 --- a/platform/windows/wix/CI-SIGN-NOTARY.md +++ b/platform/windows/wix/CI-SIGN-NOTARY.md @@ -189,7 +189,7 @@ GHA/Forgejo copy-paste sketch (unsigned default, notary job gated off): [`ci-not 2. **Sign** Windows PE + MSI with `signtool` (or Trusted Signing). 3. **Notarize** macOS zip/pkg with `notarytool --wait`. 4. **Staple** macOS artifacts; `stapler validate`. -5. **Checksum** + upload release assets; update `site/printit.verae.ai/DOWNLOADS-MANIFEST.txt` out-of-band or via a docs job. +5. **Checksum** + upload release assets; update `site/printit.verae.ai/DOWNLOADS-MANIFEST.txt` out-of-band (`platform/windows/scripts/fill-manifest-sha256.ps1` prints rows only — does not upload) or via a docs job. 6. Never upload raw PFX / `.p8` as workflow artifacts. --- diff --git a/platform/windows/wix/DUAL-SHIP.md b/platform/windows/wix/DUAL-SHIP.md index ddbc598..03b7c75 100644 --- a/platform/windows/wix/DUAL-SHIP.md +++ b/platform/windows/wix/DUAL-SHIP.md @@ -4,7 +4,7 @@ **Do not** thin or deprecate NSIS until the **thin-NSIS exit criteria checklist** (below) is fully checked — clean-VM gates, live Authenticode, silent/fleet proof, and site cutover (see [COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md), [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md)). -**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (printable A/B/C) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md) · site [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) (0.3.6 TBD rows). +**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (printable A/B/C) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md) · site [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) (0.3.6 TBD rows) · [`fill-manifest-sha256.ps1`](../scripts/fill-manifest-sha256.ps1) (hash built MSI/NSIS → manifest row; no upload). --- @@ -47,10 +47,32 @@ Expected outputs (names vary by arch): | NSIS setup | `dist/` or build output `VeraePrintStamp-windows-amd64--setup.exe` | | Full MSI | `platform/windows/wix/out/VeraePrintStamp-windows-amd64-.msi` | +Local SHA-256 for site manifest rows (**no upload**): + +```powershell +powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 ` + -Path .\dist\VeraePrintStamp-windows-amd64--setup.exe, + .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-.msi +``` + +Paste printed digests over **TBD** in [DOWNLOADS-MANIFEST.txt](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.txt) only after the blob is on the CDN. See [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md). + If WiX is missing, `build-full-msi.ps1` **exits 1** with an install tip — dual-ship **fails closed** for the MSI leg (do not claim MSI ready). Cross-host NSIS-only: `platform/windows/build-installer.sh` (needs prebuilt Windows binaries). +### Manifest checksum rows (no upload) + +After artifacts exist locally (and only after they are on the CDN when rewriting site TBD): + +```powershell +powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 ` + -Path .\dist\VeraePrintStamp-windows-amd64--setup.exe, + .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-.msi +``` + +Prints `DOWNLOADS-MANIFEST.txt` lines (` `). `-Format md` prints Markdown table rows for [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md). **Does not upload** or edit the site files. + --- ## Clean-VM matrix (minimum) @@ -195,7 +217,7 @@ Thin or demote NSIS to “key-wizard offline only” (or drop from primary downl - [ ] Site **primary** Windows download points at signed full MSI (`VeraePrintStamp-windows-*-.msi`). - [ ] NSIS `setup.exe` linked as **alternate** only (or removed from primary CTA) — not the default button. -- [ ] `DOWNLOADS-MANIFEST.txt` checksums refreshed for the promoted MSI (and remaining NSIS if kept). +- [ ] `DOWNLOADS-MANIFEST.txt` checksums refreshed for the promoted MSI (and remaining NSIS if kept) — use [`fill-manifest-sha256.ps1`](../scripts/fill-manifest-sha256.ps1) after upload (script does **not** upload). - [ ] Release notes / PACKAGING state MSI as primary full-product Windows install. - [ ] OPEN-ISSUES Issue 1 **Still left** no longer lists dual-ship gate / thin-NSIS / “NSIS still primary”. @@ -254,4 +276,5 @@ Do **not** put PFX bytes or passwords in git. Do not upload the PFX as a workflo | Sign/notary draft | [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md) | | Menubar CI notary example | [../../macos/menubar/ci-notarize.yml.example](../../macos/menubar/ci-notarize.yml.example) | | Site 0.3.6 placeholders | [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) · [DOWNLOADS-MANIFEST.txt](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.txt) | +| Local SHA-256 → manifest rows | [../scripts/fill-manifest-sha256.ps1](../scripts/fill-manifest-sha256.ps1) (hash only; no upload) | | Commercial backlog | [docs/COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md) | diff --git a/platform/windows/wix/README.md b/platform/windows/wix/README.md index e9fd053..39064bf 100644 --- a/platform/windows/wix/README.md +++ b/platform/windows/wix/README.md @@ -172,6 +172,7 @@ day-to-day full product. **Not** Authenticode-signed; printer CAs remain | `README.md` | This file | | `../scripts/build-tray-msi.ps1` | Tray candle/light driver; WiX tip exit 0 if missing | | `../scripts/build-full-msi.ps1` | Full StageFull + candle/light; WiX missing → exit 1 | +| `../scripts/fill-manifest-sha256.ps1` | Hash built MSI/NSIS → DOWNLOADS-MANIFEST row (no upload) | ### Relation to other Windows paths @@ -182,6 +183,7 @@ day-to-day full product. **Not** Authenticode-signed; printer CAs remain | `../scripts/build-tray-startmenu.ps1` | WiX-free Start Menu + Startup | | `../scripts/build-tray-msi.ps1` | Builds tray presence MSI when WiX is installed | | `../scripts/build-full-msi.ps1` | Stages StageFull + builds full MSI when WiX is installed | +| `../scripts/fill-manifest-sha256.ps1` | Local SHA-256 rows for site DOWNLOADS-MANIFEST (no upload) | | `../installer-windows.nsi` | Elevated **full product** setup.exe (primary until MSI validated) | | **`wix/` (this folder)** | Tray skeleton + full Product-Full authoring | diff --git a/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md b/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md index 4387679..4818adc 100644 --- a/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md +++ b/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md @@ -118,7 +118,7 @@ UI install is fine for smoke; `/qn` proves fleet syntax. |------|---| | Record logs + exit codes in release notes / dual-ship folder | ☐ | | Authenticode still left → SmartScreen warn is **not** promote-ready | ☐ | -| Update site `DOWNLOADS-MANIFEST` digests only after upload (0.3.6 rows are TBD until then) | ☐ | +| Update site `DOWNLOADS-MANIFEST` digests only after upload (0.3.6 rows are TBD until then); hash with `fill-manifest-sha256.ps1` (no upload) | ☐ | | Thin-NSIS only when DUAL-SHIP exit checklist **A–D** all checked | ☐ | **Overall dual-ship gate:** open / closed · notes: _______________________________ diff --git a/site/printit.verae.ai/DOWNLOADS-MANIFEST.md b/site/printit.verae.ai/DOWNLOADS-MANIFEST.md index 2e39322..bf2ec85 100644 --- a/site/printit.verae.ai/DOWNLOADS-MANIFEST.md +++ b/site/printit.verae.ai/DOWNLOADS-MANIFEST.md @@ -6,7 +6,7 @@ Human-readable companion to [`DOWNLOADS-MANIFEST.txt`](DOWNLOADS-MANIFEST.txt) ( **Last-published CDN blobs:** mostly **0.3.2** (Windows amd64 NSIS / macOS / Linux) or **0.1.2** (Windows arm64, `.deb`, bare `.zip`). **Rule:** do not replace a checksum line until the matching artifact is built, signed (when required), uploaded, and the digest verified. `TBD` is intentional — not a shipping claim. -Related: [DUAL-SHIP.md](../../platform/windows/wix/DUAL-SHIP.md) · [VM-DUAL-SHIP-CHECKLIST.md](../../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) · [COMMERCIAL-INSTALLER-BACKLOG.md](../../docs/COMMERCIAL-INSTALLER-BACKLOG.md). +Related: [DUAL-SHIP.md](../../platform/windows/wix/DUAL-SHIP.md) · [VM-DUAL-SHIP-CHECKLIST.md](../../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) · [COMMERCIAL-INSTALLER-BACKLOG.md](../../docs/COMMERCIAL-INSTALLER-BACKLOG.md) · [`fill-manifest-sha256.ps1`](../../platform/windows/scripts/fill-manifest-sha256.ps1) (local hash → manifest row; **does not upload**). --- @@ -32,15 +32,26 @@ TBD VeraePrintStamp-windows-arm64-0.3.6.msi TBD verae-print-windows-amd64-0.3.6.exe ``` -After upload: +After upload (hash only — this helper does **not** upload): + +```powershell +# Windows (preferred): SHA256SUMS-style rows for DOWNLOADS-MANIFEST.txt +powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 ` + -Path .\VeraePrintStamp-windows-amd64-0.3.6-setup.exe, + .\VeraePrintStamp-windows-amd64-0.3.6.msi +# -Format both → also print Markdown table rows for this file +# -AsName when local build name ≠ reserved CDN filename +``` ```bash -# From the directory that holds the release blobs: +# From the directory that holds the release blobs (POSIX equivalent): shasum -a 256 VeraePrintStamp-windows-amd64-0.3.6-setup.exe \ VeraePrintStamp-windows-amd64-0.3.6.msi # Paste hex digests over TBD in DOWNLOADS-MANIFEST.txt (and this table). ``` +Helper: [`fill-manifest-sha256.ps1`](../../platform/windows/scripts/fill-manifest-sha256.ps1) · dual-ship runbook: [DUAL-SHIP.md](../../platform/windows/wix/DUAL-SHIP.md). + --- ## Last-published (live checksums in `.txt`) @@ -60,5 +71,5 @@ Exact digests: see [`DOWNLOADS-MANIFEST.txt`](DOWNLOADS-MANIFEST.txt). ## Operator notes 1. Site product string may say **0.3.6** while CDN still serves **0.3.2** — that lag is documented on `index.html` and here. -2. Filling TBD without uploading the blob breaks mirror checks; always upload first, hash second, rewrite third. +2. Filling TBD without uploading the blob breaks mirror checks; always upload first, hash second (`fill-manifest-sha256.ps1`), rewrite third. 3. Dual-ship print checklist for clean VMs: [VM-DUAL-SHIP-CHECKLIST.md](../../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md). diff --git a/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt b/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt index 7c7c1e3..6409c74 100644 --- a/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt +++ b/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt @@ -46,6 +46,7 @@ TBD VeraePrintStamp-windows-arm64-0.3.6.msi # Optional companion EXE (parity with prior 0.3.x bare helper uploads): TBD verae-print-windows-amd64-0.3.6.exe # See also DOWNLOADS-MANIFEST.md (human table) and VM-DUAL-SHIP-CHECKLIST.md. +# Fill digests: platform/windows/scripts/fill-manifest-sha256.ps1 -Path (prints rows; does not upload). 56cb72d8d65c5d2e1292b0a05f235ded0a267e66530229a53980887fc5de1b72 verae-print-windows-amd64-0.3.1.exe aa2e7f1843ccbd4d466c66e92a5460f0e3d499e6af0dcba2f93cbd49bc2012e5 verae-print-windows-amd64-0.3.2.exe 079482b38ae3b49b268863209e309bb35072a3ec136f076f0ec5062d67a7c26e verae-print_0.1.2_amd64.deb diff --git a/site/printit.verae.ai/certificate.html b/site/printit.verae.ai/certificate.html index f9f26b7..908e151 100644 --- a/site/printit.verae.ai/certificate.html +++ b/site/printit.verae.ai/certificate.html @@ -8,9 +8,57 @@ - - - + +