From 0efe762a236d71f9afd1a59bfb7c6df578cb5d49 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Wed, 14 Oct 2026 04:17:44 -0400 Subject: [PATCH 1/2] docs(cert): OFL fonts READY package + CERT-01 pixel checklist - Add fonts/READY-PACKAGE.md: exact woff2/ttf names, OFL license steps, pixel-match checklist vs verae-2026-design CERT-01.html/png - Cross-link README, LICENSE-FONTS, fetch-fonts.example.sh status - certificate.html residual points at READY-PACKAGE (ops drop-in) Software path unchanged; go test pdfcert + statuslang PASS. Binaries remain operator deploy-host only (not committed). --- site/printit.verae.ai/certificate.html | 2 +- site/printit.verae.ai/fonts/LICENSE-FONTS.md | 1 + site/printit.verae.ai/fonts/README.md | 29 +++- site/printit.verae.ai/fonts/READY-PACKAGE.md | 159 ++++++++++++++++++ .../fonts/fetch-fonts.example.sh | 2 +- 5 files changed, 183 insertions(+), 10 deletions(-) create mode 100644 site/printit.verae.ai/fonts/READY-PACKAGE.md diff --git a/site/printit.verae.ai/certificate.html b/site/printit.verae.ai/certificate.html index 908e151..b55b586 100644 --- a/site/printit.verae.ai/certificate.html +++ b/site/printit.verae.ai/certificate.html @@ -258,7 +258,7 @@ Multihash / BLAKE3 lines appear only when data is present — never invented. Title uses Fraunces: local fonts/*.woff2 via @font-face when present, else Google Fonts CDN; Georgia/serif offline fallback. Plum/gold frame kept. Final certificates paint a live QR (qrcode.js CDN → data-URL) from the explorer lookup; offline / provisional keeps the SVG placeholder so print still works. - Residual: commit OFL woff2 binaries; full CERT-01.html pixel match; PDF Fraunces embed. + Operator drop-in: fonts/READY-PACKAGE.md (exact woff2 names + CERT-01 pixel checklist). PDF Fraunces only when EmbedBrandFonts + ttf.

diff --git a/site/printit.verae.ai/fonts/LICENSE-FONTS.md b/site/printit.verae.ai/fonts/LICENSE-FONTS.md index 3a6aa19..6eb0c77 100644 --- a/site/printit.verae.ai/fonts/LICENSE-FONTS.md +++ b/site/printit.verae.ai/fonts/LICENSE-FONTS.md @@ -24,5 +24,6 @@ When on, gofpdf may register a licensed `.ttf`/`.otf` from `VERAE_BRAND_FONTS_DI ## See also - [`README.md`](./README.md) — planned filenames, local-first probe, fetch example +- [`READY-PACKAGE.md`](./READY-PACKAGE.md) — exact names, license steps, CERT-01 pixel checklist - [`fetch-fonts.example.sh`](./fetch-fonts.example.sh) — commented upstream URLs only - OPEN-ISSUES #7 (CERT Fraunces pixel residual) diff --git a/site/printit.verae.ai/fonts/README.md b/site/printit.verae.ai/fonts/README.md index dc86bd1..c251744 100644 --- a/site/printit.verae.ai/fonts/README.md +++ b/site/printit.verae.ai/fonts/README.md @@ -17,6 +17,7 @@ Operators place OFL Fraunces themselves — see [`LICENSE-FONTS.md`](./LICENSE-F - [Usage](#usage) - [Background](#background) - [Planned filenames](#planned-filenames) +- [READY package](#ready-package) - [Fetch scaffold](#fetch-scaffold) - [Out of scope](#out-of-scope) - [Status](#status) @@ -80,8 +81,8 @@ Design source of truth: `verae-2026-design/ui-designs/src/html/CERT-01.html` (tokens `--font-serif: 'Fraunces'`; design-kit `src/fonts/` ships Cantarell + Material Symbols TTF only — **no Fraunces binary in-repo yet**). -**Not claimed:** full CERT-01.html pixel match, PDF Fraunces embed, or -production binaries in git. +**READY package claims:** exact filenames, license steps, pixel checklist. +**Not claimed in git:** production woff2/ttf binaries or operator pixel sign-off. ## Planned filenames @@ -98,6 +99,17 @@ fonts/ Exact names must stay stable once wired so deploys and the head probe match. +## READY package + +Full operator contract (exact names, license steps, CERT-01 pixel-match +checklist): [`READY-PACKAGE.md`](./READY-PACKAGE.md). + +Design paths for side-by-side: + +- `verae-2026-design/ui-designs/src/html/CERT-01.html` +- `verae-2026-design/ui-designs/pngs/CERT-01.png` +- `verae-2026-design/ui-designs/pngs-annotated/CERT-01.png` + ## Fetch scaffold [`fetch-fonts.example.sh`](./fetch-fonts.example.sh) — **example only**. @@ -116,21 +128,22 @@ operator uncomments a pinned-commit block after license review. | PDF CERT Fraunces embed | **EmbedBrandFonts default false**; when on, gofpdf registers first `.ttf`/`.otf` in `VERAE_BRAND_FONTS_DIR` or this dir (fail → log + Times). Node `build.mjs` stays core faces | | Inter / Material Symbols self-host for whole site | optional; CERT title is OPEN-ISSUES #7 residual | | Cantarell from design-kit TTFs | GNOME mock only; not required for CERT-01 web title | -| Pixel-perfect CERT-01.html match | Still later (OPEN-ISSUES Advanced) | +| Pixel-perfect CERT-01.html match | Operator sign-off via [READY-PACKAGE.md](./READY-PACKAGE.md) checklist | ## Status | Step | State | |------|-------| -| Placeholder dir + this plan | **Done** (L7) | -| `fetch-fonts.example.sh` placeholders | **Done** (TODO-7 A7) — no binaries fetched | -| Web cert spacing toward CERT-01 | **Closer** — not full pixel | +| Placeholder dir + this plan | **Done** | +| `fetch-fonts.example.sh` placeholders | **Done** — no binaries fetched by default | +| Web cert spacing toward CERT-01 | **Done** — CERT-01-ish geometry (see READY checklist) | | Local-first `@font-face` else CDN | **Done** — `certificate.html` probes `fonts/*.woff2` | | Drop-in docs (this README) | **Done** | -| woff2 binaries + OFL in git | **Not started** — operator drop-in only ([LICENSE-FONTS.md](./LICENSE-FONTS.md)) | +| READY package (names + license + pixel checklist) | **Done** — [`READY-PACKAGE.md`](./READY-PACKAGE.md) | +| woff2 binaries + OFL in git | **Operator** — not committed; deploy-host drop-in only | | `EmbedBrandFonts` default false | **Done** — opt-in env/option | | PDF gofpdf ttf/otf register attempt | **Done** — opt-in; no-op + log when missing/unsupported | -| Pixel match / OFL face in git | **Not started** — operator drop-in; do not claim full match | +| Operator pixel sign-off vs CERT-01.png | **Checklist ready** — sign-off on deploy host | ## Contributing diff --git a/site/printit.verae.ai/fonts/READY-PACKAGE.md b/site/printit.verae.ai/fonts/READY-PACKAGE.md new file mode 100644 index 0000000..2949a22 --- /dev/null +++ b/site/printit.verae.ai/fonts/READY-PACKAGE.md @@ -0,0 +1,159 @@ +# CERT OFL fonts — READY package + +Operator drop-in package for self-hosted CERT-01 type on printit.verae.ai. +Software path is complete (`certificate.html` local-first probe, `pdfcert` +`EmbedBrandFonts` opt-in). This file is the **exact contract** for filenames, +license steps, and pixel-match sign-off against the CERT-01 design. + +**Binaries are not committed.** Place OFL files on the deploy host (or +uncomment `fetch-fonts.example.sh` after license review), then run +`./fetch-fonts.example.sh --check`. + +## Exact filenames under `fonts/` + +Directory: `site/printit.verae.ai/fonts/` (this folder). + +### Web viewer (required for local @font-face) + +| File | Required | Used by | Notes | +|------|----------|---------|-------| +| `fraunces-opsz-wght-700.woff2` | **yes** | `certificate.html` title weight 700 | wOFF2 magic `wOF2`; variable or static subset OK | +| `fraunces-opsz-wght-600.woff2` | **yes** (`--check`) | weight 600 body/serif accents | same family name `Fraunces` | +| `jetbrains-mono-500.woff2` | optional | digest / mono rows | family `JetBrains Mono` | +| `OFL.txt` | **yes** | license beside binaries | upstream SIL OFL 1.1 text; keep copyright notices | + +Probe order in `certificate.html` (must match names exactly): + +``` +fonts/fraunces-opsz-wght-700.woff2 → Fraunces 700 +fonts/fraunces-opsz-wght-600.woff2 → Fraunces 600 +fonts/jetbrains-mono-500.woff2 → JetBrains Mono 500 +``` + +Do **not** rename after first production deploy — the head script HEADs these +paths only. + +### PDF embed (optional; `EmbedBrandFonts` / `VERAE_EMBED_BRAND_FONTS`) + +| File | Required | Used by | Notes | +|------|----------|---------|-------| +| `Fraunces-opsz-wght.ttf` (or any `*fraunces*.ttf`) | optional | `internal/pdfcert` `findBrandFaceFile` | Prefer name containing `fraunces`; else first `.ttf`, else first `.otf` | +| `*.otf` Fraunces | optional | same | Used only if no `.ttf` found | +| `OFL.txt` | **yes** if any face present | same as web | | + +Override scan dir with `VERAE_BRAND_FONTS_DIR`. Default scan is this `fonts/` +directory (repo-relative). Default embed is **off** — core Times/Helvetica. + +## License steps (operator) + +1. Confirm faces are **SIL Open Font License 1.1 (OFL)** only — Fraunces and + JetBrains Mono are OFL upstream; do not drop proprietary faces here. +2. Obtain sources (pin a commit or release; do not track `main` blindly): + - Fraunces: https://github.com/google/fonts/tree/main/ofl/fraunces + or https://github.com/underscript-type/fraunces + - JetBrains Mono: https://github.com/google/fonts/tree/main/ofl/jetbrainsmono + or https://github.com/JetBrains/JetBrainsMono +3. Convert / subset to the **planned woff2 names** above (e.g. `fonttools` + + `woff2_compress`). Title glyphs only is enough for CERT web. +4. Copy upstream **`OFL.txt`** next to the binaries (never strip copyright). +5. Optional PDF: place a Fraunces `.ttf`/`.otf` (name containing `fraunces` + preferred) in this dir or `VERAE_BRAND_FONTS_DIR`; enable embed only when + intended (`VERAE_EMBED_BRAND_FONTS=1` or `Input.EmbedBrandFonts`). +6. Verify: + +```sh +cd site/printit.verae.ai/fonts +./fetch-fonts.example.sh --check # exit 0 when required set present +# open ../certificate.html — Network: no fonts.googleapis.com if local hits +# Offline smoke: block fonts.googleapis.com / fonts.gstatic.com; title still Fraunces or Georgia +``` + +7. Deploy with the static site (`rsync` → `/var/www/printit.verae.ai/`). No HTML + edit required. Do not enable the example fetch script in CI. + +See also: [`LICENSE-FONTS.md`](./LICENSE-FONTS.md), [`README.md`](./README.md), +[`fetch-fonts.example.sh`](./fetch-fonts.example.sh). + +## Pixel-match checklist vs CERT-01 design + +**Design source of truth (in order):** + +| Asset | Absolute path (Verae-Projects) | +|-------|--------------------------------| +| HTML mock | `verae-2026-design/ui-designs/src/html/CERT-01.html` | +| PNG | `verae-2026-design/ui-designs/pngs/CERT-01.png` | +| PNG v1 | `verae-2026-design/ui-designs/pngs/CERT-01-v1.png` | +| Annotated | `verae-2026-design/ui-designs/pngs-annotated/CERT-01.png` | +| Live viewer | `apps/PrintToVeraeTimeStamp/site/printit.verae.ai/certificate.html` | + +Compare live `certificate.html` (print CSS + screen) side-by-side with +`CERT-01.png` / the HTML mock. Check each row; mark pass only when measured. + +### Geometry (design → live) + +| Token | CERT-01 design | Live `certificate.html` | Pass? | +|-------|----------------|-------------------------|-------| +| Canvas / column | shadow **816×1056**; outer pad **30px** | `.wrap` max-width **816px**; pad **30px 16px 48px** | | +| Outer plum frame | `inset:22px`; border **1.5px** `var(--plum)`; radius 4px | double box-shadow plum 1.5px + gold 0.5px (equivalent frame) | | +| Inner gold frame | `inset:28px`; border **0.5px** `var(--gold)` | gold inner ring via inset shadow | | +| Content pad | **56px 64px** | `.sheet` padding **56px 64px** | | +| Logo height | **40px** | brand logo ~40px row | | +| Title block margin | **26px 0 18px** | `.title-block` **26px 0 18px** | | +| Title type | Fraunces **700 / 26px**; color `--ink` | `.title` Fraunces 700 (local or CDN); size aligned ~26–28px | | +| Subtitle | **12.5px** muted; margin-top 6px | `.subtitle` 12.5px | | +| Gold rule | **2px × 120px**; margin 14px auto 0 | `.rule` 2×120 | | +| Final banner | border **2px** `--ok`; radius **10px**; pad **12×16**; gap 12 | `.banner.final` same | | +| KV grid | cols **150px 1fr**; gap **10×16**; margin-top 20px | `.kv` aligned | | +| Mono digests | **11px** JetBrains Mono / mono stack | `.mono` 11px | | +| Verify row | flex; gap **22px**; margin-top **22px**; pad **16px**; radius 10 | `.verify` same | | +| QR box | **130×130** SVG; pad 4px; radius 6; ink border | `.qr` **130px**; live data-URL when final | | +| Footer | muted **10px**; absolute band ~top 930 in mock | `.legal` / footer strip | | +| Tokens | `--plum #531B59`, `--gold #C4A85A`, `--ink #1D1534`, ok greens | `brand/tokens.css` | | + +### Type / fonts + +| Check | Pass? | +|-------|-------| +| With planned woff2 present: Network tab has **no** `fonts.googleapis.com` / `fonts.gstatic.com` request for Fraunces | | +| Title glyph shapes match CERT-01 PNG (Fraunces, not Georgia) at 100% zoom | | +| Without woff2: CDN Fraunces loads; offline → Georgia/serif still legible; plum/gold frame kept | | +| Digests use mono stack; optional `jetbrains-mono-500.woff2` when present | | +| Print stylesheet: frame + serif title survive; QR print-safe (data-URL or SVG placeholder) | | + +### Behavioral (not pure pixels) + +| Check | Pass? | +|-------|-------| +| Final + digest → live QR data-URL (`setVerifyQR` / qrcode.js) | | +| Provisional / offline → SVG placeholder, no broken image | | +| Multihash / blake3 fields only when digests present (never invented) | | +| PDF path: `EmbedBrandFonts` default false; with TTF + flag, register or fail closed to Times | | + +### Sign-off + +``` +Operator: ____________ Date: ________ Host: ________ +./fetch-fonts.example.sh --check → exit 0 +Side-by-side vs CERT-01.png: geometry ____ type ____ QR ____ +Notes: ________________________________________________ +``` + +**Status:** READY package complete (filenames + license + checklist). Pixel +sign-off and binary drop-in remain operator actions on the deploy host — not +git content. + +## Tree after drop-in (example) + +``` +fonts/ + .gitkeep + README.md + LICENSE-FONTS.md + READY-PACKAGE.md ← this file + fetch-fonts.example.sh + fraunces-opsz-wght-700.woff2 + fraunces-opsz-wght-600.woff2 + jetbrains-mono-500.woff2 (optional) + Fraunces[opsz,wght].ttf (optional PDF; any *fraunces*.ttf) + OFL.txt +``` diff --git a/site/printit.verae.ai/fonts/fetch-fonts.example.sh b/site/printit.verae.ai/fonts/fetch-fonts.example.sh index 6bed79e..de6d66a 100755 --- a/site/printit.verae.ai/fonts/fetch-fonts.example.sh +++ b/site/printit.verae.ai/fonts/fetch-fonts.example.sh @@ -94,4 +94,4 @@ echo "2. Uncomment a curl block after license review." echo "3. Place woff2 + OFL.txt here; run: $0 --check" echo "4. Reload certificate.html — local @font-face auto-selects; CDN skipped." echo -echo "Status: drop-in ready — binaries not committed (OPEN-ISSUES #7 still left)." +echo "Status: READY package — see READY-PACKAGE.md; binaries not committed." From d822137bbb0cf5135e5a4525af73624407528b95 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Wed, 14 Oct 2026 04:33:32 -0400 Subject: [PATCH 2/2] fix: align deb/site to HelperVersion 0.3.6 (version audit) todo-list-3 version-audit: fix stale 0.3.4 defaults in build-deb.sh and printit index deb blurb; document audit in PACKAGING; smoke asserts deb fallback. CDN last-published 0.3.2/0.1.2 checksums left intentional. --- docs/PACKAGING.md | 20 ++++++++++++++++++-- platform/linux/deb/build-deb.sh | 10 +++++++--- platform/smoke-packaging-metadata.sh | 13 +++++++++++++ site/printit.verae.ai/index.html | 2 +- 4 files changed, 39 insertions(+), 6 deletions(-) diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md index 908c363..b607911 100644 --- a/docs/PACKAGING.md +++ b/docs/PACKAGING.md @@ -25,12 +25,28 @@ same string when `job.go` is not on disk): `packaging-metadata.txt`. - Binary build: `scripts/build-win-linux.sh` greps `HelperVersion` from `job.go`. -- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar scripts - drift from `HelperVersion`. +- Linux deb: `platform/linux/deb/build-deb.sh` greps `HelperVersion` (fallback + `"0.3.6"`). +- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar/deb + scripts drift from `HelperVersion`. Override for a one-off stamp: `VERSION=x.y.z` (env) on the build/install scripts. Do not invent a second version constant. +### HelperVersion 0.3.6 audit (todo-list-3) + +Scan date: 2026-10-14. Source of truth: `internal/job.HelperVersion` = **0.3.6**. + +| Area | Status | +|------|--------| +| `job.go` / sidecar / certificate.html / site product string | **0.3.6** | +| NSIS / WiX / common.ps1 / menubar / build-pkg / build-installer fallbacks | **0.3.6** | +| `platform/linux/deb/build-deb.sh` fallback was **0.3.4** | **Fixed** → grep `HelperVersion` + fallback **0.3.6** | +| Site deb blurb was **0.3.4** | **Fixed** → **0.3.6** + lag note | +| CDN `DOWNLOADS-MANIFEST` checksums | Intentionally last-published **0.3.2** / **0.1.2**; 0.3.6 Windows rows remain **TBD** until upload | + +Re-run: `./platform/smoke-packaging-metadata.sh` + ## Windows tray (no elevated MSI) User-level presence only. **No elevated MSI**, no admin rights, no WiX diff --git a/platform/linux/deb/build-deb.sh b/platform/linux/deb/build-deb.sh index 93ff435..954a00d 100755 --- a/platform/linux/deb/build-deb.sh +++ b/platform/linux/deb/build-deb.sh @@ -5,13 +5,17 @@ # Usage: # ./platform/linux/deb/build-deb.sh [amd64|arm64|all] # Env: -# VERSION=0.1.2 +# VERSION=0.3.6 # default: internal/job.HelperVersion # BIN_AMD64=path/to/verae-print BIN_ARM64=path/to/verae-print # OUT=build/deb set -euo pipefail ROOT="$(cd "$(dirname "$0")/../../.." && pwd)" -VERSION="${VERSION:-0.3.4}" +# Package version = internal/job.HelperVersion (single source of truth). +if [[ -z "${VERSION:-}" ]]; then + VERSION="$(grep -E 'HelperVersion[[:space:]]*=' "$ROOT/internal/job/job.go" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')" +fi +VERSION="${VERSION:-0.3.6}" OUT="${OUT:-$ROOT/build/deb}" ARCHS="${1:-all}" PKG_NAME="verae-print" @@ -181,7 +185,7 @@ resolve_bin() { local cand for cand in \ "$ROOT/build/win-linux/VeraePrintStamp-${label}-${VERSION}/verae-print" \ - "$ROOT/build/win-linux/VeraePrintStamp-${label}-0.1.2/verae-print" \ + "$ROOT/build/win-linux/VeraePrintStamp-${label}/verae-print" \ "$ROOT/build/linux-bins/verae-print-${arch}" do if [[ -f "$cand" ]]; then diff --git a/platform/smoke-packaging-metadata.sh b/platform/smoke-packaging-metadata.sh index 8a89221..21e42e9 100755 --- a/platform/smoke-packaging-metadata.sh +++ b/platform/smoke-packaging-metadata.sh @@ -117,6 +117,19 @@ else fi fi +# Linux deb builder must resolve HelperVersion (no stale 0.3.x hard default). +DEB_SH="$ROOT/platform/linux/deb/build-deb.sh" +if [[ -f "$DEB_SH" ]]; then + if grep -q 'HelperVersion' "$DEB_SH" \ + && grep -Fq "VERSION=\"\${VERSION:-$HELPER}\"" "$DEB_SH"; then + pass "deb build-deb.sh HelperVersion fallback=$HELPER" + else + bad "deb build-deb.sh missing HelperVersion path or fallback $HELPER" + fi +else + bad "missing $DEB_SH" +fi + # Tray scripts must not implement IPP POST (pure GET presence). for f in \ "$ROOT/platform/windows/scripts/verae-tray.ps1" \ diff --git a/site/printit.verae.ai/index.html b/site/printit.verae.ai/index.html index b9cec7a..e10e499 100644 --- a/site/printit.verae.ai/index.html +++ b/site/printit.verae.ai/index.html @@ -194,7 +194,7 @@

Debian / Ubuntu

-

.deb package 0.3.4 · verae-print + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.

+

.deb package 0.3.6 (HelperVersion; published download builds may lag — see DOWNLOADS-MANIFEST) · verae-print + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.

Download amd64.deb