PrintToVeraeTimeStamp/docs/PUBLISH-DIGESTS.md

Publish digests — DOWNLOADS-MANIFEST after sign

Operator runbook for filling site/printit.verae.ai/DOWNLOADS-MANIFEST.txt and the human table in DOWNLOADS-MANIFEST.md after Windows (and other) release blobs are built, signed when required, and uploaded to the CDN.

Helper: platform/windows/scripts/fill-manifest-sha256.ps1
Does not: upload, sign, rewrite site files, or touch CI secrets.
Related: DUAL-SHIP.md · CI-SIGN-NOTARY.md · COMMERCIAL-INSTALLER-BACKLOG.md · .github/workflows/windows-msi-sign.yml.example

---

Order (fail closed)

1. Build — NSIS *-setup.exe and/or full MSI via build-full-msi.ps1 (CI unsigned: windows-msi.yml).
2. Sign — Authenticode on PE + MSI when shipping Windows trust (live CI still left; local dry-run: sign-dry-run.ps1; example workflow: windows-msi-sign.yml.example).
3. Upload — put the same bytes that customers will download on the CDN / release channel under the reserved leaf names (e.g. VeraePrintStamp-windows-amd64-0.3.6.msi).
4. Hash — run fill-manifest-sha256.ps1 on the uploaded (or pre-upload local copy that matches CDN) files.
5. Paste — replace TBD rows in DOWNLOADS-MANIFEST.txt and the sha256 column in DOWNLOADS-MANIFEST.md.
6. Verify — re-download from the public URL and confirm Get-FileHash / shasum -a 256 matches the pasted line.

Do not paste digests for unsigned-only CI smoke MSIs into production manifest rows. Do not fill TBD before upload (mirror checks break).

---

fill-manifest-sha256.ps1

# From repo root (Windows). Paths = the signed blobs you just uploaded (or identical local copies).
powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\fill-manifest-sha256.ps1 `
  -Path .\dist\VeraePrintStamp-windows-amd64-0.3.6-setup.exe,
        .\platform\windows\wix\out\VeraePrintStamp-windows-amd64-0.3.6.msi `
  -Format both

Flag	Effect
-Path	One or more MSI / setup.exe / bare helper EXE paths
-Format txt	SHA256SUMS lines only (default) — paste into DOWNLOADS-MANIFEST.txt
-Format md	Markdown table rows for DOWNLOADS-MANIFEST.md
-Format both	txt, blank line, then md
-AsName <leaf>	Override leaf name when local build name ≠ reserved CDN filename (single path)

Output shape (txt):

<lowercase-hex-sha256>  <leaf-name>

Two spaces between digest and name (same as existing .txt / shasum -a 256).

POSIX equivalent if the script is unavailable:

shasum -a 256 VeraePrintStamp-windows-amd64-0.3.6-setup.exe \
  VeraePrintStamp-windows-amd64-0.3.6.msi
# lowercase hex; paste over TBD

---

0.3.6 Windows dual-ship placeholders

Reserved rows (still TBD until signed publish):

Leaf	Channel
VeraePrintStamp-windows-amd64-0.3.6-setup.exe	NSIS primary (until thin-NSIS exit A–D)
VeraePrintStamp-windows-arm64-0.3.6-setup.exe	NSIS arm64
VeraePrintStamp-windows-amd64-0.3.6.msi	Full MSI dual-ship
VeraePrintStamp-windows-arm64-0.3.6.msi	Full MSI arm64
verae-print-windows-amd64-0.3.6.exe	Optional bare helper

After a successful hash run, replace each matching TBD <leaf> line in .txt and the TBD cell in .md. Leave other series (live 0.3.2 / 0.1.2) unchanged unless those blobs are re-uploaded.

---

What this does not claim

• Authenticode or SmartScreen green (needs live sign + clean-VM proof).
• MSI as site primary download (thin-NSIS checklist still open).
• Automatic site deploy from CI (no publish job rewrites manifests).
• macOS notary staple (separate: NOTARIZE-CHECKLIST.md / ci-notarize.yml.example).

---

License

UNLICENSED © Verae — operator docs only.