[Feature] Release engineering for 0.1.0

brenno commented

2026-07-22 09:28:36 +00:00

Owner

The umbrella for actually shipping. Everything below was found in the release review; the code work is done, this is the last stretch.

Version to 0.1.0 in one place. It lives in pubspec.yaml and hard-coded in lib/services/export_metadata.dart, which lands in the metadata of every exported PDF and PPTX. Add a test that compares the two, or derive one from the other — otherwise a bumped release ships files that announce the old version.
Show the version in the app. The About panel does not display it, while SECURITY.md asks reporters to state it.
CHANGELOG. Everything sits under [Unreleased]; that becomes one dated version heading.
Windows and Linux still carry the Flutter template identity — com.example in windows/runner/Runner.rc and linux/CMakeLists.txt. Authenticode over a binary naming com.example as publisher is indefensible, and a Flatpak with that app-id is not publishable.
macOS is ad-hoc signed (CODE_SIGN_IDENTITY = "-"), without hardened runtime, so a downloaded copy will not start on someone else's machine. Notarisation requires hardened runtime, so this is not a single flag.
Nothing ships alongside the binary: no LICENSE.md, no THIRD_PARTY_NOTICES.md, no sbom/, no checksums, no signature.
Two of four platforms have never been built or tested. Either arrange a runner per OS, or state plainly that this release is macOS + web and the rest is build-from-source.

The release checklist itself was written out during the review; the order matters, in particular that the artefact is tested from a download on a second machine with the quarantine flag intact. That step is what breaks most first releases.

The umbrella for actually shipping. Everything below was found in the release review; the code work is done, this is the last stretch. - **Version to 0.1.0 in one place.** It lives in `pubspec.yaml` *and* hard-coded in `lib/services/export_metadata.dart`, which lands in the metadata of every exported PDF and PPTX. Add a test that compares the two, or derive one from the other — otherwise a bumped release ships files that announce the old version. - **Show the version in the app.** The About panel does not display it, while `SECURITY.md` asks reporters to state it. - **CHANGELOG.** Everything sits under `[Unreleased]`; that becomes one dated version heading. - **Windows and Linux still carry the Flutter template identity** — `com.example` in `windows/runner/Runner.rc` and `linux/CMakeLists.txt`. Authenticode over a binary naming `com.example` as publisher is indefensible, and a Flatpak with that app-id is not publishable. - **macOS is ad-hoc signed** (`CODE_SIGN_IDENTITY = "-"`), without hardened runtime, so a downloaded copy will not start on someone else's machine. Notarisation requires hardened runtime, so this is not a single flag. - **Nothing ships alongside the binary**: no `LICENSE.md`, no `THIRD_PARTY_NOTICES.md`, no `sbom/`, no checksums, no signature. - **Two of four platforms have never been built or tested.** Either arrange a runner per OS, or state plainly that this release is macOS + web and the rest is build-from-source. The release checklist itself was written out during the review; the order matters, in particular that the artefact is tested from a download on a *second* machine with the quarantine flag intact. That step is what breaks most first releases.

brenno added the

enhancement

accepted

labels

2026-07-22 09:28:36 +00:00

brenno referenced this issue

2026-07-22 11:47:10 +00:00

feat: versie op één plek, zichtbaar in de app, en com.example eruit #544

brenno referenced this issue from a commit

2026-07-22 11:47:11 +00:00

fix(release): com.example weg uit de Windows- en Linux-identiteit

brenno commented

2026-07-22 11:57:42 +00:00

Author

Owner

Administrative half merged (#544): version derived from one constant with a test holding export_metadata.dart to it, version shown in the About panel (translated across all 31 languages), and com.example gone from the Windows and Linux identity. [Unreleased] deliberately left alone — turning it into a dated heading is a release action and yours to take.

Still open here, and none of it is a matter of effort:

Code signing and notarisation. Needs certificates. macOS is ad-hoc signed (CODE_SIGN_IDENTITY = "-") with no hardened runtime, so a downloaded copy will not start on someone else's machine — and notarisation requires hardened runtime, so this is not one flag.
Windows and Linux builds. Never built or tested; that needs those operating systems or a runner per OS. The alternative is stating plainly that this release is macOS + web and the rest is build-from-source — which is an honest option, not a lesser one.
Artefacts alongside the binary (LICENSE, THIRD_PARTY_NOTICES, sbom/, checksums, signature). This follows from having a release process at all, which does not exist yet.

The first two are the gate. Until a downloaded build starts on a machine that is not this one, there is no release to ship.

Administrative half merged (#544): version derived from one constant with a test holding `export_metadata.dart` to it, version shown in the About panel (translated across all 31 languages), and `com.example` gone from the Windows and Linux identity. `[Unreleased]` deliberately left alone — turning it into a dated heading is a release action and yours to take. Still open here, and none of it is a matter of effort: - **Code signing and notarisation.** Needs certificates. macOS is ad-hoc signed (`CODE_SIGN_IDENTITY = "-"`) with no hardened runtime, so a downloaded copy will not start on someone else's machine — and notarisation *requires* hardened runtime, so this is not one flag. - **Windows and Linux builds.** Never built or tested; that needs those operating systems or a runner per OS. The alternative is stating plainly that this release is macOS + web and the rest is build-from-source — which is an honest option, not a lesser one. - **Artefacts alongside the binary** (LICENSE, THIRD_PARTY_NOTICES, `sbom/`, checksums, signature). This follows from having a release process at all, which does not exist yet. The first two are the gate. Until a downloaded build starts on a machine that is not this one, there is no release to ship.

brenno added the

triage

label

2026-07-22 11:57:42 +00:00

brenno referenced this issue

2026-07-22 13:42:57 +00:00

[Feature] Publish a light-weight voluntary security attestation (COMPLIANCE.md) #549

brenno referenced this issue

2026-07-22 13:43:30 +00:00

[Feature] An end-of-life and support-period policy (EL.01) #551

brenno referenced this issue

2026-07-22 13:43:48 +00:00

[Feature] A channel someone can subscribe to for security notifications #552

brenno referenced this issue

2026-07-22 13:44:35 +00:00

[Feature] Machine-readable project metadata, so a third party can attest without asking #555

brenno referenced this issue

2026-07-22 16:16:33 +00:00

[Docs] The README never says this is an unreleased alpha #582

brenno referenced this issue

2026-07-22 16:16:35 +00:00

[Docs] There is not a single screenshot of a tool whose entire purpose is visual #585

brenno referenced this issue

2026-07-22 16:18:14 +00:00

[Feature] Label a first issue, and write down how accepted and declined are decided #596

brenno referenced this issue

2026-07-22 16:18:17 +00:00

[Docs] The FAQ claims a client-side-only architecture with no backend #602

brenno referenced this issue

2026-07-22 16:21:55 +00:00

[Bug] The version constant says 0.2.0 while the release is called 0.1.0 #629

brenno commented

2026-07-22 16:41:23 +00:00

Author

Owner

Scope decided 2026-07-22: 0.1.0 is web only. Desktop is build-from-source, stated plainly as such rather than as a lesser option.

What that settles, and it settles most of this issue:

Code signing and notarisation drop out of 0.1.0 entirely. They were the gate — 'until a downloaded build starts on a machine that is not this one, there is no release to ship' — and a web bundle has no such problem. They come back the day a desktop artefact ships, and this issue's reasoning about hardened runtime still stands for then.
The Windows and Linux question drops out too. Never built, never tested; saying so is now the published position instead of an open item.
What remains is buildable without any certificate: the [Unreleased] heading becomes a dated version, the artefacts travel alongside the bundle (LICENSE, THIRD_PARTY_NOTICES, sbom/, checksums), and there is a documented way to verify what you downloaded.

The tag itself stays yours — that is the one irreversible, outward-facing step.

Next: I will prepare everything up to the tag, but only after the privacy and security queue from the pre-publication review, per the project's own ordering rule. Those are the findings that would be permanent the moment anything is published.

**Scope decided 2026-07-22: 0.1.0 is web only.** Desktop is build-from-source, stated plainly as such rather than as a lesser option. What that settles, and it settles most of this issue: - **Code signing and notarisation drop out of 0.1.0 entirely.** They were the gate — 'until a downloaded build starts on a machine that is not this one, there is no release to ship' — and a web bundle has no such problem. They come back the day a desktop artefact ships, and this issue's reasoning about hardened runtime still stands for then. - **The Windows and Linux question drops out too.** Never built, never tested; saying so is now the published position instead of an open item. - **What remains is buildable without any certificate:** the `[Unreleased]` heading becomes a dated version, the artefacts travel alongside the bundle (LICENSE, THIRD_PARTY_NOTICES, `sbom/`, checksums), and there is a documented way to verify what you downloaded. The tag itself stays yours — that is the one irreversible, outward-facing step. Next: I will prepare everything up to the tag, but only after the privacy and security queue from the pre-publication review, per the project's own ordering rule. Those are the findings that would be permanent the moment anything is published.

brenno removed the

triage

label

2026-07-22 16:41:23 +00:00

brenno referenced this issue

2026-07-22 17:19:14 +00:00

[Docs] Disclose that two thirds of the commits have an AI co-author #595

brenno added the

in-progress

label

2026-07-22 17:41:37 +00:00

brenno commented

2026-07-22 17:41:50 +00:00

Author

Owner

Opgepakt. Tak: feat/release-artefacten. Reikwijdte: Makefile (build-web), een nieuw tool/-script voor de checksums, docs/BUILD.md en docs/HOSTING.md voor de verificatieroute, plus een test die bewaakt dat de artefacten blijven meereizen. Buiten scope, en blijft van jou: de tag zelf.

Opgepakt. Tak: `feat/release-artefacten`. Reikwijdte: `Makefile` (build-web), een nieuw `tool/`-script voor de checksums, `docs/BUILD.md` en `docs/HOSTING.md` voor de verificatieroute, plus een test die bewaakt dat de artefacten blijven meereizen. Buiten scope, en blijft van jou: de tag zelf.

brenno referenced this issue from a commit

2026-07-22 17:55:30 +00:00

feat(release): laat licentie, derdenverklaring en een checksumlijst met de webbundel meereizen (#520)

brenno referenced this issue from a commit

2026-07-22 17:55:30 +00:00

docs(release): schrijf op wat met de bundel meereist, hoe je hem nakijkt, en dat 0.1.0 web-only is (#520)

brenno referenced this issue from a commit

2026-07-22 18:09:11 +00:00

fix(release): bronaanwijzing erbij, machinegebonden bestand eruit (#520)

brenno referenced this issue from a pull request that will close it,

2026-07-22 18:10:02 +00:00

feat(release): laat de webbundel met licentie, bron, SBOM en checksums reizen (#520) #665

brenno closed this issue

2026-07-22 18:10:13 +00:00

brenno referenced this issue from a commit

2026-07-22 18:10:14 +00:00

Merge pull request 'feat(release): laat de webbundel met licentie, bron, SBOM en checksums reizen (#520)' (#665) from feat/release-artefacten into main

brenno commented

2026-07-22 18:10:45 +00:00

Author

Owner

Klaar en op main in 908c9719 (PR #665). Daarmee is alles wat zonder certificaat te bouwen was gedaan.

Wat er landde

LICENSE.md, THIRD_PARTY_NOTICES.md, SOURCE.md en de SBOM reizen met de webbundel mee; SHA256SUMS sluit af, in het gewone sha256sum-formaat.
De web-only-positie staat nu in docs/KNOWN_LIMITATIONS.md in plaats van alleen hier.
Verificatieroute in docs/BUILD.md, met de grenzen erbij: het is geen handtekening, en het vangt géén compromittering van onze eigen publicatieketen.

Twee dingen die de bewakerreview opleverde en die het issue niet noemde

De bundel reisde zonder bronaanwijzing. main.dart.js is gecompileerd, en EUPL-1.2 artikel 5 vraagt bij distribueren of communiceren om de bron of een aanwijzing ernaartoe — artikel 1 rekent hosten daaronder. De repo-URL stond alleen in .well-known/security.txt, dat een herhoster door zijn eigen vervangt. Vandaar SOURCE.md.
.last_build_id werd mee verzegeld. De inhoud is een md5 over onder meer het absolute pad van de uitvoermap op de bouwmachine, dus wie zelf bouwt kreeg gegarandeerd een andere digest dan de aankondiging — bij byte-identieke bron. De enige controle die een zelf-bouwer een onafhankelijk oordeel geeft, stond structureel op rood.

Niet gedraaid: make check-secrets en make sast — gitleaks, trufflehog en semgrep staan geen van drieën op deze machine. Deze wijziging voegt geen sleutel, netwerkpad of afhankelijkheid toe, maar de eis is daarmee niet gehaald.

Wat overblijft is van jou: de tag zelf, en de [Unreleased]/0.1.0 — unreleased-kop een datum geven. Dat is de onomkeerbare, naar buiten gerichte stap. Wil je dit issue als drager daarvan houden, dan heropen je hem met één klik.

Klaar en op main in `908c9719` (PR #665). Daarmee is alles wat zonder certificaat te bouwen was gedaan. **Wat er landde** - `LICENSE.md`, `THIRD_PARTY_NOTICES.md`, `SOURCE.md` en de SBOM reizen met de webbundel mee; `SHA256SUMS` sluit af, in het gewone `sha256sum`-formaat. - De web-only-positie staat nu in `docs/KNOWN_LIMITATIONS.md` in plaats van alleen hier. - Verificatieroute in `docs/BUILD.md`, met de grenzen erbij: het is geen handtekening, en het vangt géén compromittering van onze eigen publicatieketen. **Twee dingen die de bewakerreview opleverde en die het issue niet noemde** - De bundel reisde zonder bronaanwijzing. `main.dart.js` is gecompileerd, en EUPL-1.2 artikel 5 vraagt bij distribueren *of communiceren* om de bron of een aanwijzing ernaartoe — artikel 1 rekent hosten daaronder. De repo-URL stond alleen in `.well-known/security.txt`, dat een herhoster door zijn eigen vervangt. Vandaar `SOURCE.md`. - `.last_build_id` werd mee verzegeld. De inhoud is een md5 over onder meer het absolute pad van de uitvoermap op de bouwmachine, dus wie zelf bouwt kreeg gegarandeerd een andere digest dan de aankondiging — bij byte-identieke bron. De enige controle die een zelf-bouwer een onafhankelijk oordeel geeft, stond structureel op rood. **Niet gedraaid:** `make check-secrets` en `make sast` — gitleaks, trufflehog en semgrep staan geen van drieën op deze machine. Deze wijziging voegt geen sleutel, netwerkpad of afhankelijkheid toe, maar de eis is daarmee niet gehaald. **Wat overblijft is van jou:** de tag zelf, en de `[Unreleased]`/`0.1.0 — unreleased`-kop een datum geven. Dat is de onomkeerbare, naar buiten gerichte stap. Wil je dit issue als drager daarvan houden, dan heropen je hem met één klik.

brenno referenced this issue

2026-07-31 09:52:34 +00:00

Windows-releaseartefacten ondertekenen (Authenticode) #1013

brenno referenced this issue

2026-07-31 09:52:35 +00:00

Linux-releaseartefacten ondertekenen (detached signature) #1014

brenno referenced this issue from a commit

2026-07-31 09:55:36 +00:00

docs(assurance): ENISA-mapping — open punten wegen, issues koppelen

brenno referenced this issue

2026-07-31 09:55:52 +00:00

docs(assurance): ENISA-mapping — open punten wegen en aan issues koppelen #1016