Keymaker v2.2.0

Keymaker v2.2.0, writing KEYM v3 containers. Those are two
different version numbers and they move independently — see the bottom of these
notes if a file will not open.

What changed

Keymaker v2.2.0 — a design release.

The container format, ciphers and key derivation are unchanged: v2.2.0 reads
and writes exactly what v2.1.0 did, and the frozen fixture corpus in CI is
what says so.

What changed is the surface, and how much of it is now checked by a machine
rather than by eye:

• The container inspector summarises before it itemises. An empty form no
  longer gets a header hex row and a slot table describing a file nobody has
  made yet.
• The display face is Plus Jakarta Sans, and it actually ships. The stacks
  previously led with Satoshi, which was never vendored and so was never drawn.
• Disabled controls are drawn rather than dimmed. The old 50%-opacity
  treatment composited the filled primary to a mid-grey pill that read as an
  ordinary, available button.
• Advanced asks two questions instead of presenting one wall.
• A cipher-field plate sits behind the hero, and you can see it.
• Icons are rationed from six sizes to three, each with a job.

Three new gates, each sabotaged and shown to fail before being trusted: icon
sizes, hero-plate visibility and contrast, and service-worker precache
integrity. All three read what the browser painted rather than what the source
says, because every defect they catch was invisible in the source.

Two fixes worth naming, both checks that could not fail. The freeze-warning
test had been red on main in firefox through three merges while reporting the
app as broken when the app was right. And the v2.1.0 release notes said
'KEYM v2' while the app wrote v3, with a test asserting the same literal the
generator hard-coded.

Verifying this release

Two checks, and they answer different questions. Neither of them asks you to
trust this project's own tooling.

1. The files are the ones this tag produced.

tar -xzf keymaker-v2.2.0.tar.gz && cd keymaker-v2.2.0
sha256sum -c SHA256SUMS

sha256sum is on every Unix machine and has nothing to do with this project,
which is the point.

2. This repository's release workflow is what signed that manifest.

cosign verify-blob \
  --bundle SHA256SUMS.sigstore \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity 'https://github.com/404SecNotFound/Keymaker-v2/.github/workflows/release.yml@refs/tags/v2.2.0' \
  SHA256SUMS

Keyless signing: there is no published key to obtain and therefore no key
distribution to get wrong. The check is not "signed by a key we told you about"
— it is "signed by this workflow, in this repository", and
--certificate-identity is the flag that makes it so. Without it,
cosign verify-blob accepts a signature from anybody and says "Verified OK".

Note that the identity above ends in release.yml@refs/tags/v2.2.0, while
docs/VERIFYING.md gives deploy.yml@refs/heads/main for
the live site. Different workflows sign the two things, so they are different
identities and neither will verify the other. That document is where these
commands come from — they are generated from it, not maintained beside it.

What this artifact is

The site as built from this tag, with the Pages base path, so it is directly
comparable to a deployment of the same commit.

Not byte-identical to whatever the live site is serving right now, and it would
be dishonest to imply otherwise: the live site tracks main, so unless the
deployment is of this exact tag it is a different commit. The two are also
labelled differently on purpose — a build from this workflow says
v2.2.0, a rolling deployment says v2.2.0-dev — so that a
version number never names an artifact you are not running. Each is verified
against its own signing identity; neither is offered as a proxy for the other.

It is built with the Pages base path, so it expects to be served from
/Keymaker-v2/. That makes it a verification artifact rather than a drop-in
for hosting elsewhere; to host it at another path, build from source, which
docs/VERIFYING.md also covers.

Container format

This release writes KEYM v3 containers. The format is specified in
docs/FORMAT-V3-DESIGN.md and implemented
independently in reference/keym2.py, which decrypts your
files without this application, this website, or a browser. If this project
disappears, that file and the printed procedure in
docs/RECOVERY.md are enough.

v2.2.0 is the application version. KEYM v3 is the format version. They are
separate numbers on purpose, because they answer different questions: which app
you are running, and which file you are holding. A file that will not open is
almost always a question about the second.