Release v1.3.2 (84df706) · BrightSpots/rcv

Updates for v1.3.2 have been tested only on Windows OS. v1.3.2 is for installation on Windows OS only

v1.3.2 was certified in the state of California on April 22, 2024.

What's Changed

Explicit TDP instructions for a secure, hardened OS install with secure BIOS
TDP instructions for two Windows OS accounts. One Administrator level Windows account for installation and initial configuration. A separate ‘RCTab’ Windows standard account for running the tabulation with only necessary permissions that will not have access to make administrative changes to the machine that could be a security issue
Read-Only RCTab output files, each with a corresponding read-only .hash file that contains the SHA512 hash of file contents to ensure they haven’t been edited
Automatic, programmatic verification of the cryptographic signature of all input CVRs using FIPS 140-2 certified libraries. This verification step ensures both the integrity (CVR contents have not been edited) and provenance (CVRs came from the Hart voting system) of the Hart CVRs. RCTab will throw a halting error and tabulation will not begin if cryptographic validation of Hart’s CVR signature is not successful.
Major updates in the TDP throughout section 07 (I-M) to specifically address the California Voting System Standards section 9.6 System Security Specification
Gradle caches package is built with release to enable airgapped build

make all output files read-only (#687) by @artoonie in #749
include SHA256 for output files (#752) cherry-pick onto 1.3.2 by @artoonie in #758
RSA Validation: Cherry-Picked ont 1.3.2 release by @artoonie in #764
no saving into user accounts (cherry-pick onto 1.3.2) by @artoonie in #768
FIPS Compliance by @artoonie in #765
Allow bouncycastle to build on non-Oracle JDKs by @artoonie in #769
downgrade bouncycastle by @artoonie in #773
bump version number to 1.3.2 by @artoonie in 0eacbb4
fix too strict security provider checking by @artoonie in c15bf17

Full Changelog: v1.3.1...v1.3.2