CrowFlix v0.5.1

CrowFlix v0.5.1 Windows desktop release.

Build:

• Commit: b9cbf3fad449f82d0ebbae2657ba7b6b448ef5ae
• Platform: Windows x64
• Installer SHA-256: e685dcfef2b8a3489f91eed558174b96b0ddf7bd86c6937a557d4e00f9017812

Release changes:

[0.5.1] - 2026-07-31

Security

• Removed pathname check-then-read races from release-time dependency-licence
  collection. Files are now opened once, validated and read through the same
  bounded descriptor, eliminating the CodeQL js/file-system-race finding.
• Rejected malformed dependency paths and enforced lexical and physical
  containment for package manifests, dependency-declared licence files and
  checked-in licence overrides.

Changed

• Kept repeated release builds isolated by clearing only the dedicated,
  generated NSIS bundle output before each build, so an installer from an older
  version cannot be mistaken for a current release artifact.
• Strengthened the release checklist to require a completed CodeQL analysis
  with no unresolved findings before tagging.
• Installed playback, catalogue and user-data behaviour is unchanged. This
  patch hardens release tooling; there is no evidence that the v0.5.0 installer
  was exploited or contained the affected build-time code path.

Known limitation:

Signing status: UNSIGNED. The installer and application executable are not Authenticode-signed because this project does not currently have a trusted code-signing certificate. Windows may therefore show an unrecognized-publisher warning.

Before running the installer:

1. Compare its SHA-256 digest with the included .sha256 sidecar.

2. Verify the GitHub build-provenance attestation with:

   gh attestation verify <installer> --repo CrowLoki/Crow-Flix

The checksum proves file integrity only when obtained through a trusted channel; it is not a substitute for Authenticode signing.