Skip to content

BetterPullReview v0.3.1

Latest
Latest

Choose a tag to compare

View all tags
@MikeMarcin MikeMarcin released this 20 Oct 18:32
· 274 commits to main since this release
v0.3.1
2ed7e5f

BetterPullReview 0.3.1

Download and install

System Download
macOS 14.4+ · Apple Silicon and Intel Download DMG
Windows 10/11 · x64 Download MSI
Ubuntu 26.04 · x64 Download DEB

Full agent integrations and local automation are included. On Ubuntu, download
and verify the matching .deb.asc signature before installing.

Changes since 0.3.0

  • Original BetterPullReview code and documentation now carry the MIT License.
    Packages include the original-code licence alongside retained third-party
    notices and licence obligations.
  • Installation and first-review documentation is shorter, with direct platform
    downloads and a private vulnerability-reporting policy.
  • Release publication explicitly supports the now-public repository while
    preserving destination, source, checksum and visibility guards.
  • Linux package auditing recognises exact stripped upstream Qt images through
    their producer metadata while retaining first-party symbol checks.
  • Public pull requests can be previewed on Windows and Linux without signing in.
  • Qt is updated to 6.12.0; new macOS builds require macOS 14.4 or later.
  • Long Review comments scroll to the end without snapping back when native
    overlay scrollbars appear or disappear. The diff text keeps its full viewport.
  • Discuss preserves original comment Markdown, including refreshed bodies.
    Empty Approved and Commented review summaries explain that there is no overall
    review comment and identify linked file comments when present.
  • Opening a New-badged Discuss card marks it read through the existing persistent
    read state, including pointer and keyboard activation. Clearing its New badge
    keeps an open comment menu, reply text and reading position in place.

Verification and distribution

Each platform supplies checksums, SPDX and a separate exact-version
corresponding-source archive. Binary and source access are public through the
same release channel at no additional charge. Corporate/offline redistribution
must include the exact source asset. Source, digests and tags are retained
immutably and indefinitely until all applicable obligations have ended.

macOS uses Developer ID signing and notarization. Windows uses a per-user MSI;
the runtime ZIP is an inventory archive. Ubuntu 26.04 uses a signed DEB and a
per-user archive requiring system dependencies; WSL2 production does not qualify
a clean Ubuntu desktop. Its private ICU 73.2 libraries retain pinned source and
recipient rebuild instructions.

Linux signature verification

The Ubuntu artifacts have detached OpenPGP signatures. Save the complete public
key block below as bpr-release-signing.asc. Its SHA-256 is
c271732f02b5f3c709ad1a61d7f7816200e96226c490fd77d88f6583437f9798.
The approved full fingerprint is
ED85BAA84A3B6D83FCD5B1F107CEC96F2688E4A8.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEasxxjBYJKwYBBAHaRw8BAQdA9KNHnT4d1R2udPXayFCA+/25zFrtQ19mKfZH
egF0Pj20IEJldHRlclB1bGxSZXZpZXcgUmVsZWFzZSBTaWduaW5niJYEExYKAD4W
IQTthbqoSjttg/zVsfEHzslvJojkqAUCasxxjAIbAwUJA8MjpAULCQgHAgYVCgkI
CwIEFgIDAQIeAQIXgAAKCRAHzslvJojkqGLgAQDOsFQeotQcvzDKZ5EyOV5RG9hs
L7mR9PeQBHVq6fsJYAEA90e/kJyl1nPfTaPkxcKVNZPF6iq8KZLsFurdYT4RfQA=
=GIqv
-----END PGP PUBLIC KEY BLOCK-----

Check the saved key's digest and fingerprint before importing it:

sha256sum bpr-release-signing.asc
gpg --show-keys --with-fingerprint bpr-release-signing.asc
gpg --import bpr-release-signing.asc

For each of the six signed Ubuntu products—the DEB, user archive, SPDX,
corresponding-source ZIP, checksum file and provenance—download its matching
.asc signature and run gpg --verify ARTIFACT.asc ARTIFACT, replacing both
names with that exact file. The .release.json manifest is verification
metadata and has no detached signature of its own.
Require a good signature from the full fingerprint above before installation
or use. A detached DEB signature is verified separately; dpkg does not enforce
it. This public key and fingerprint are supplied through the same public
release channel as the signed artifacts.

Known limitations

RFC-BPR-0038 remains open. Clean-account installation, authentication and
platform vaults, native Intel and full Windows/Ubuntu desktop courses,
accessibility, upgrade/removal, resident-material crash privacy, external
hardening and complete vulnerability/fuzz coverage remain incomplete.
Profile purge excludes shared updater/registry state and is not uninstall.

The Ubuntu optimized large-review RSS-growth failure tracked by BPR-1653 is
unresolved. The owner explicitly carries forward the exception for only the unchanged
216 MiB process RSS-growth predicate to v0.3.1. The current optimized course remains failed with that predicate; observed
cache samples stay below 64 MiB. Later cleanup and shutdown checks were not
reached. A dedicated implementer will pursue a
causal repair after publication, preserving the original limits and course.
This exception waives no other test, native, signing, security or source obligation.
Exact artifact and security results are recorded separately; historical findings
and dispositions retain only their original scope.

Installed source-offer clarification: a sentence describing private repository access remains from earlier releases. This release supplies binaries and their exact corresponding-source assets publicly through the same channel at no additional charge. The exact source URLs and digests, redistribution duties, original-channel fallback and indefinite immutable retention remain in force.

Assets 30
Loading