Add unsigned Windows reproducibility proofs

.github/workflows/desktop-pr-build.yml

@@ -138,7 +138,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # was stable
         with:
-          toolchain: 1.95.0
+          toolchain: 1.88.0
 
       - name: Install sccache
         shell: bash
@@ -170,61 +170,9 @@ jobs:
             ${{ runner.os }}-sccache-windows-
             ${{ runner.os }}-sccache-
 
-      - name: Provide ONNX Runtime (Windows)
-        shell: bash
-        run: |
-          ./frontend/src-tauri/scripts/provide-windows-onnxruntime.sh >> "$GITHUB_ENV"
-
-      - name: Stage Windows runtime DLLs for bundling
-        shell: pwsh
-        run: |
-          # maple.exe links onnxruntime.dll by ordinal; without these next to the
-          # exe the loader binds to the OS Windows-ML onnxruntime.dll (v1.17) and
-          # TTS hangs at Session::builder. See resources/windows/README.md.
-          $dest = "frontend/src-tauri/resources/windows"
-          New-Item -ItemType Directory -Force -Path $dest | Out-Null
-          # ONNX Runtime 1.22.0 (already downloaded + SHA-verified; path in env)
-          Copy-Item "$env:ORT_DYLIB_PATH" (Join-Path $dest "onnxruntime.dll") -Force
-          # MSVC C++ runtime DLLs onnxruntime.dll depends on. Find a source dir
-          # holding all four, independent of the runner's VS year/edition: prefer
-          # the versioned redist (located via vswhere), fall back to System32.
-          $crtDlls = 'VCRUNTIME140.dll','VCRUNTIME140_1.dll','MSVCP140.dll','MSVCP140_1.dll'
-          $candidates = @()
-          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
-          if (Test-Path $vswhere) {
-            $vs = & $vswhere -latest -products * -property installationPath
-            if ($vs) {
-              $candidates += Get-ChildItem (Join-Path $vs 'VC\Redist\MSVC\*\x64') -Directory -ErrorAction SilentlyContinue |
-                             Where-Object { $_.Name -match '^Microsoft\.VC\d+\.CRT$' } | ForEach-Object FullName
-            }
-          }
-          $candidates += "$env:WINDIR\System32"
-          $src = $candidates | Where-Object { $d = $_; -not ($crtDlls | Where-Object { -not (Test-Path (Join-Path $d $_)) }) } | Select-Object -First 1
-          if (-not $src) { throw "No directory has all CRT DLLs. Searched: $($candidates -join '; ')" }
-          Write-Host "CRT source: $src"
-          foreach ($dll in $crtDlls) { Copy-Item (Join-Path $src $dll) (Join-Path $dest $dll) -Force }
-          Get-ChildItem $dest | Select-Object Name, Length
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: bun install --frozen-lockfile --ignore-scripts
-
-      - name: Configure sccache
-        shell: bash
-        run: |
-          {
-            echo "RUSTC_WRAPPER=sccache"
-            echo "SCCACHE_CACHE_SIZE=2G"
-          } >> "$GITHUB_ENV"
-
       - name: Build Tauri App (Windows, unsigned)
-        working-directory: ./frontend
         shell: bash
-        run: bun tauri build --no-sign --config '{"bundle":{"createUpdaterArtifacts":false}}'
-        env:
-          VITE_OPEN_SECRET_API_URL: https://enclave.secretgpt.ai
-          VITE_MAPLE_BILLING_API_URL: https://billing-dev.opensecret.cloud
-          VITE_CLIENT_ID: ba5a14b5-d915-47b1-b7b1-afda52bc5fc6
+        run: ./scripts/ci/desktop-windows-pr.sh
 
       - name: Show sccache stats
         run: sccache --show-stats
@@ -235,4 +183,30 @@ jobs:
           name: maple-windows-x64-pr
           path: |
             frontend/src-tauri/target/release/bundle/nsis/*.exe
+            frontend/src-tauri/target/release/maple.exe
+            frontend/src-tauri/resources/windows/*.dll
+            frontend/src-tauri/target/reproducibility/desktop-pr-windows-*.sha256
           retention-days: 5
+
+  verify-windows-artifacts:
+    needs:
+      - build-windows
+    runs-on: ubuntu-latest-8-cores
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Download Windows artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
+        with:
+          name: maple-windows-x64-pr
+          path: artifacts
+
+      - name: Verify Windows artifact reproducibility proofs
+        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows

frontend/src-tauri/resources/windows/README.md

@@ -45,39 +45,29 @@ must be staged here **before `bun tauri build`** on Windows.
 
 ## CI staging
 
-The Windows CI workflows (`desktop-pr-build.yml`, `desktop-build.yml`) stage
-these automatically in the **"Stage Windows runtime DLLs for bundling"** step,
-which runs after "Provide ONNX Runtime (Windows)" and before the Tauri build.
+The Windows PR workflow stages these automatically through
+`scripts/ci/desktop-windows-pr.sh` before the Tauri build. That script uses:
+
+- SHA-verified ONNX Runtime from `scripts/provide-windows-onnxruntime.sh`.
+- A SHA-verified, versioned Microsoft `VC_redist.x64.exe` URL pinned in
+  `frontend/src-tauri/scripts/onnxruntime-pins.sh`.
+- A SHA-verified WiX CLI NuGet package, used only to extract the VC++ redist
+  bootstrapper payload reproducibly.
+
+The build emits `target/reproducibility/desktop-pr-windows-*.sha256` proof
+manifests, and CI verifies those manifests from uploaded artifacts.
 
 For a **local** Windows build, run `scripts/provide-windows-onnxruntime.sh`
-first (it exports `ORT_DYLIB_PATH`), then stage the same five files:
-
-1. **`onnxruntime.dll`** — from the SHA-verified ONNX Runtime download:
-
-   ```bash
-   cp "$ORT_DYLIB_PATH" frontend/src-tauri/resources/windows/onnxruntime.dll
-   ```
-
-2. **The 4 MSVC CRT DLLs** — from the Visual Studio redist on the machine,
-   located via `vswhere` so it's independent of the VS year/edition (the
-   `^Microsoft\.VC\d+\.CRT$` filter avoids the neighbouring `DebugCRT`/`OPENMP`
-   folders); falls back to `System32`:
-
-   ```powershell
-   $crtDlls = 'VCRUNTIME140.dll','VCRUNTIME140_1.dll','MSVCP140.dll','MSVCP140_1.dll'
-   $candidates = @()
-   $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
-   if (Test-Path $vswhere) {
-     $vs = & $vswhere -latest -products * -property installationPath
-     if ($vs) {
-       $candidates += Get-ChildItem (Join-Path $vs 'VC\Redist\MSVC\*\x64') -Directory -ErrorAction SilentlyContinue |
-                      Where-Object { $_.Name -match '^Microsoft\.VC\d+\.CRT$' } | ForEach-Object FullName
-     }
-   }
-   $candidates += "$env:WINDIR\System32"
-   $src = $candidates | Where-Object { $d = $_; -not ($crtDlls | Where-Object { -not (Test-Path (Join-Path $d $_)) }) } | Select-Object -First 1
-   $crtDlls | ForEach-Object { Copy-Item (Join-Path $src $_) frontend\src-tauri\resources\windows\ }
-   ```
+first (it exports `ORT_DYLIB_PATH`), then run the same staging helper:
+
+```powershell
+$env:MAPLE_WINDOWS_VC_REDIST_VERSION = "14.44.35211"
+$env:MAPLE_WINDOWS_VC_REDIST_URL = "<pinned URL from frontend/src-tauri/scripts/onnxruntime-pins.sh>"
+$env:MAPLE_WINDOWS_VC_REDIST_SHA256 = "<pinned SHA-256 from frontend/src-tauri/scripts/onnxruntime-pins.sh>"
+.\frontend\src-tauri\scripts\stage-windows-runtime-dlls.ps1 `
+  -OrtDllPath "$env:ORT_DYLIB_PATH" `
+  -Destination .\frontend\src-tauri\resources\windows
+```
 
 The hook reads these files at makensis compile time, so they must be present
 here before the build runs (the CI staging step guarantees that); a missing

frontend/src-tauri/scripts/onnxruntime-pins.sh

@@ -72,6 +72,62 @@ onnxruntime_windows_x64_dll_sha256_for_version() {
   esac
 }
 
+windows_vc_redist_x64_version() {
+  printf '%s\n' "14.44.35211"
+}
+
+windows_vc_redist_x64_url_for_version() {
+  case "$1" in
+    14.44.35211)
+      printf '%s\n' "https://download.visualstudio.microsoft.com/download/pr/7ebf5fdb-36dc-4145-b0a0-90d3d5990a61/CC0FF0EB1DC3F5188AE6300FAEF32BF5BEEBA4BDD6E8E445A9184072096B713B/VC_redist.x64.exe"
+      ;;
+    *)
+      echo "No pinned Windows x64 VC++ Redistributable URL for version '$1'." >&2
+      return 1
+      ;;
+  esac
+}
+
+windows_vc_redist_x64_archive_sha256_for_version() {
+  case "$1" in
+    14.44.35211)
+      printf '%s\n' "cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b"
+      ;;
+    *)
+      echo "No pinned Windows x64 VC++ Redistributable SHA-256 for version '$1'." >&2
+      return 1
+      ;;
+  esac
+}
+
+windows_wix_cli_version() {
+  printf '%s\n' "6.0.2"
+}
+
+windows_wix_cli_url_for_version() {
+  case "$1" in
+    6.0.2)
+      printf '%s\n' "https://www.nuget.org/api/v2/package/wix/6.0.2"
+      ;;
+    *)
+      echo "No pinned WiX CLI NuGet package URL for version '$1'." >&2
+      return 1
+      ;;
+  esac
+}
+
+windows_wix_cli_archive_sha256_for_version() {
+  case "$1" in
+    6.0.2)
+      printf '%s\n' "13caed0aa86898c9952eb8ba82c6ac6b43d1575bb731ac848e5edf5490a10428"
+      ;;
+    *)
+      echo "No pinned WiX CLI NuGet package SHA-256 for version '$1'." >&2
+      return 1
+      ;;
+  esac
+}
+
 onnxruntime_ios_commit_for_version() {
   case "$1" in
     1.22.2)