WinMerge 2.16.58.2 (x64 + ARM64 setup)

Unmodified mirror of the upstream release.

Source: https://github.com/WinMerge/winmerge/releases/tag/v2.16.58.2

asset	sha256	Authenticode
WinMerge-2.16.58.2-x64-Setup.exe	26f794838bc4e545d7b9f36dc8beeb5a65a12bd4627fa3b4fe87068abef925b0	Valid — CN=Takashi Sawanaka
WinMerge-2.16.58.2-ARM64-Setup.exe	3dcd40d79fee3f01da7e12765d5dc3f4cbec8e038749b791697b573ba1d3a8ce	Valid — CN=Takashi Sawanaka

WinMerge 2.16.52.2 — the build that fixed #3015/#3055

Unmodified mirror. The fixed half of the pair with winmerge-2.16.52.

The maintainer closed #3055 with "fixed in the latest version 2.16.52.2", and
this release shipped the same day #3015 was closed. Measured: choosing
Insert tabs here writes TabType=0x0 and survives reopening Options, where
2.16.52 writes 0x1 and comes back showing Insert spaces.

Source: https://github.com/WinMerge/winmerge/releases/tag/v2.16.52.2

asset	sha256
winmerge-2.16.52.2-x64-exe.zip	531bce09f2f01626c2ba2b65eb4423676d5329bfaca45fa75dedea5d3ddcd341
winmerge-2.16.52.2-ARM64-exe.zip	ae3c9fde2fcd0c16f33efd680607b6a250f972c83e14b158b71ec4836c6ab579

WinMerge 2.16.52 — the build with #3015/#3055

Unmodified mirror. Paired with winmerge-2.16.52.2.

The bug is #3015; #3055 is the
duplicate that describes the symptom. PropEditor.cpp attached a
std::clamp(v, 1, MAX_TABSIZE) validator to OPT_TAB_TYPE instead of
OPT_TAB_SIZE, so choosing Insert tabs — value 0 — was clamped up to 1,
which is Insert spaces. Fixed in commit edc1597 (2025-10-30).

The failure is asymmetric, which is what makes it a good test: choosing Insert
spaces works on both builds, because 1 is already inside the clamp range. Only
the tabs direction is lost.

Source: https://github.com/WinMerge/winmerge/releases/tag/v2.16.52

asset	sha256
winmerge-2.16.52-x64-exe.zip	b4c815072923f01cacda189a967f377ec2dde38ee27880b472d96b3206ce8c2c
winmerge-2.16.52-ARM64-exe.zip	3123c519a84d5469d5c7d66fca1dad0f8a96af8fed2282288d52e889d7c6811a

DB Browser for SQLite 3.13.1 portable — the build that fixed #3735

Unmodified mirror. The portable zip, kept separately from the msi release used
by the CI gate, because the demo runs two builds side by side and an installed
package cannot be present twice.

Source: https://github.com/sqlitebrowser/sqlitebrowser/releases/tag/v3.13.1

asset	sha256
DB.Browser.for.SQLite-v3.13.1-win64.zip	22375e275ec42d96de1d3b8e9ea4ed86d2a3505c4d0ffcbd1af67aa4003e5e4d

DB Browser for SQLite 3.13.1 (win64 Qt5 + arm64 Qt6)

Unmodified mirror of the upstream release. The two architectures ship different Qt
versions at the same application version, which is why both are kept.

Source: https://github.com/sqlitebrowser/sqlitebrowser/releases/tag/v3.13.1

asset	sha256	Authenticode
DB.Browser.for.SQLite-v3.13.1-win64.msi	d023d54b3a5db10c7e896089bb3dbe6e7f4bc4eaa9bbecb34ca414be5970f688	Valid — CN=SignPath Foundation
DB.Browser.for.SQLite-v3.13.1-arm64.msi	89bf0adafad492f44d850d76c188204f0639f185b50482a3cbd59afe509b1d84	NotSigned upstream — hash is the only check available

DB Browser for SQLite 3.13.0 — the build with #3735

Unmodified mirror of the upstream release. Paired with sqlitebrowser-3.13.1
for the upstream-bug demo: 3.13.0 appends a trailing newline when a single grid
cell is copied, 3.13.1 does not.

Source: https://github.com/sqlitebrowser/sqlitebrowser/releases/tag/v3.13.0

asset	sha256
DB.Browser.for.SQLite-v3.13.0-win64.zip	69465171d0eaca2a3d68ec5a5048f62ee192d136412a6f6747538d4535c18bbe

The win64 (Qt 5) zip is the one mirrored because 3.13.0 has no arm64 build at
all — the two versions have to be the same Qt for the comparison to mean
anything. Zips carry no Authenticode signature, so the hash is the whole check;
it matches the bytes the reproduction was developed against.

PowerToys 0.101.2362.0 — the build with CmdPal #50175

PowerToys 0.101.2362.0 — the build with Command Palette issue #50175.

Command Palette 0.12.12365.0 ships inside this installer and is registered as
Microsoft.CommandPalette_8wekyb3d8bbwe on PowerToys' first run.

#50175 is open, so there is no "after" build to pair this with; the reproduction
asserts the wanted behaviour under xfail(strict=True) against this version.

Straight from https://github.com/microsoft/PowerToys/releases/tag/v0.101.2362.0,
unmodified. Each hash was produced twice from independent downloads on different
machines (macOS via gh release download, and a Windows 11 ARM64 VM).

asset	sha256
PowerToysUserSetup-0.101.2362.0-x64.exe	D56FA7130FA68AFE553068C15A59A6B24C8DBCC9A0989A43EF0FC5A373230DE3
PowerToysUserSetup-0.101.2362.0-arm64.exe	4C2AE5156B7E4F1F5BA744BA6E1CF6BFE3D9614978356E6B00AA47CAB86350DB

Authenticode signer, whole subject:

CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
issuer:     CN=Microsoft Code Signing PCA 2024, O=Microsoft Corporation, C=US
thumbprint: 1D77A9B9E8FE2075D9AD15123257FB90DB0DA4A1

Silent install flag is /silent (WiX Burn convention, single slash). --silent
is not a Burn switch — the bootstrapper ignores it, shows its UI, and waits for a
click that never comes.

Notepad++ 8.9.8 (x64 + arm64 installers)

Unmodified mirror of the upstream release, so CI does not depend on a third-party host being reachable.

Source: https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8

asset	sha256	Authenticode
npp.8.9.8.Installer.x64.exe	7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2	Valid — CN="NOTEPAD++"
npp.8.9.8.Installer.arm64.exe	3ac2c91245e980c4fd0991e5c1971439e234c0713e994d1dae532c70b7528587	Valid — CN="NOTEPAD++"

Hashes were produced twice from two independent downloads and agree.

Notepad++ 8.8 portable (the build that fixed #16326)

Unmodified mirror. Commit 38ee65fd added npcNoInputC0 to the portable config.xml.

Source: https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.8

asset	sha256
npp.8.8.portable.x64.zip	d2011791f4955115e2deff4f5d086481a7ba04c957fbca0b2f65f4e608c79935
npp.8.8.portable.arm64.zip	e8e10819793ea4db9d0bfebd2963d56432d59d5a3be9f5149e69b06e6cbe0e06

Notepad++ 8.7.9 portable (the build with #16326)

Unmodified mirror. Used by the upstream-bug demo: this build's config.xml is missing
npcNoInputC0, so Ctrl+Shift+D inserts an invisible EOT (0x04).

Source: https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.7.9

asset	sha256
npp.8.7.9.portable.x64.zip	c0543076abcad4b3119154cc3ee2ca88e63fc1381ee07e1e29d7321df2b7513d
npp.8.7.9.portable.arm64.zip	54e52bde00219c9daf1b0895fa3c125b0fb06cd6c7ce5eb374440057816ab18f

Zips carry no Authenticode signature, so the hash is the whole check.