hash 20.0.3

hash 20.0.3: signed and notarized component and standalone macOS CLI.

Source: 166d392
Verification/signing run: https://github.com/miyako/hash/actions/runs/41741807348/attempts/1

Install hash.zip as the normal 4D dependency component. Standalone CLI ZIP/DMG assets are part of this same release. Both DMGs carry stapled offline notarization tickets; ZIPs use online ticket lookup. Windows helpers are not Apple-signed. See SHA256SUMS for final-byte hashes and provenance.json plus the accompanying native, 4D, signing and notarization evidence. Exact 4D 20.7 execution remains unverified.

Approved publication recovery

The original publication job in run 41741807348 failed with Bad Content-Length after persisting the tested version commit and creating this private draft. Signing, notarization, stapling, Gatekeeper and signed installed-host gates had passed. User-approved recovery used the reviewed transport fix in #4 (merge 222652c). The same 15 finalized assets and source 166d392 were retained; no rebuilding, re-signing, notarization resubmission, version advance or asset replacement occurred. Every draft asset was downloaded and compared byte-for-byte before create-only tagging and publication. The original failed publication history is preserved.

20.0.1

Reusable compute-only 4D component, namespace cs.hash. Stable API: cs.hash.hash.new().sha256(file; {timeout: 300}). Use hash.zip for 4D dependencies.json or install its entire hash.4dbase folder under Components; do not install hash.4DZ alone.

Source: c0fc530. hash.zip SHA-256: 7fe55bf2f552e7c6441cff5079bad5c9f2513cf694563d8b2c4f76ba8a7d71d5.

Developer ID Application signatures (team Y69CWUC25B), secure timestamps and hardened runtime cover the actual compiled 4D library and both universal CLI slices. Both component and standalone ZIPs separately received Apple notarization Accepted results; downloaded ticketContents match all payload CDHashes. Both DMGs are separately signed, notarized, stapled, validated and Gatekeeper-assessed. Raw CLI/ZIP stapling is unsupported; ZIP delivery uses online ticket lookup. Raw non-app CLI spctl execute assessment is not an app assessment; strict notarized-code verification passes.

Validation: exact-source native CLI execution on macOS Intel/ARM and Windows x64/ARM (including x64-emulated Windows ARM selector), diagnostic-free actual 4D 20.8 component/host compilation, installed execution before and after signing/final ZIP extraction, signed CLI native ARM/Rosetta smoke. Evidence: https://github.com/miyako/hash/actions/runs/41659485571 plus attached provenance, native receipts, signed runtime report and notarization logs. SHA256SUMS describes final post-signing/stapling bytes; pre-sign provenance is separate.

Compatibility: declared 4D 20.7 LTS; exact 20.7 runtime unavailable and untested. Real 4D runtime exercised on macOS ARM with 20.8; Windows 4D execution is not claimed. macOS helper minimum 12.0, runtime tested on macOS 15 CI; Windows ARM requires Windows 11 with x64 emulation. No model/cache/provider/event dependencies.