Lockverity v2.1.3

Lockverity v2.1.3

Lockverity v2.1.3 is the current Windows release of the local-first, evidence-first software supply-chain assurance tool for public GitHub repositories and source archives.

Highlights

• Native Windows desktop shell using Microsoft Edge WebView2 with an owned loopback FastAPI lifecycle.
• Explicit per-scan evidence-provider selection with provider privacy and availability states kept visible.
• Hardened untrusted ZIP/TAR intake with bounded validation and safe relative-symlink handling, without executing analyzed repository code.
• Stronger local mutation, CLI/desktop lifecycle, shutdown, duplicate-launch, logging, and release-gate coverage.
• Partial or unavailable provider coverage remains explicit rather than being silently converted into a clean result.
• Deterministic Windows packaging, payload provenance, upgrade behavior, and native icon resources.
• Refined system/light/dark appearance, provider-status presentation, demo isolation, and sidebar behavior.

Website: https://lockverity.namanp.de

Artifact source commit: 2ddb0e2d8f3771c711e98809beab409d468bebdd

Download

• Lockverity-2.1.3-windows-x64-setup.exe — recommended Windows 10/11 x64 installer; per-user, no admin, no UAC.
• Installer SHA-256: 831264757dccde2c8feef0422390d9812f053fcad811455bde868756c7757bfd
• Lockverity-2.1.3-windows-x64-portable.zip — verified Windows 10/11 x64 portable ZIP, no installation required.
• Portable ZIP SHA-256: 5c68d1b06ad570d829a53eeb400ab4d7f2e8576c4b0a6079197d9dbdec35844f

The release includes installer/build manifests and checksum files for provenance and integrity verification.

Security / signing

The Windows build is currently unsigned. Windows may show Unknown publisher or Microsoft Defender SmartScreen warnings. Verify the published SHA-256 before running the installer.

Lockverity does not execute analyzed repository code and does not treat missing or unavailable provider evidence as proof that no vulnerability exists.

Lockverity v2.1.2

Which download should I choose?

Pick this	If you are…
Windows installer (Lockverity-2.1.2-windows-x64-setup.exe)	A normal Windows user who wants the recommended install path. Per-user, no admin, no UAC. Default install path %LOCALAPPDATA%\Programs\Lockverity.
Windows portable ZIP (Lockverity-2.1.2-windows-x64-portable.zip)	A Windows user who wants Lockverity without a formal install. Extract anywhere you control, double-click Lockverity.exe.
Code → Download ZIP on the GitHub repository page	A developer or auditor who wants to read or modify the source code. It is not the Windows installer and is not the Windows portable. The source ZIP is intended for development and auditing only.
macOS / Linux	Source-based installation only. Lockverity v2.1.2 does not publish a packaged macOS binary (no .dmg, no .pkg, no signed .app) or a packaged Linux binary (no .deb, no .rpm, no Flatpak, no AppImage, no Snap). The macOS and Linux workflows are source-based developer setups.

The Windows build is not code-signed. Because this release is unsigned, Windows may display Unknown publisher and/or a Microsoft Defender SmartScreen warning. Verify the SHA-256 hash of every asset before installing.

Code signing policy

• Lockverity v2.1.2 is currently unsigned.

• No SignPath-signed Lockverity release currently exists.

• The project is preparing an application to the SignPath Foundation Open Source code-signing program.

• Code signing policy

• Privacy policy

What v2.1.2 changes

v2.1.2 is a narrow Windows-only hotfix on top of v2.1.1. There are no new features and no runtime contract changes.

Corrected Windows Installed apps icon

The v2.1.0 and v2.1.1 installers declared
UninstallDisplayIcon={app}\Lockverity.exe — a path that does not
exist on disk (the launcher is installed under {app}\app\, not at
the install root) and that omitted the explicit ,0 icon index. As
a result, Settings → Installed apps showed the generic
application icon for the Lockverity entry. v2.1.2 fixes the path to
{app}\app\Lockverity.exe,0 so the shell renders the Lockverity
brand icon.

Complete multi-resolution Windows ICO

The canonical ICO at backend/pyinstaller/favicon-exe.ico is
regenerated from the approved 1024×1024 brand-favicon source PNG
with the full size set the Windows shell queries:
16×16, 24×24, 32×32, 48×48, 64×64, 128×128, 256×256. v2.1.0 and
v2.1.1 shipped only {16, 32, 48, 256}, which caused a partial
shell fallback to the generic icon for some user accounts.

Consistent installer, executable, and shortcut branding

The same canonical ICO is used as SetupIconFile, bundled at the
install root, and referenced by the Start Menu and desktop
shortcuts via the IconFilename directive. The uninstaller EXE
icon is inherited from SetupIconFile (Inno Setup 6.7.3
contract). After install, Settings → Installed apps, the Start
Menu shortcut, the desktop shortcut (if opted in), and the
uninstaller UI all show the Lockverity brand icon.

Authenticode signing-readiness hooks

A disabled-by-default signing helper
(backend/scripts/_authenticode_sign.py) exposes the documented
env-var contract for a future trusted Authenticode provider
(LOCKVERITY_SIGNTOOL_PATH, LOCKVERITY_SIGNTOOL_PFX,
LOCKVERITY_SIGNTOOL_PFX_PASSWORD,
LOCKVERITY_SIGNTOOL_TIMESTAMP_URL,
LOCKVERITY_SIGNTOOL_DESCRIPTION, LOCKVERITY_SIGNTOOL_URL).
When all env vars are unset the build is unchanged: still
functional, still unsigned, no code-signing integration. The
helper signs Lockverity.exe → lockverity-cli.exe →
unins000.exe → installer EXE, with SHA-256 and RFC 3161
timestamping, when later enabled by an operator with a trusted
Authenticode certificate.

What v2.1.2 does not claim

• The Windows build is not code-signed. No Authenticode
  certificate is procured, no signing provider is contacted, no
  PFX is bundled, no private key is committed, and no
  self-signed production certificate is generated. Operators may
  see Unknown publisher or SmartScreen warnings; verify the
  SHA-256 hash before installing. A signed v2.1.2 binary
  requires a future trusted Authenticode provider to be
  configured at build time.
• No new features. v2.1.2 is icon + signing-readiness only.
  The scan intake, repository analysis, evidence model,
  exporters, and runtime contracts are unchanged from v2.1.1.
• No private-repository support. Public GitHub repositories
  and uploaded source archives only.
• macOS and Linux remain source-installation-only. The
  Windows installer and portable are the only packaged
  distributions.

Source identity

• Source commit: 2aa8729832ac94093966a67d2f3f76c0e2110d15
• Tag: checkpoint-v2.1.2-public-release (annotated, peels to
  the source commit)
• Branch: main

The portable's BUILD-MANIFEST.json and the installer's
INSTALLER-MANIFEST.json both record the same source commit. The
installer's payload_zip_sha256 matches the portable ZIP's
SHA-256.

Assets

Asset	Size	SHA-256
Lockverity-2.1.2-windows-x64-setup.exe	31,227,275 bytes	6ec50d612c8edb49ab9a7e8cdf20b071a0094070998eee8555ef09bbbdc5af5b
Lockverity-2.1.2-windows-x64-portable.zip	56,198,519 bytes	7b8824e1fa780f46caafef25e84f3249e4f7f5cb11d5c5e22cfcf4491bfe6996
INSTALLER-MANIFEST.json	1,684 bytes	7e4c0328d6f3357429d8141490e69680357a7df06dfcc88fa8a89a35bf590025
BUILD-MANIFEST.json	1,160 bytes	e01692940e645e16639a84faf45334c77f22bf8a13a4c099302a24d21b47460b
Lockverity-2.1.2-SHA256SUMS.txt	393 bytes	ec324e6cad86a7a535567f5e0898559d560717df58e8a4a842d7630058306e9d
Lockverity-2.1.2-windows-x64-portable-SHA256SUMS.txt	134,706 bytes	d297239fe49876d444563d7c116acc7e7d447002fcb26bec419ad2f27a649843

The Lockverity-2.1.2-SHA256SUMS.txt file lists the four main
release assets above. The
Lockverity-2.1.2-windows-x64-portable-SHA256SUMS.txt file lists
every file inside the portable ZIP (900 entries) for an
end-to-end integrity check.

Previous releases

• v2.1.1 (2026-08-04): code-only hotfix for the
  public-repository scan intake; same Windows installer, same
  portable, same brand assets; corrected actionable error
  taxonomy and repository-intake consistency. Remains on tag
  checkpoint-v2.1.1-public-release (release id 365202120).
• v2.1.0 (2026-08-04): local runtime brand polish; first
  published release. Remains on tag
  checkpoint-v2.1.0-public-release (release id 364751203).

Neither is re-published or replaced. The previous release tags,
release bodies, and six release assets each remain unchanged.

Lockverity v2.1.1

Which download should I choose?

Windows installer EXE (Lockverity-2.1.1-windows-x64-setup.exe)
is the recommended option for most Windows users. It is per-user,
no-UAC, no-admin, installs to %LOCALAPPDATA%\Programs\Lockverity,
and ships an uninstall entry. Verify the SHA-256 before running.

Windows portable ZIP (Lockverity-2.1.1-windows-x64-portable.zip)
is for operators who cannot install (locked-down laptop, USB-only
workflow, no write access to %LOCALAPPDATA%). Extract anywhere
and run Lockverity.exe. The runtime home is still
%LOCALAPPDATA%\Lockverity. The portable does not write to its
own install directory.

Code → Download ZIP is the Lockverity source code. It is not
the Windows installer and is not the Windows portable. If you want
to run Lockverity, use the installer or portable ZIP above. The
source ZIP is intended for development and auditing only.

macOS and Linux remain source-installation-only in v2.1.1. The
repository ships a Python 3.12 + Node 24 build path; see
docs/install.md
for the source install commands.

SmartScreen and antivirus: the Windows build is unsigned in
v2.1.1 and may show "Windows protected your PC" or
"Unknown publisher" on first launch. SmartScreen remembers
the choice for the same executable. Verify the SHA-256 of the
asset against the values in
Lockverity-2.1.1-SHA256SUMS.txt
before installing.

What v2.1.1 fixes

v2.1.1 is a code-only hotfix on top of v2.1.0. The Windows
installer, Windows portable, single-port production runtime,
cross-platform local runtime CLI, original brand assets, and
concise About page are unchanged from v2.1.0.

• Public self-scan of the Lockverity repository now starts
  successfully. The v2.1.0 scan intake failed on a self-scan
  because the workspace root was resolved under the PyInstaller
  _internal support directory and the long-named extracted
  directory pushed the destination path past Windows
  MAX_PATH (260). The v2.1.0 user-visible result was
  "Could not start a scan (Unknown error.) / An internal error
  occurred." The hotfix routes the workspace root through
  LOCKVERITY_HOME and adds Windows long-path support
  (\\?\ prefix above 260 chars), so a public self-scan starts
  successfully.
• Actionable error taxonomy for the scan intake. Generic
  "Unknown error" / "Archive was rejected." / raw
  "Upstream returned 404 Not Found." messages are replaced
  with category-specific, user-facing messages:
  • 404 / private repository: "Repository could not be
    accessed. Confirm that the URL exists and is public.
    Private repositories are not supported in this version."
    The message intentionally does not reveal whether a
    private repository actually exists.
  • 422 invalid ref: "The requested branch, tag, or commit
    could not be found on the repository. Check the ref and
    try again."
  • 429 rate limit: "GitHub rate limit reached. Wait a few
    minutes and retry. Configure LOCKVERITY_GITHUB_TOKEN to
    lift the unauthenticated limit."
  • 403 denial: "GitHub denied the request. The repository may
    be private, the URL may be wrong, or the configured token
    may lack access. Private repositories are not supported in
    this version."
  • Archive rejection: 11 category-specific actionable
    messages (archive_unsafe_path, archive_symlink_forbidden,
    archive_too_many_files, archive_entry_too_large,
    archive_uncompressed_too_large,
    archive_overwrite_forbidden,
    archive_path_resolve_failed, archive_path_escape,
    archive_extract_failed,
    archive_quarantine_write_failed,
    archive_validation_failed).
  • Internal error: a new internal_unexpected envelope carries
    a non-PII 16-character lowercase hex correlation_id and
    the operator-facing line "Reference: <id>. Open
    Diagnostics or inspect the local runtime log." The full
    stack trace is written to the local log only.
• Repository-intake consistency. The legacy
  POST /repositories endpoint was retained for backwards
  compatibility and is now wrapped with the same
  internal_unexpected boundary as defence in depth. Both
  bundled repository-intake pages — /analyze and
  /repositories/new — submit through the same canonical
  intake endpoint (POST /repositories/github) and render the
  same classified error envelope and correlation-id line.
• Failed-intake transaction cleanup. A scan that fails
  before transitioning to READY is not left as a misleading
  running scan; the new internal_unexpected path bubbles the
  failure to the API envelope without leaving a partial
  workspace state. New tests assert that after a 404, an
  invalid_ref, an internal_unexpected, or a retried 404
  with the same canonical URL, the database contains no READY
  workspace and no scan row in a non-terminal state.

What v2.1.1 preserves

• OpenSSF Scorecard partial scans remain Partial. When the
  OpenSSF Scorecard repository-posture provider is unavailable,
  the scan (e.g. namanparikh11/scopeforge-cli) remains partial,
  not completed. A missing or unavailable provider is recorded
  as such and surfaced explicitly; the UI does not convert
  absence into "no findings". The provider-honesty contract is
  unchanged.
• No private-repository support. v2.1.1 does not change the
  public-only intake contract.
• No code signing. The Windows build is intentionally
  unsigned. Operators may see SmartScreen or antivirus warnings.
  Verify the SHA-256 of the asset before running it.

Asset verification

Every release asset has a SHA-256 in
Lockverity-2.1.1-SHA256SUMS.txt.

Windows (PowerShell):

Get-FileHash .\Lockverity-2.1.1-windows-x64-setup.exe -Algorithm SHA256
Get-FileHash .\Lockverity-2.1.1-windows-x64-portable.zip -Algorithm SHA256

macOS / Linux:

shasum -a 256 Lockverity-2.1.1-windows-x64-setup.exe
shasum -a 256 Lockverity-2.1.1-windows-x64-portable.zip

If the hash does not match, do not run the asset. Re-download
from the same URL; if the hash still differs, do not run the
asset and report the discrepancy to the maintainers.

The internal
Lockverity-2.1.1-windows-x64-portable-SHA256SUMS.txt
lists the SHA-256 of every file inside the portable ZIP (the
launcher EXE, the CLI EXE, the build manifest, the licence, the
portable README, the third-party notices file, and the full
_internal Python distribution payload).

Source commit

6279a5df1a895f3bf51cb3ad36e3059834363936

All three source-commit fields in the embedded manifests
(portable BUILD-MANIFEST.json, installer INSTALLER-MANIFEST.json)
equal this commit.

Lockverity v2.1.0

Which download should I choose?

• Windows installer — Lockverity-2.1.0-windows-x64-setup.exe
  Recommended for normal Windows users. Per-user, no admin, no UAC.
• Windows portable — Lockverity-2.1.0-windows-x64-portable.zip
  Extract anywhere, no formal install. Recommended for locked-down
  laptops and USB-only workflows.
• Source code archives — for developers only; not the Windows
  application. Pick these from the Code → Download ZIP button on
  the GitHub repository.
• macOS / Linux — no packaged binaries in v2.1.0. Source-based
  setup only; see the macOS
  and Linux
  install sections in the central install guide.

Code → Download ZIP downloads the Lockverity source code. It
is not the Windows installer. If you want to run Lockverity on
Windows, use the Windows installer or Windows portable above.

Lockverity v2.1.0

Lockverity v2.1.0 introduces:

• Windows x64 per-user installer
• Windows x64 portable package
• Single-port production runtime serving the web interface and API
• Graphical Windows launcher
• Local CLI commands for start, stop, status, open, doctor, and logs
• Duplicate-launch reuse and process-identity protections
• Runtime data separation under LocalAppData
• Improved Lockverity branding, favicon, and About experience
• Findings grid improvements
• Clean uninstall that preserves operator data
• Offline operation without system Python, Node, or npm

Security and privacy

• Loopback-only default binding
• No telemetry
• No service
• No scheduled task
• No firewall modification
• No automatic updater
• No administrator privileges required
• Runtime database and logs remain under the operator-controlled Lockverity home
• Installer and binaries are currently unsigned - Windows SmartScreen or
  antivirus warnings may occur; verify downloads with the supplied SHA-256
  checksums

Upgrade notes

• Existing runtime data is preserved
• Uninstall does not delete the Lockverity runtime home
• Installer uses: %LOCALAPPDATA%\Programs\Lockverity
• Runtime data normally uses: %LOCALAPPDATA%\Lockverity

Primary asset hashes

Portable ZIP
a4414372c964f0f50d6e6a864d5a8b8c288acd8a5008e8d45a0ed67e8e58f302
Lockverity-2.1.0-windows-x64-portable.zip (56,088,933 bytes)

Installer EXE
db90854369d2bc0ca09fc935abe3f5213260f12229b979ab3bb55dfb5d73bec6
Lockverity-2.1.0-windows-x64-setup.exe (31,128,774 bytes)

Build identity

• Source commit: da21f778f542572f4e71ba694b5d9f240d1bcdff
• Version: 2.1.0
• Target: Windows x64

Lockverity v2.0.6 — Public Release Readiness

Lockverity v2.0.6 is the first public-readiness checkpoint for the
local-first software supply-chain evidence workbench.

Highlights:

• Analyze public GitHub repositories and uploaded ZIP source archives.
• Repository-controlled code is not executed.
• Discover supported manifests, dependencies, workflows, licences, and
  evidence gaps.
• Optional provider enrichment through OSV, deps.dev, GitHub, and OpenSSF
  evidence sources.
• Provider failure or missing coverage is preserved as unavailable, partial,
  or not requested rather than treated as clean.
• Compare scans from the same repository without falsely equating missing
  evidence with remediation.
• Export CycloneDX 1.5/1.7, SARIF, findings JSON, findings CSV, and Markdown
  evidence reports.
• Local repository records, scans, findings, and provider evidence remain in
  the operator-controlled workspace.
• Hardened archive intake, bounded HTTP handling, filename/path safety,
  deterministic exports, documentation verification, migration coverage,
  dependency-lock reproducibility, and public-release checks.

Validation:

• Backend: 1,131 tests passed.
• Frontend: 329 tests passed.
• Release verifier: 10/10 stages passed.
• Node 22.22 and Node 24 clean-install validation passed with plain npm ci.
• npm audit and npm audit --omit=dev reported zero vulnerabilities.
• Manual browser acceptance passed.

Important limits:

• Results reflect evidence available at scan time.
• Lockverity does not certify that software is secure or compliant.
• External providers may be incomplete or unavailable.
• Use only with repositories and archives you own or are authorized to assess.
• The current public release is local-first and intended for defensive review.