Annotrail 0.1.2 preview — macOS package integrity

This patch fixes the macOS package integrity defect in 0.1.0/0.1.1: ZIP creation had converted 21 signed Java license symlinks into regular files after signing, invalidating the runtime and app resource seals. Version 0.1.2 fixes the file types before signing Mach-O contents, the runtime and the app in order. Both the original app and the actual ZIP extraction must pass strict signature verification. Altered licenses and JARs are rejected. Portable archives also include the linked security, validation and license documents.

Source commit: ea29296f653ee4a15d1a9b583076b8f09e3748ab.
Exact-commit CI passed 72 JUnit tests on each of macOS, Linux and Windows, with zero failures or skipped JUnit tests. Packaging regressions passed 13/13 on macOS and 11/11 on Linux and Windows; the two macOS signature tests are explicitly skipped on those other platforms. All three platforms passed the real native Swing-window review/export/reopen workflow and extracted runtime-included package CLI workflow. The final CI-produced macOS ZIP was independently exercised again on the local Mac.

Download your platform ZIP; Java is included. The standalone JAR requires Java 17+. Verify SHA256SUMS. macOS bundle build 3 corresponds to product version 0.1.2. Reanalyze after upgrading to create a fresh review plan. Replace older extracted app folders with the new package.

The macOS app is ad-hoc signed for package integrity. It is not Developer ID signed or notarized; Windows launchers are not Authenticode signed. The native-window tests drive the application's own controls; external OS mouse/keyboard input and native file-picker interaction remain unverified. These are explicit external release limitations, so this remains a preview. No operating-system protections were disabled.

The exclusive-copy output fallback from 0.1.1 remains: incomplete output can be visible until export succeeds, and forced termination/power loss can leave partial files. Use output folders you control and wait for success. Actual exFAT/FAT32 hardware was not tested; unsupported-link and filesystem-failure cases use fault injection. Portable Java does not make identity-check-and-unlink atomic against a hostile concurrent process.

Supported scope remains selectable-text PDFs with embedded Highlight, Underline, StrikeOut and Text comments. No OCR, handwriting, rotated text, encrypted input or signed revised-PDF workflow. Reports can contain private document text and author metadata.

The Temurin source and build archives are corresponding source for the bundled runtime; they are not required to run Annotrail. Licenses and notices are included in each package. The standalone JAR is the Linux CI artifact.

Executable class bytes match across the three CI JARs. Metadata differs: the Ubuntu runner used Maven JAR Plugin 3.5.1 versus 3.5.0 on macOS/Windows, and Windows generated CRLF in pom.properties. Byte-for-byte cross-platform JAR reproducibility is not claimed.