Skip to content

v2.1.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 14:51
Immutable release. Only release title and notes can be modified.
v2.1.4
fe35344
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Retro Web UI v2.1.4

v2.1.4 is a backward-compatible release-integrity patch over v2.1.3.
It does not add a product feature, theme, framework claim, or
semantic-conversion behavior.

The public GitHub-enforced immutable v2.1.3 Release remains unchanged. Its
actual verified provenance correctly binds tag object
a5730ea775455db2f004a31c9db626c642f12510 and all 15 public assets. The
independent post-publication saturation review nevertheless found that the
local certification policy checked the tag string and asset digests without
explicitly requiring the release package subject's annotated-tag-object
SHA-1. Because an immutable Release cannot be repaired in place, this release
closes that generalized fail-closed gap in a new patch version.

Immutable publication gates

  • A protected, manually approved pre-tag workflow uses a dedicated
    Administration-read credential to require the literal repository setting
    enabled: true, an unused version tag and Release, and the exact main
    commit.
  • The annotated tag records the successful preflight run ID. The tag-triggered
    workflow resolves the authoritative remote annotated tag and that exact run,
    checks their identities and commit binding, and downloads the protected
    preflight evidence without forwarding repository credentials to signed
    artifact storage.
  • Publication creates one draft Release through a create-only API path, retains
    its exact Release ID, uploads only the manifest-bound asset set, and verifies
    that same draft before making it public.
  • Final certification requires the literal GitHub Release API boolean
    immutable: true, complete public re-downloads and SHA-256 matches, and
    verified Sigstore/DSSE statements containing exactly one
    pkg:github/ririri-rgb/retro-web-ui@v2.1.4 subject whose SHA-1 is the
    authoritative annotated tag object, plus every expected asset digest.
  • Third-party GitHub Actions used by CI, native builds, preflight, and release
    publication are pinned by commit.

Distribution and compatibility

The release retains the v2.1.0 desktop workspace, Core, CLI, Skill,
framework, browser, privacy, and containment behavior. Assets include native
archives for macOS arm64, Windows x86_64, and Linux x86_64, plus the standalone
Skill ZIP, Python wheel, source distribution, SHA-256 sidecars, and
per-platform native reports. The tagged workflow rebuilds and exercises the
complete release set.

The macOS archive is ad-hoc signed, not Developer ID signed or notarized. The
Windows archive is unsigned and not Authenticode signed. Hosted native checks
use offscreen display environments and do not replace physical-device UX
evaluation. Codex remains an external prerequisite and is not bundled.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system and verify its adjacent SHA-256 file.

Install the matching Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.1.4/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.1.4-py3-none-any.whl without
installing Qt. The historical v2.1.0 and immutable v2.1.3 Releases remain
unchanged.

Assets 18
Loading