Tina4Pascal v1.0.3

Tina4Pascal v1.0.3

Maintenance release — release tooling + clean-box robustness.

Changes

• macOS notarization — release-macos.sh now Developer-ID-codesigns the
  macOS binary (hardened runtime, timestamped) and notarizes it when a notary
  credential is configured, so downloads open without a Gatekeeper warning.
• Windows clean-box installer hardened — the CLI's one-time FPC auto-install
  sends a browser User-Agent, tries a direct mirror, and validates the download
  is a real PE installer (MZ header + full size) before running it — a
  partial/HTML response now fails cleanly instead of executing a corrupt file.
• CI — the Windows job installs FPC via the Lazarus setup action (reliable),
  no longer gated on SourceForge rate-limiting runners. Linux + macOS + Windows
  all green.

No API or rendering changes since v1.0.2 (bundled fonts on all platforms, WebP,
HTML→PDF, etc. carry over).

Assets & verification

Windows deliverables are Authenticode-signed (Certum EV, Code Infinity (Pty) Ltd);
Linux + macOS tarballs are GPG-signed with the release key
(tina4pascal-release-public.asc, fp E0B36CDD76676DD08E4F1FA641DA6E7645F494AF).
Each asset ships a .sha256.

gpg --import tina4pascal-release-public.asc && gpg --verify <asset>.asc <asset>
Get-AuthenticodeSignature tina4pascal.ps1        # Windows: Status = Valid

macOS Gatekeeper (if not notarized on your build)

gpg --verify tina4-htmlviewer-macos-arm64.tar.gz.asc tina4-htmlviewer-macos-arm64.tar.gz
tar xzf tina4-htmlviewer-macos-arm64.tar.gz
xattr -dr com.apple.quarantine tina4-htmlviewer-macos-arm64