Record v0.0.1 public signing material

index.html

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <link rel="icon" type="image/png" href="/favicon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
     <meta name="theme-color" content="#c9a473" />
     <title>MathScrap</title>

packaging/logo/SHA256SUMS.txt

@@ -0,0 +1 @@
+b61b9160596a0f4e7fa1a9a9296d341687b3a158e24fdf082f24c1bb208c57bf  app-icon.png

scripts/verify-packaged-dist.mjs

@@ -28,7 +28,7 @@ need('models/comer/decoder_int8.onnx', 1_000_000)
 need('models/comer/vocab.json', 100)
 need('models/comer/LICENSE', 100)
 need('models/comer/NOTICE.md', 50)
-need('favicon.svg', 50)
+need('favicon.png', 50)
 
 const ortDir = path.join(dist, 'ort')
 if (!existsSync(ortDir)) fail('dist/ort is missing. ONNX Runtime WASM was not copied into the bundle.')

signing/v0.0.1/README.md

@@ -0,0 +1,23 @@
+# v0.0.1 公开签名材料
+
+# v0.0.1 public signing material
+
+这些是本机发行钥匙的公钥和指纹。私钥留在签名那台机器上，不进入仓库，也不注册到 GitHub 账户。
+
+These are the public keys and fingerprints for the machine that signs this release. Private keys stay on that machine. They are not in the repository and they are not added to the GitHub account.
+
+Git 提交和 annotated tag 使用 GPG Ed25519 `13E203AC53D88778AD69A9361EC5DC0B3EDBB23E`。UID 是 `DNT_OF`，没有邮箱。因此这把钥匙的有效签名不能写成 GitHub Verified。已在 `main` 上的三个提交保持原样，这个新提交不回头补签它们。
+
+Git commits and the annotated tag use GPG Ed25519 `13E203AC53D88778AD69A9361EC5DC0B3EDBB23E`. The UID is `DNT_OF` and it has no email address, so a valid signature from this key is not GitHub Verified. The three commits already on `main` stay as they are. This new commit does not re-sign them.
+
+Android 正式证书 SHA-256 是 `3D0E7FCAFEACF781628A29DE1D7EBCC7E2FEE58CC14A9F0D258C06776CE5F690`，alias `mathscrap-release`。它不是 CI 的 Android debug 证书。
+
+The Android release certificate SHA-256 is `3D0E7FCAFEACF781628A29DE1D7EBCC7E2FEE58CC14A9F0D258C06776CE5F690`, alias `mathscrap-release`. It is not the CI Android debug certificate.
+
+Windows 自签代码签名证书 SHA-256 是 `62B307F926AFE2641E306A557ACB0260A9159DA0A404A738298F01C5EC4F9F1F`。CurrentUser\My 指纹是 `75F97DC8735195D8E04A254FA906B4E1003AA65A`。系统会显示不受信任，这是预期结果。
+
+The Windows self-signed code-signing certificate SHA-256 is `62B307F926AFE2641E306A557ACB0260A9159DA0A404A738298F01C5EC4F9F1F`. The CurrentUser\My thumbprint is `75F97DC8735195D8E04A254FA906B4E1003AA65A`. An untrusted-root warning is expected.
+
+`SHA256SUMS` 覆盖同目录的三个公钥文件。
+
+`SHA256SUMS` covers the three public files in this directory.

signing/v0.0.1/SHA256SUMS

@@ -0,0 +1,3 @@
+2932a7d4a531fcf6d92da32b3efcd34215f60902e26640091295dd5a90242c3c  git-signing-public.asc
+3d0e7fcafeacf781628a29de1d7ebcc7e2fee58cc14a9f0d258c06776ce5f690  android-release-public.cer
+62b307f926afe2641e306a557acb0260a9159da0a404a738298f01c5ec4f9f1f  windows-code-signing-public.cer

signing/v0.0.1/git-signing-public.asc

@@ -0,0 +1,9 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEau9DaBYJKwYBBAHaRw8BAQdAhRVEZcHn64PMyZ9bVx3jX1TZhv4jN8xxvAcj
+fpuNp2W0BkROVF9PRoiWBBMWCgA+FiEEE+IDrFPYh3itaak2HsXcCz7bsj4FAmrv
+Q2gCGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQHsXcCz7bsj4F
+MAD+JYkDxP5iAl22KNMg90fHVQWOBMqfy3jYroY6cuSC5GYA/jahsCAlh8vZPXGZ
+r2gJ7duokSmtv49lPqJjZN07DsMM
+=KYFk
+-----END PGP PUBLIC KEY BLOCK-----

src-tauri/icons/android/values/ic_launcher_background.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-  <color name="ic_launcher_background">#C9A473</color>
+  <color name="ic_launcher_background">#E7C9A7</color>
 </resources>