[masarray]

Summary

• replaces stale hard-coded About version/build/license text with the executable informational version, build commit, GPL-3.0-or-later status, historical boundary, commercial-license boundary, source links, and evidence limitations
• regenerates Quick Start and User Manual PDFs deterministically under the current GPL release line and validates their extracted text
• adds exact SOURCE.md corresponding-source identity, immutable commit archive URL, CycloneDX 1.5 SBOM, checksum coverage, build/source/tested-merge commit separation, and embedded package provenance
• verifies package legal files, source offer, SBOM, EXE version, embedded wording, required PDFs, and optional Authenticode status
• blocks public release publication until Windows signing secrets are configured, and adds GitHub build attestations for the package and SBOM
• validates Pages changes on pull requests and smoke-tests the deployed public site for the expected GPL/version state
• versions the CLA, identifies the Licensor, adds future CLA/DCO enforcement, expands asset and dependency provenance, and preserves the historical boundary with annotated tag license-boundary/apache-2.0-final
• pins critical GitHub Actions to reviewed revisions and aligns security scope with the receive-only product surface

Local validation

• deterministic PDF regeneration check
• public wording and PDF extraction validation
• repository health gate
• clean restore
• Release build
• full test suite: 54/54 passed

Release decision

Do not publish v1.4.0-beta.2 until this PR is merged, the deployed Pages smoke test passes, a fresh Windows candidate passes package verification, and the Authenticode certificate secrets are configured. Pull-request candidates may remain unsigned and are not official signed releases.

Contribution licensing

• I have read and affirmatively accept CONTRIBUTOR-LICENSE-AGREEMENT.md (CLA Version 1.0, effective 2026-07-17)
• I have the legal right and any required employer or organizational authorization to submit this contribution
• Every commit includes Signed-off-by: Name <email> under the DCO
• Any third-party material is identified with its license and provenance

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[masarray]

Post-v1.4.2 release triage: this July provenance/signing hardening proposal is not part of the published v1.4.2 source or binaries. Its last CI/release-package validation failed and its base predates the current main/release pipeline. Moved to Draft rather than merging a large stale security/release rewrite into stable without an updated implementation, signing configuration, and complete tests. Preserve for a focused future rebase/review; do not represent its unsigned-vs-signed or SBOM work as complete.

[masarray]

Repository cleanup after the public stable v1.4.2 release. This July 2026 draft targets a historical pre-v1.4.0 baseline and includes assumptions that do not match today's published unsigned, GPL-3.0-or-later community release. Its older release-blocking signing requirement is not adopted retroactively; the published v1.4.2 release clearly discloses the unsigned installer. The current default branch already has release versioning, checksums/manifests, licensing/provenance notices, CI/security checks and signed-off field-evidence limitations. Closing as superseded / not planned, not claiming all historic #11 ideas are implemented; any genuinely missing signing/SBOM/attestation enhancements should be proposed separately against current main. v1.4.2 release: https://github.com/masarray/DigSubAnalyzer/releases/tag/v1.4.2