Sign WPM packages and prepare WSH 1.0.1

.github/workflows/m2.yml

@@ -250,7 +250,7 @@ jobs:
           ./tools/Build-WpmPackage.ps1 `
             -Architecture '${{ matrix.arch }}' `
             -Configuration Debug `
-            -Version "1.0.0+$shortRevision" `
+            -Version "1.0.1+$shortRevision" `
             -BuildDirectory '${{ matrix.build_directory }}'
 
       - name: Collect Debug build and test evidence
@@ -464,17 +464,44 @@ jobs:
           }
           $wpmDirectory >> $env:GITHUB_PATH
 
-      - name: Build Release WPM packages
+      - name: Build and verify signed Release WPM packages
         shell: pwsh
+        env:
+          WPM_PRIVATE_KEY: ${{ secrets.WPM_RELEASE_PRIVATE_KEY }}
         run: |
-          foreach ($architecture in @('x86', 'x64', 'arm64')) {
-            ./tools/Build-WpmPackage.ps1 `
-              -Architecture $architecture `
-              -Configuration Release `
-              -Version '${{ github.ref_name }}' `
-              -BuildDirectory "out/release-builds/$architecture" `
-              -TinyCcVersion '0.9.28-rc.1444+9a4be30f' `
-              -WcrtVersion '1.0.0'
+          if ([string]::IsNullOrWhiteSpace($env:WPM_PRIVATE_KEY)) {
+            throw 'Tagged releases require the WPM_RELEASE_PRIVATE_KEY secret.'
+          }
+          $keyPath = Join-Path $env:RUNNER_TEMP 'wsh-release.private'
+          try {
+            [IO.File]::WriteAllText($keyPath, $env:WPM_PRIVATE_KEY)
+            foreach ($architecture in @('x86', 'x64', 'arm64')) {
+              ./tools/Build-WpmPackage.ps1 `
+                -Architecture $architecture `
+                -Configuration Release `
+                -Version '${{ github.ref_name }}' `
+                -BuildDirectory "out/release-builds/$architecture" `
+                -TinyCcVersion '0.9.28-rc.1444+9a4be30f' `
+                -WcrtVersion '1.0.0' `
+                -SigningKey $keyPath
+            }
+
+            wpm trust add release_keys/wpm-release.public
+            if ($LASTEXITCODE -ne 0) {
+              throw 'WPM failed to trust the release public key.'
+            }
+            $packages = @(Get-ChildItem out/packages/wsh-*.zip -File)
+            if ($packages.Count -ne 3) {
+              throw "Expected three signed Release packages; found $($packages.Count)."
+            }
+            foreach ($package in $packages) {
+              wpm verify $package.FullName
+              if ($LASTEXITCODE -ne 0) {
+                throw "WPM signature verification failed: $($package.Name)"
+              }
+            }
+          } finally {
+            Remove-Item $keyPath -Force -ErrorAction SilentlyContinue
           }
 
       - name: Upload complete Release WPM package set
@@ -518,9 +545,11 @@ jobs:
           name: wsh-release-packages
           path: release-assets
 
-      - name: Create WPM repository indexes
+      - name: Create WPM repository assets
         shell: pwsh
         run: |
+          Copy-Item release_keys/wpm-release.public `
+            release-assets/wpm-release.public
           ./tools/New-WpmRepositoryIndex.ps1 `
             -PackageDirectory release-assets `
             -OutputDirectory release-assets `

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.20)
 
-project(wsh VERSION 1.0.0 LANGUAGES C)
+project(wsh VERSION 1.0.1 LANGUAGES C)
 
 set(CMAKE_C_STANDARD 99)
 set(CMAKE_C_STANDARD_REQUIRED ON)
@@ -116,8 +116,10 @@ target_link_libraries(wsh_static PUBLIC wsh_core)
 target_link_libraries(wsh_shared PUBLIC wsh_core)
 
 target_compile_definitions(wsh_static PRIVATE
+    WSH_VERSION="${PROJECT_VERSION}"
     WSH_WCRT_VERSION="${WSH_WCRT_VERSION}")
 target_compile_definitions(wsh_shared PRIVATE
+    WSH_VERSION="${PROJECT_VERSION}"
     WSH_WCRT_VERSION="${WSH_WCRT_VERSION}")
 
 add_executable(wsh src/main.c)

README.md

@@ -14,6 +14,33 @@ completed the M0 baseline review and form the accepted project baseline. The
 M1 repository skeleton and M2 portable core are implemented. Lexer, parser,
 evaluator, and Windows process behavior remain allocated to later milestones.
 
+## Install
+
+With [WPM] installed, open an elevated PowerShell session, add the latest WSH
+release as a package repository, and install the package for the current
+Windows architecture:
+
+```powershell
+Invoke-WebRequest `
+  https://github.com/Thewafflication/wsh/releases/latest/download/wpm-release.public `
+  -OutFile wpm-release.public
+wpm trust add wpm-release.public
+wpm repo add https://github.com/Thewafflication/wsh/releases/latest/download
+wpm update
+wpm install wsh
+```
+
+Use `--arch x86`, `--arch x64`, or `--arch arm64` to select an architecture
+explicitly. The package installs WSH beneath `%ProgramFiles%` and sets the
+machine-level `WSH_HOME` variable. Open a new terminal and verify the install:
+
+```powershell
+& "$env:WSH_HOME\wsh.exe" --version
+```
+
+Release packages are signed with the published WPM release key and accompanied
+by `SHA256SUMS` on the [latest release].
+
 ## Project Goals
 
 - Target Windows without requiring a POSIX compatibility layer.
@@ -50,20 +77,19 @@ adapted, extended, or excluded reference behavior.
 
 ## Build and Test
 
-The primary presets use the WPM-installed TinyCC and WCRT packages. Install
-the pinned build dependencies once (WPM selects the native TinyCC package):
+The primary presets use WPM-installed TinyCC and WCRT packages. From an
+elevated PowerShell session, install the project-pinned build dependencies for
+the target architecture:
 
 ```powershell
-wpm config set prerelease true --package tinycc
-wpm install tinycc --version 0.9.28-rc.1444+9a4be30f
-wpm install wcrt --arch any --version 1.0.0
+./tools/Install-BuildDependencies.ps1 -Architecture x64
 ```
 
-The toolchain finds those pinned versions beneath `%ProgramFiles%` and falls
-back to `TCC_HOME` and `WCRT_HOME` for custom installation roots. CMake 3.20 or
-newer and Ninja are also required. The checked-in presets build the executable,
-static/shared library skeletons, portable core, and controlled tests. For
-example:
+Replace `x64` with `x86` or `arm64` as needed. The toolchain finds the pinned
+dependencies beneath `%ProgramFiles%` and falls back to `TCC_HOME` and
+`WCRT_HOME` for custom installation roots. CMake 3.20 or newer and Ninja are
+also required. The checked-in presets build the executable, static/shared
+library skeletons, portable core, and controlled tests. For example:
 
 ```powershell
 cmake --preset x64-debug
@@ -95,11 +121,11 @@ the release also includes an identical `repository.json` compatibility asset.
 
 ## Release Toolchain
 
-CI provisions TinyCC `0.9.28-rc.1444+9a4be30f` and WCRT `1.0.0` through WPM
-before every architecture build. The dependency script verifies the durable
-WPM release key before installing either package. KerTeX and cv2pdb remain
-separate documentation and symbol-tool dependencies. CTest remains the
-top-level test dispatcher.
+CI provisions the project-pinned TinyCC and WCRT packages through WPM before
+every architecture build. The dependency script verifies the durable WPM
+release key before installing either package. KerTeX and cv2pdb remain separate
+documentation and symbol-tool dependencies. CTest remains the top-level test
+dispatcher.
 
 ## Project Process
 
@@ -135,3 +161,5 @@ Project-owned source files should use:
 [architecture decisions]: docs/adr-0001-rc-inspired-windows-language.md
 [adoption record]: docs/adoption-record.md
 [rc-manual]: https://9fans.github.io/plan9port/man/man1/rc.html
+[WPM]: https://github.com/Thewafflication/wpm
+[latest release]: https://github.com/Thewafflication/wsh/releases/latest

release_keys/wpm-release.public

@@ -0,0 +1,3 @@
+wpm-public-key-v1
+algorithm=ed25519
+public-key=Juf5Rpofn1AToGC4YWFYJ5FX59+OprOTcWTfeVnQ3DQ=

src/wshlib.c

@@ -2,13 +2,17 @@
 
 #include <stdio.h>
 
+#ifndef WSH_VERSION
+#define WSH_VERSION "unavailable"
+#endif
+
 #ifndef WSH_WCRT_VERSION
 #define WSH_WCRT_VERSION "unavailable"
 #endif
 
 const char *wsh_get_version_string(void)
 {
-    return "1.0.0";
+    return WSH_VERSION;
 }
 
 const char *wsh_get_runtime_name(void)

tests/CMakeLists.txt

@@ -20,10 +20,12 @@ set(WSH_TEST_TOOLCHAIN "TinyCC ${WSH_TINYCC_VERSION}")
 set(WSH_TEST_TARGET_ARCHITECTURE "${WSH_TARGET_ARCHITECTURE}")
 
 add_test(NAME version-smoke COMMAND wsh --version)
+string(REPLACE "." "\\." WSH_TEST_VERSION_PATTERN "${PROJECT_VERSION}")
 set_tests_properties(
     version-smoke
     PROPERTIES
-        PASS_REGULAR_EXPRESSION "Waughtal Shell.*Version 1\\.0\\.0"
+        PASS_REGULAR_EXPRESSION
+            "Waughtal Shell.*Version ${WSH_TEST_VERSION_PATTERN}"
 )
 
 add_test(NAME print-abi-smoke COMMAND wsh --print-abi)

tools/Build-WpmPackage.ps1

@@ -180,13 +180,17 @@ try {
         $entries[$entry.FullName.Replace('\', '/')] = $entry.Length
     }
 
-    foreach ($requiredEntry in @(
+    $requiredEntries = @(
         'wsh.exe',
         '.wpm/package.txt',
         '.wpm/install.cmd',
         '.wpm/remove.cmd',
         '.wpm/index.csv'
-    )) {
+    )
+    if (-not [string]::IsNullOrWhiteSpace($SigningKey)) {
+        $requiredEntries += '.wpm/signature.json'
+    }
+    foreach ($requiredEntry in $requiredEntries) {
         if (-not $entries.ContainsKey($requiredEntry) -or
             $entries[$requiredEntry] -eq 0) {
             throw "WPM package is missing a required entry: $requiredEntry"