Release winTerm v1.0.1 with self-signed installer

.github/ISSUE_TEMPLATE/Bug_Report.yml

@@ -11,7 +11,7 @@ body:
     id: version
     attributes:
       label: winTerm version
-      placeholder: 1.0.0 or exact commit
+      placeholder: 1.0.1 or exact commit
     validations:
       required: true
   - type: dropdown

.github/actions/spelling/expect/82ae324e5b5abd40a06a0506a07edb2f31fc1d62.txt

@@ -5,7 +5,7 @@ dracula
 fira
 gitmodules
 jetbrains
-Kaname
+HelloThisWorld
 keycap
 LANCZOS
 latte

.github/workflows/winget.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   validate:
     name: Generate and validate public-release manifests
-    if: github.event_name == 'workflow_dispatch' || github.event.release.tag_name == 'v1.0.0'
+    if: github.event_name == 'workflow_dispatch' || github.event.release.tag_name == 'v1.0.1'
     runs-on: windows-2022
     timeout-minutes: 20
     steps:
@@ -26,41 +26,41 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          $release = gh release view v1.0.0 --repo '${{ github.repository }}' --json tagName,isDraft,isPrerelease,url,assets | ConvertFrom-Json
-          if ($release.tagName -ne 'v1.0.0' -or $release.isDraft -or $release.isPrerelease) {
-            throw 'WinGet manifests may be generated only from the public stable v1.0.0 Release.'
+          $release = gh release view v1.0.1 --repo '${{ github.repository }}' --json tagName,isDraft,isPrerelease,url,assets | ConvertFrom-Json
+          if ($release.tagName -ne 'v1.0.1' -or $release.isDraft -or $release.isPrerelease) {
+            throw 'WinGet manifests may be generated only from the public stable v1.0.1 Release.'
           }
-          $asset = @($release.assets | Where-Object { $_.name -eq 'winTerm-1.0.0-x64.msix' })
+          $asset = @($release.assets | Where-Object { $_.name -eq 'winTerm-1.0.1-x64.msix' })
           if ($asset.Count -ne 1) {
             throw 'The public Release does not contain exactly one x64 installer.'
           }
 
           $downloadDirectory = Join-Path $env:RUNNER_TEMP 'winterm-winget-source'
           New-Item -ItemType Directory -Path $downloadDirectory | Out-Null
-          gh release download v1.0.0 --repo '${{ github.repository }}' --pattern 'winTerm-1.0.0-x64.msix' --dir $downloadDirectory
+          gh release download v1.0.1 --repo '${{ github.repository }}' --pattern 'winTerm-1.0.1-x64.msix' --dir $downloadDirectory
           if ($LASTEXITCODE -ne 0) {
             throw 'Public installer download failed.'
           }
-          $packagePath = Join-Path $downloadDirectory 'winTerm-1.0.0-x64.msix'
+          $packagePath = Join-Path $downloadDirectory 'winTerm-1.0.1-x64.msix'
           $sha = (Get-FileHash -LiteralPath $packagePath -Algorithm SHA256).Hash
-          $url = 'https://github.com/${{ github.repository }}/releases/download/v1.0.0/winTerm-1.0.0-x64.msix'
+          $url = 'https://github.com/${{ github.repository }}/releases/download/v1.0.1/winTerm-1.0.1-x64.msix'
           .\scripts\winterm\generate-winget-manifests.ps1 `
             -InstallerUrl $url `
             -InstallerSha256 $sha `
-            -OutputDirectory 'packaging\winget\1.0.0'
+            -OutputDirectory 'packaging\winget\1.0.1'
 
       - name: Validate WinGet manifests
         shell: pwsh
         run: |
-          winget validate 'packaging\winget\1.0.0'
+          winget validate 'packaging\winget\1.0.1'
           if ($LASTEXITCODE -ne 0) {
             throw 'winget validate failed.'
           }
 
       - name: Upload the validated manifest set for manual submission
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: Kaname.winTerm-1.0.0-winget
-          path: packaging/winget/1.0.0
+          name: HelloThisWorld.winTerm-1.0.1-winget
+          path: packaging/winget/1.0.1
           if-no-files-found: error
           retention-days: 30

.gitignore

@@ -18,6 +18,7 @@
 !docs/releases/
 docs/releases/*
 !docs/releases/1.0.0.md
+!docs/releases/1.0.1.md
 x64/
 x86/
 ARM64/

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.0.1 - Stable
+
+### Changed
+
+- Replaced the previous package and WinGet identity with `HelloThisWorld.winTerm`.
+- Updated application, package, shell module, About, Workspace metadata, and release versions to 1.0.1.
+- Added a direct GitHub Release download link and v1.0.1 badge to the README.
+- Changed the exact-tag Release workflow to build and cryptographically verify a self-signed x64 MSIX.
+
+### Security
+
+- The Release uploads the final MSIX, public CER, installation instructions, checksums, notices, SBOMs, symbols, and provenance from the exact immutable `v1.0.1` commit.
+- The temporary signing key is non-exportable and removed after signing; no private key is published.
+- Release assets are allowlisted, re-downloaded, and verified before and after publication.
+
+### Known issues
+
+- The installer is self-signed, is not publicly trusted or timestamped, and requires administrators to import the attached CER into Trusted People.
+- ARM64 and Windows 10 are not supported by this Release.
+
 ## 1.0.0 - Release candidate
 
 ### Added

README.md

@@ -1,43 +1,43 @@
 # winTerm
 
-[![Version](https://img.shields.io/badge/version-1.0.0-blue)](docs/releases/1.0.0.md)
+[Download winTerm v1.0.1](https://github.com/HelloThisWorld/winTerm/releases/tag/v1.0.1)
+
+[![Version](https://img.shields.io/badge/version-1.0.1-blue)](https://github.com/HelloThisWorld/winTerm/releases/tag/v1.0.1)
 [![Validation](https://github.com/HelloThisWorld/winTerm/actions/workflows/winterm-validation.yml/badge.svg)](https://github.com/HelloThisWorld/winTerm/actions/workflows/winterm-validation.yml)
 [![Windows build](https://github.com/HelloThisWorld/winTerm/actions/workflows/winterm-full-build.yml/badge.svg)](https://github.com/HelloThisWorld/winTerm/actions/workflows/winterm-full-build.yml)
-[![Stable release](https://img.shields.io/badge/stable%20release-blocked-critical)](docs/release-checklist-v1.0.md)
+[![Stable release](https://img.shields.io/badge/stable%20release-v1.0.1-success)](https://github.com/HelloThisWorld/winTerm/releases/latest)
 
 winTerm is an independent open-source terminal application based on Microsoft Windows Terminal.
 
 winTerm is not affiliated with or endorsed by Microsoft. It does not use Microsoft, Windows, or Windows Terminal logos.
 
 ## Latest stable release
 
-There is no approved public winTerm Stable release yet. The 1.0.0 candidate is blocked on production signing, clean Windows 11 installation, upgrade, uninstall, accessibility, packaged runtime, and performance evidence. A download link is intentionally withheld so an unsigned Draft or Actions artifact is not presented as a user installer.
-
-When the real public Release exists and its assets pass re-download verification, this section must link to the repository’s `/releases/latest` page.
+Download the latest verified installer from the [GitHub Releases page](https://github.com/HelloThisWorld/winTerm/releases/latest). The v1.0.1 installer is self-signed rather than signed by a public certificate authority, so Windows does not trust it automatically. Download the `.msix`, matching `.cer`, `INSTALL.txt`, and `SHA256SUMS.txt` from the same Release, verify the hashes, then follow the included certificate installation steps.
 
 ## Supported Windows versions
 
 The intended winTerm 1.0 support target is Windows 11 x64. Windows 10 is unsupported for the Stable commitment. ARM64 remains Disabled until a native ARM64 package is built, installed, and launched successfully and is actually attached to a public Release.
 
 ## Installation
 
-Do not install a development or Draft package as a Stable release. An approved installer must:
+The official installer must:
 
-- be downloaded from the public `v1.0.0` Release in this repository;
-- be named `winTerm-1.0.0-x64.msix`;
+- be downloaded from the public `v1.0.1` Release in this repository;
+- be named `winTerm-1.0.1-x64.msix`;
 - match `SHA256SUMS.txt`;
-- have a trusted production signature and timestamp whose subject matches the package Publisher;
+- have a cryptographically valid signature matching the included `winTerm-1.0.1.cer`;
 - install without Visual Studio, Git, Developer Mode, registry edits, global font installation, or profile modification.
 
-See [installation guidance](docs/user/installation.md).
+Because the certificate is self-signed, an administrator must import it into the Local Machine `Trusted People` certificate store before installing the MSIX. See [installation guidance](docs/user/installation.md).
 
 ## Screenshots
 
 Release screenshots must be captured from the signed winTerm package after branding and accessibility review. No Microsoft or Windows Terminal screenshot is reused as winTerm promotional artwork. Screenshots are therefore withheld while the Stable gate is blocked.
 
 ## Core features
 
-- independent `Kaname.winTerm` package identity and `winterm.exe` alias;
+- independent `HelloThisWorld.winTerm` package identity and `winterm.exe` alias;
 - PowerShell 7, Windows PowerShell 5.1, CMD, and dynamic WSL profile foundations;
 - conservative Linux-style Safe Compatibility for local PowerShell and CMD;
 - built-in and open-source Themes with pinned hashes and license records;
@@ -63,9 +63,9 @@ The exact gate status is recorded in:
 - [security review](docs/security-review-v1.0.md);
 - [accessibility audit](docs/accessibility-audit-v1.0.md);
 - [performance validation](docs/performance-v1.0.md);
-- [release notes](docs/releases/1.0.0.md).
+- [release notes](docs/releases/1.0.1.md).
 
-GitHub Actions may prepare an explicitly blocked Draft Release. It cannot publish an unsigned or untested installer, replace an existing Stable asset, or upload ARM64 without exact native-validation evidence.
+GitHub Actions builds from the exact immutable `v1.0.1` Tag, creates a temporary non-exportable self-signed key, verifies the package identity and embedded signature, uploads only allowlisted assets, re-downloads them for verification, and then publishes the Release. It never replaces an existing Release asset.
 
 ## Build
 
@@ -86,7 +86,7 @@ development wrapper from PowerShell 7:
 It builds and validates Release, creates a disposable self-signed code-signing
 certificate, signs the MSIX, exports only the public `.cer`, verifies the
 package signature and identity, and writes `SHA256SUMS.txt` under
-`artifacts/local/winTerm-1.0.0-development-x64`. The private key is removed
+`artifacts/local/winTerm-1.0.1-development-x64`. The private key is removed
 after signing.
 
 Before installation, an administrator must import the included `.cer` into

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-The latest public winTerm Stable release receives security support. There is currently no supported public Stable release while the 1.0.0 candidate is blocked. An unsigned development or Draft package is not a security release.
+The latest public winTerm Stable release receives security support. winTerm 1.0.1 is the current supported Stable release. Its installer is self-signed; verify the GitHub Release URL, SHA-256 hashes, attached public certificate, and GitHub provenance before importing certificate trust or installing it.
 
 ## Reporting a vulnerability
 

SUPPORT.md

@@ -2,7 +2,7 @@
 
 ## Supported releases
 
-The latest public Stable winTerm release is supported. A prerelease is supported for testing and feedback only. At present, winTerm 1.0.0 remains a release candidate and is not a supported public Stable release until every publication gate passes.
+The latest public Stable winTerm release is supported. A prerelease is supported for testing and feedback only. winTerm 1.0.1 is the current Stable release.
 
 ## Platforms and architectures
 

docs/architecture.md

@@ -33,7 +33,7 @@ Limited conditional changes in upstream integration files select the manifest, p
 
 | State | winTerm location or behavior |
 | --- | --- |
-| Packaged settings and state | Package-local data under `%LOCALAPPDATA%\Packages\<Kaname.winTerm package family>\LocalState` |
+| Packaged settings and state | Package-local data under `%LOCALAPPDATA%\Packages\<HelloThisWorld.winTerm package family>\LocalState` |
 | Unpackaged settings and state | `%LOCALAPPDATA%\winTerm` |
 | `settings.json` | The selected winTerm base settings directory |
 | `state.json` and elevated state | The selected winTerm base settings directory |

docs/branding.md

@@ -5,14 +5,14 @@
 | Surface | winTerm 1.0 value |
 | --- | --- |
 | Product and display name | `winTerm` |
-| Package name | `Kaname.winTerm` |
+| Package name | `HelloThisWorld.winTerm` |
 | Application ID | `winTerm` |
 | Execution alias | `winterm.exe` |
 | Forbidden alias | `wt.exe` |
 | Development publisher | `CN=winTerm Development` |
-| Stable publisher | Injected only from the protected signing environment and required to match the production certificate subject |
-| Package version | `1.0.0.0` |
-| Application version | `1.0.0` |
+| Stable publisher | `CN=winTerm Development`, matching the public self-signed Release certificate |
+| Package version | `1.0.1.0` |
+| Application version | `1.0.1` |
 | Release channel | `stable` |
 | Package description | `Independent open-source terminal based on Microsoft Windows Terminal` |
 
@@ -22,9 +22,9 @@ The terminal host may retain the internal filename `WindowsTerminal.exe`, and up
 
 ## Publisher and signing
 
-`CN=winTerm Development` is a source-controlled development placeholder, not a production publisher. The protected Release workflow may replace it only in the clean tag checkout immediately before packaging. The certificate subject must exactly match the injected Publisher. A private key, PFX, password, token, or signing-service credential must never be committed or uploaded as a release asset.
+`CN=winTerm Development` is the v1.0.1 self-signed publisher. The Release workflow creates a temporary non-exportable key and exports only its public CER. The certificate subject must exactly match the package Publisher. A private key, PFX, password, token, or signing-service credential must never be committed or uploaded as a release asset.
 
-An unsigned package can exist only in an explicitly blocked Draft Release. It cannot be described or published as a Stable installer.
+An unsigned package may exist only as an intermediate CI build. The public installer must contain a cryptographically valid signature matching the CER attached to the same Release.
 
 ## Application data and coexistence
 

docs/build.md

@@ -83,7 +83,7 @@ internal testing:
 
 The wrapper:
 
-1. verifies the 1.0.0 version and runs the source-level Smoke suite;
+1. verifies the 1.0.1 version and runs the source-level Smoke suite;
 2. builds the x64 Release MSIX with signing disabled;
 3. validates the generated package;
 4. runs the Relevant compiled tests when `-IncludeTests` is present;
@@ -98,11 +98,11 @@ The wrapper:
 The default output directory is ignored by Git:
 
 ```text
-artifacts/local/winTerm-1.0.0-development-x64/
+artifacts/local/winTerm-1.0.1-development-x64/
     INSTALL.txt
     SHA256SUMS.txt
-    winTerm-1.0.0-development.cer
-    winTerm-1.0.0-development-x64.msix
+    winTerm-1.0.1-development.cer
+    winTerm-1.0.1-development-x64.msix
 ```
 
 The wrapper refuses to overwrite an existing output directory. Use a new
@@ -118,7 +118,7 @@ again:
 
 ```powershell
 .\scripts\winterm\build-local-development.ps1 `
-  -PackagePath .\path\to\CascadiaPackage_1.0.0.0_x64.msix `
+  -PackagePath .\path\to\CascadiaPackage_1.0.1.0_x64.msix `
   -OutputDirectory artifacts/local/winTerm-development-from-existing-package
 ```
 
@@ -128,19 +128,19 @@ append a signature.
 To install the result:
 
 1. verify the files against `SHA256SUMS.txt`;
-2. open `winTerm-1.0.0-development.cer`;
+2. open `winTerm-1.0.1-development.cer`;
 3. choose **Install Certificate**, **Local Machine**, and **Trusted People**,
    and approve the administrator prompt;
-4. open `winTerm-1.0.0-development-x64.msix` and select **Install**.
+4. open `winTerm-1.0.1-development-x64.msix` and select **Install**.
 
 Equivalent elevated PowerShell commands are included in `INSTALL.txt`.
-Remove the development certificate after testing. A self-signed development
-package is not a substitute for the production-signed and timestamped Stable
-installer required by the [release process](release-process.md).
+Remove the development certificate after testing. Public v1.0.1 uses the same
+self-signing trust model but generates a distinct certificate from the exact
+release Tag; trust only the CER downloaded from that GitHub Release.
 
 ## CI runner
 
-The validation and full-build workflows use GitHub-hosted Windows runners. The Stable workflow uses the protected `winterm-stable-release` environment and an exact `v1.0.0` checkout. Only the protected prepare job may access production signing configuration; pull-request workflows never receive those secrets.
+The validation and full-build workflows use GitHub-hosted Windows runners. The Stable workflow accepts only an exact `v1.0.1` Tag checkout. It creates a temporary non-exportable self-signed key, publishes only the public CER, deletes the private key after signing, and verifies the released MSIX against that CER.
 
 ## Known build issues in the implementation environment
 

docs/compatibility-policy.md

@@ -10,7 +10,7 @@ This policy commits to:
 - preserving unsupported newer Workspace files rather than overwriting them;
 - creating a backup before a migration replaces persisted data;
 - deterministic and idempotent migrations;
-- preserving the `winterm.exe` alias and the `Kaname.winTerm` package boundary throughout 1.x;
+- preserving the `winterm.exe` alias and the `HelloThisWorld.winTerm` package boundary throughout 1.x;
 - leaving Windows Terminal settings, package identity, and `wt.exe` untouched.
 
 This is not a promise to read every future schema forever. A future incompatible schema must use a new schema version, publish a migration policy, and never silently downgrade or overwrite newer data.

docs/powershell-integration.md

@@ -1,6 +1,6 @@
 # PowerShell integration
 
-The packaged module is `ShellAssets\powershell\winTerm.Shell\winTerm.Shell.psd1`, version `1.0.0`. It supports PowerShell 7 and Windows PowerShell 5.1 with the same syntax.
+The packaged module is `ShellAssets\powershell\winTerm.Shell\winTerm.Shell.psd1`, version `1.0.1`. It supports PowerShell 7 and Windows PowerShell 5.1 with the same syntax.
 
 An explicit winTerm profile launcher must set these process-local variables before importing the module: