chore(release): close the changelogs for 0.7.0

CHANGELOG.md

@@ -5,8 +5,16 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); versions fol
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-25
+
 ### Added
 
+- **A Tools tab, with a filter tester.** Pick a field from the Control page, type an
+  expression and a value, and see at once whether they match - and which part of the
+  expression decided it, for example the `!10.0.5.0/24` that excluded `10.0.5.7`. A value
+  that is not an address, a port or a PID is reported as that, not as "does not match".
+  "Use in the Control field" puts the expression into that field.
+
 - **Sockets, on the Tools tab.** Every TCP and UDP socket on this computer, like
   `netstat -ano`, with no session needed: what is listening, what is connected, its state
   and the program that owns it. See which port your application listens on before you
@@ -20,12 +28,6 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); versions fol
   on a port nothing seems to use is often in a range Windows set aside, and this shows it
   at once. Nothing is sent over the network. It is the second tab of the Tools page.
 
-- **A Tools tab, with a filter tester.** Pick a field from the Control page, type an
-  expression and a value, and see at once whether they match - and which part of the
-  expression decided it, for example the `!10.0.5.0/24` that excluded `10.0.5.7`. A value
-  that is not an address, a port or a PID is reported as that, not as "does not match".
-  "Use in the Control field" puts the expression into that field.
-
 - **Diagnostics, on the Tools tab.** When START will not work, this shows why without a
   console: the same checks as `--doctor`, each marked OK, Warning or Problem, with a "?"
   that explains them in plain words. "Clean up the driver" unloads a WinDivert driver that
@@ -70,7 +72,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); versions fol
   The run now says it once, and still runs, because impairing one direction on purpose is a
   perfectly good thing to ask for.
 
-- **Some command-line shortcuts stopped working, and the full flags did not.** Adding the
+- **Some shortened command-line options no longer work. The full ones still do.** Adding the
   upload flags means `--latency` is no longer the only option starting with "latency", so
   short forms like `--lat`, `--jit`, `--j`, `--cor` and `--spike-p` are now ambiguous and are
   refused. Every full flag still works, so saved reproduction commands and every example in
@@ -92,16 +94,25 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); versions fol
 
 ### Docs
 
-- **The README now points at the website.** One link under the badges, and a second after the
-  quick start for anyone who wants a walkthrough of a single task instead of the full manual.
-  The guides there cover packet loss, latency, speed limits, aiming at one app and testing with
-  no internet, each with the numbers worth trying and the command that does it.
+- **The README now points at the website.** A link after the quick start leads to the guides,
+  for anyone who wants a walkthrough of a single task instead of the full manual. They cover
+  packet loss, latency, speed limits, aiming at a single app and testing with no internet, each
+  with the numbers worth trying and the command that does it.
 
 - **The website's front page now shows the command it was talking about.** It said one command is
   enough to check that a service survives 10 percent packet loss, and then did not print one,
   which every other page on the site does. It now shows the command, says that the run stops
   itself when the time is up, and points at the rehearsal switch that changes no real traffic.
 
+- **The website's download page describes the release as it is.** It mentions the installer
+  next to the zip and lists every file a release carries. The command it gave for checking a
+  download failed for everyone. It is now the same command as in the README, which is run
+  against every published release.
+
+- **The website no longer says the program is unsigned.** It has been signed since 0.5.0. The
+  download and questions pages now say so, and explain that Windows can still warn for a while
+  because the certificate is new.
+
 ## [0.6.0] - 2026-09-04
 
 ### Added

VERSION.txt

@@ -1 +1 @@
-0.6.0
+0.7.0

site/pages/download/en.html

@@ -1,7 +1,7 @@
 <section class="hero">
   <h1>Download Bean Network Tester</h1>
-  <p class="lead">One archive, no installer. Unpack it, run the executable, and it asks for
-  administrator rights itself.</p>
+  <p class="lead">A zip that runs without installing anything, or an installer for everyone on
+  the computer. Either way, the program asks for administrator rights itself.</p>
   <p class="actions">
     <a class="btn btn-primary" href="{{site.download_url}}">{{cta.download}}</a>
   </p>
@@ -13,7 +13,9 @@ <h2>The facts, in one place</h2>
     <li><strong>Price:</strong> free, and free software - GNU GPL v3.</li>
     <li><strong>Runs on:</strong> Windows 10 and Windows 11, 64-bit.</li>
     <li><strong>Needs:</strong> administrator rights, because traffic is captured by a driver.</li>
-    <li><strong>Install:</strong> none. Unpack the archive anywhere and run it.</li>
+    <li><strong>Install:</strong> not needed. Unpack the zip anywhere and run it. Or use the
+    <code>.msi</code> installer, which adds a Start Menu entry and puts the program on
+    <code>PATH</code> (it needs administrator rights).</li>
     <li><strong>Sends data:</strong> nowhere. No telemetry, no update check, no network client.</li>
     <li><strong>Modes:</strong> a window, and the same file as a command-line tool.</li>
     <li><strong>Source:</strong> <a href="{{site.repo_url}}">on GitHub</a>, under the same licence.</li>
@@ -22,34 +24,43 @@ <h2>The facts, in one place</h2>
 
 <section>
   <h2>What is in the release</h2>
-  <p>Every release publishes three files, and the two beside the archive are there so you do not
-  have to take the download on trust:</p>
+  <p>A release publishes five files. Two are the program, and the other three are there so you
+  do not have to take the download on trust:</p>
   <ul>
     <li><strong>the zip</strong> - the program and the driver it uses, together in one folder;</li>
-    <li><strong>SHA256SUMS.txt</strong> - the checksum of that archive;</li>
+    <li><strong>the .msi installer</strong> - the same program, installed for everyone on the
+    computer, with a Start Menu entry;</li>
+    <li><strong>SHA256SUMS.txt</strong> - the checksums of the zip and the installer;</li>
     <li><strong>an SBOM</strong> - a standard list of every component inside, with versions and
-    licences, signed against the archive.</li>
+    licences, signed against the zip;</li>
+    <li><strong>a .sigstore.json file</strong> - that signature as a file, to check it without
+    asking GitHub.</li>
   </ul>
 </section>
 
 <section>
   <h2>Checking that you got what we built</h2>
   <p>The checksum answers "did this arrive unchanged". In PowerShell, compare the output with the
-  line in <code>SHA256SUMS.txt</code>:</p>
+  line in <code>SHA256SUMS.txt</code> (for the installer, put <code>.msi</code> in place of
+  <code>.zip</code>):</p>
 <pre><code>Get-FileHash .\BeanNetworkTester-*.zip -Algorithm SHA256</code></pre>
   <p>The signature answers a different question - "did this come out of that repository" - and needs
   the GitHub command-line tool:</p>
-<pre><code>gh attestation verify .\BeanNetworkTester-*.zip --repo donislawdev/BeanNetworkTester</code></pre>
+<pre><code>gh attestation verify BeanNetworkTester-vX.Y.Z-windows-x64.zip --repo donislawdev/BeanNetworkTester --predicate-type https://spdx.dev/Document/v2.3</code></pre>
+  <p>Type the name of the zip you downloaded as the first part - <code>gh</code> does not accept a
+  <code>*</code> there. Keep <code>--predicate-type</code>: without it <code>gh</code> looks for a
+  different kind of statement and reports that it found none.</p>
   <p>A checksum you copy from the same page as the download proves less than a signature. Both are
   published, so both are worth a moment.</p>
 </section>
 
 <section>
   <h2>Windows may warn you</h2>
-  <p>The executable is not signed with a paid certificate, so SmartScreen flags it as something it
-  has not seen before. That is a statement about the certificate, not about the file - which is
-  exactly why the checksum and the signature are published. The
-  <a href="../faq/">questions page</a> covers this and what the driver needs.</p>
+  <p>The program and the installer are signed, so Windows names who signed them instead of saying
+  "Unknown publisher". The certificate is new, so SmartScreen may still warn for a while - it has
+  not seen it often yet. That is about the certificate, not about the file, and the two checks
+  above let you verify the file yourself. The <a href="../faq/">questions page</a> covers this and
+  what the driver needs.</p>
 </section>
 
 <section>

site/pages/download/page.json

@@ -6,13 +6,13 @@
       "slug": "download",
       "link_text": "Download",
       "title": "Download Bean Network Tester for Windows",
-      "description": "Free download for Windows 10 and 11, no installer. What is in the archive, how to check it is the file we built, and what it needs to run."
+      "description": "Free download for Windows 10 and 11, as a zip or an installer. What is in the release, how to check it is the file we built, and what it needs to run."
     },
     "pl": {
       "slug": "pobieranie",
       "link_text": "Pobieranie",
       "title": "Pobierz Bean Network Tester na Windows",
-      "description": "Darmowe pobranie na Windows 10 i 11, bez instalatora. Co jest w archiwum, jak sprawdzić, że to nasz plik, i czego program potrzebuje."
+      "description": "Darmowe pobranie na Windows 10 i 11, jako zip albo instalator. Co jest w wydaniu, jak sprawdzić, że to nasz plik, i czego program potrzebuje."
     }
   }
 }

site/pages/download/pl.html

@@ -1,7 +1,7 @@
 <section class="hero">
   <h1>Pobierz Bean Network Tester</h1>
-  <p class="lead">Jedno archiwum, bez instalatora. Rozpakuj, uruchom plik wykonywalny, a on sam
-  poprosi o prawa administratora.</p>
+  <p class="lead">Archiwum zip, które działa bez instalowania, albo instalator dla wszystkich
+  użytkowników komputera. W obu przypadkach program sam poprosi o prawa administratora.</p>
   <p class="actions">
     <a class="btn btn-primary" href="{{site.download_url}}">{{cta.download}}</a>
   </p>
@@ -13,7 +13,9 @@ <h2>Fakty w jednym miejscu</h2>
     <li><strong>Cena:</strong> darmowy, i wolne oprogramowanie - GNU GPL v3.</li>
     <li><strong>Działa na:</strong> Windows 10 i Windows 11, 64-bit.</li>
     <li><strong>Wymaga:</strong> praw administratora, bo ruch przechwytuje sterownik.</li>
-    <li><strong>Instalacja:</strong> żadna. Rozpakuj archiwum gdziekolwiek i uruchom.</li>
+    <li><strong>Instalacja:</strong> niepotrzebna. Rozpakuj zip gdziekolwiek i uruchom. Możesz też
+    użyć instalatora <code>.msi</code>, który dodaje program do menu Start i do <code>PATH</code>
+    (wymaga praw administratora).</li>
     <li><strong>Wysyła dane:</strong> nigdzie. Bez telemetrii, bez sprawdzania aktualizacji, bez
     klienta sieciowego.</li>
     <li><strong>Tryby:</strong> okno i ten sam plik jako narzędzie linii komend.</li>
@@ -24,35 +26,45 @@ <h2>Fakty w jednym miejscu</h2>
 
 <section>
   <h2>Co jest w wydaniu</h2>
-  <p>Każde wydanie publikuje trzy pliki, a te dwa obok archiwum są po to, żebyś nie musiał brać
-  pobrania na wiarę:</p>
+  <p>Wydanie publikuje pięć plików. Dwa to program, a pozostałe trzy są po to, żebyś nie musiał
+  brać pobrania na wiarę:</p>
   <ul>
     <li><strong>archiwum zip</strong> - program i sterownik, którego używa, razem w jednym
     katalogu;</li>
-    <li><strong>SHA256SUMS.txt</strong> - suma kontrolna tego archiwum;</li>
+    <li><strong>instalator .msi</strong> - ten sam program, instalowany dla wszystkich
+    użytkowników komputera, z pozycją w menu Start;</li>
+    <li><strong>SHA256SUMS.txt</strong> - sumy kontrolne archiwum i instalatora;</li>
     <li><strong>SBOM</strong> - standardowa lista każdego komponentu w środku, z wersjami i
-    licencjami, podpisana wobec archiwum.</li>
+    licencjami, podpisana wobec archiwum;</li>
+    <li><strong>plik .sigstore.json</strong> - ten podpis jako plik, żeby sprawdzić go bez
+    pytania GitHuba.</li>
   </ul>
 </section>
 
 <section>
   <h2>Sprawdzenie, że dostałeś to, co zbudowaliśmy</h2>
   <p>Suma kontrolna odpowiada na pytanie „czy plik dotarł niezmieniony". W PowerShellu porównaj
-  wynik z linią w <code>SHA256SUMS.txt</code>:</p>
+  wynik z linią w <code>SHA256SUMS.txt</code> (dla instalatora wpisz <code>.msi</code> zamiast
+  <code>.zip</code>):</p>
 <pre><code>Get-FileHash .\BeanNetworkTester-*.zip -Algorithm SHA256</code></pre>
   <p>Podpis odpowiada na inne pytanie - „czy to wyszło z tego repozytorium" - i wymaga narzędzia
   linii komend GitHuba:</p>
-<pre><code>gh attestation verify .\BeanNetworkTester-*.zip --repo donislawdev/BeanNetworkTester</code></pre>
+<pre><code>gh attestation verify BeanNetworkTester-vX.Y.Z-windows-x64.zip --repo donislawdev/BeanNetworkTester --predicate-type https://spdx.dev/Document/v2.3</code></pre>
+  <p>Jako pierwszą część wpisz nazwę pobranego pliku zip - <code>gh</code> nie przyjmuje tam
+  <code>*</code>. Zostaw <code>--predicate-type</code>: bez niego <code>gh</code> szuka innego
+  rodzaju poświadczenia i odpowiada, że żadnego nie znalazł.</p>
   <p>Suma kontrolna skopiowana z tej samej strony, z której pobierasz plik, dowodzi mniej niż
   podpis. Publikujemy oba, więc oba są warte chwili.</p>
 </section>
 
 <section>
   <h2>Windows może ostrzegać</h2>
-  <p>Plik wykonywalny nie jest podpisany płatnym certyfikatem, więc SmartScreen oznacza go jako
-  coś, czego wcześniej nie widział. To zdanie o certyfikacie, nie o pliku - i właśnie dlatego suma
-  kontrolna i podpis są opublikowane. <a href="../najczestsze-pytania/">Strona z pytaniami</a>
-  opisuje to oraz czego potrzebuje sterownik.</p>
+  <p>Program i instalator są podpisane, więc Windows pokazuje, kto je podpisał, zamiast
+  nieznanego wydawcy. Certyfikat jest nowy, więc SmartScreen może jeszcze przez jakiś czas
+  ostrzegać - rzadko go dotąd widział. To zdanie o certyfikacie, nie o pliku, a dwa sprawdzenia
+  powyżej pozwalają zweryfikować plik samodzielnie.
+  <a href="../najczestsze-pytania/">Strona z pytaniami</a> opisuje to oraz czego potrzebuje
+  sterownik.</p>
 </section>
 
 <section>

site/pages/faq/en.html

@@ -34,10 +34,11 @@ <h2>Does it send anything anywhere?</h2>
 
 <section>
   <h2>Windows warned me about the download. Why?</h2>
-  <p>Because the executable is new and unsigned, and SmartScreen flags anything it has not seen
-  before. A code-signing certificate is a yearly cost, not a statement about the file. Every release
-  publishes a SHA-256 checksum, a list of components, and a signature tying the two to the build that
-  produced them, so you can verify what you downloaded instead of trusting a green tick.</p>
+  <p>The program is signed, so the warning names who signed it instead of saying "Unknown
+  publisher". SmartScreen can still warn for a while, because the certificate is new and it has not
+  seen it often yet. Some antivirus tools may also react to a program that asks for administrator
+  rights and loads a network driver. Every release publishes a SHA-256 checksum and a signed list of
+  its components, so you can verify what you downloaded instead of trusting a green tick.</p>
 </section>
 
 <section>

site/pages/faq/pl.html

@@ -35,10 +35,12 @@ <h2>Czy program cokolwiek gdzieś wysyła?</h2>
 
 <section>
   <h2>Windows ostrzegł mnie przy pobieraniu. Dlaczego?</h2>
-  <p>Bo plik jest nowy i niepodpisany, a SmartScreen oznacza wszystko, czego wcześniej nie widział.
-  Certyfikat do podpisywania kodu to koszt roczny, nie opinia o pliku. Każde wydanie publikuje sumę
-  kontrolną SHA-256, listę komponentów i podpis wiążący jedno z drugim z buildem, który je wytworzył
-  - więc możesz sprawdzić, co pobrałeś, zamiast wierzyć zielonemu znaczkowi.</p>
+  <p>Program jest podpisany, więc ostrzeżenie pokazuje, kto go podpisał, zamiast nieznanego
+  wydawcy. SmartScreen może jeszcze przez jakiś czas ostrzegać, bo certyfikat jest nowy i rzadko go
+  dotąd widział. Niektóre antywirusy mogą też reagować na program, który prosi o prawa
+  administratora i ładuje sterownik sieciowy. Każde wydanie publikuje sumę kontrolną SHA-256 i
+  podpisaną listę komponentów, więc możesz sprawdzić, co pobrałeś, zamiast wierzyć zielonemu
+  znaczkowi.</p>
 </section>
 
 <section>

tests/test_site.py

@@ -411,6 +411,31 @@ def glob_pages(code):
     return glob.glob(os.path.join(SITE, "pages", "*", "%s.html" % code))
 
 
+def test_the_pages_never_call_a_signed_program_unsigned():
+    """Every release since 0.5.0 is signed, and the site went on saying it was not.
+
+    The download page said "not signed with a paid certificate" and the questions page
+    "new and unsigned", in both languages, for weeks after the first signed release -
+    while the README told the right story. Prose that nothing reads is prose that
+    rots. The fact lives in ``legal.CODESIGN_SHA256``: while it pins a certificate, no
+    page may say the program is unsigned. Emptying that constant is the day this test
+    and the pages change together, which is why it fails instead of skipping.
+    """
+    from beantester import legal
+    check("a signing certificate is pinned", bool(legal.CODESIGN_SHA256),
+          "(if signing stopped, rewrite this test together with the pages)")
+    denial = re.compile(r"\bunsigned\b|\bnot signed\b|niepodpisan|nie jest podpisan", re.I)
+    registry = build_site.load_registry(ROOT)
+    seen = 0
+    for code in build_site.language_codes(registry):
+        for path in sorted(glob_pages(code)):
+            seen += 1
+            found = denial.findall(_read(path))
+            check(f"{os.path.basename(os.path.dirname(path))} [{code}]: "
+                  f"does not call the program unsigned", not found, f"({found})")
+    check("there are pages to read", seen > 20, f"({seen})")
+
+
 def test_the_program_strings_really_reach_the_built_pages(tmp_path):
     """The other half: every ``{{app.*}}`` a page uses resolves to the program's text.