From 78e8979a5d6a6daf8322b2587b98c7b94516435b Mon Sep 17 00:00:00 2001 From: Frode Hus Date: Sat, 19 Sep 2026 10:31:29 +0200 Subject: [PATCH 1/2] Record that the winget packages are published The submissions opened on 2026-09-15 have been approved, and BuildInfo has reported the Certum signature since 1.2.2 rather than "Unsigned". Co-Authored-By: Claude Opus 5 --- windows/CONTINUING.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/CONTINUING.md b/windows/CONTINUING.md index 66164b78..9486640d 100644 --- a/windows/CONTINUING.md +++ b/windows/CONTINUING.md @@ -72,7 +72,7 @@ work added these: - **Option-click is Ctrl-click.** `PanelView` reads the Control key state at click time (`InputKeyboardSource.GetKeyStateForCurrentThread`) for Activate, Extend and the profile chips. - **The global shortcut is `RegisterHotKey` on the tray's hidden window**, which receives `WM_HOTKEY`; `HotKeyCenter` implements the model's `IHotKeyCenter` seam. A binding is a virtual key plus `MOD_*` flags, recorded by `HotKeyRecorder` (a button that captures the next key press; Ctrl, Alt or Win required) and stored in `settings.json`. - **The update check reads the releases list**, not `releases/latest`, and keeps the first published `v*` release that carries an MSI: both platforms share one tag, but a macOS-only hotfix without an MSI must not offer itself to Windows users. -- **`BuildInfo`** takes the version from the assembly's informational version (`installer/build.ps1` sets it from the tag) and the signing state from the executable's Authenticode signature; "Unsigned" for the current releases. +- **`BuildInfo`** takes the version from the assembly's informational version (`installer/build.ps1` sets it from the tag) and the signing state from the executable's Authenticode signature: `Signed: `, which release builds have shown since 1.2.2 ("Open Source Developer Frode Hus", the Certum certificate), and "Unsigned" for a local build. - **Windows App SDK 1.8** (1.8.260804001), self-contained in the MSI; .NET itself is framework-dependent (`Microsoft.DotNet.Runtime.10`). - **The winget manifest is generated, not committed, and submitted by the publish job** (`scripts/submit-winget.sh`, needs the `WINGET_TOKEN` secret): one microsoft/winget-pkgs pull request per package and release. winget-pkgs nests dotted identifiers, so the CLI's manifests live at `manifests/r/Reothor/Elevate/CLI/`. @@ -95,5 +95,5 @@ work added these: ## What is left -- **Issue #17, code signing and winget submission**: done. Signing with the Certum SimplySign certificate needs the `CERTUM_USERNAME`, `CERTUM_OTP_URI` and `CERTUM_KEY_ID` secrets (`docs/releasing.md`, "Windows signing secrets"; `scripts/Connect-SimplySign.ps1` opens the cloud session on the runner); winget submission needs `WINGET_TOKEN`. The first submissions were opened on 2026-09-15 and await Microsoft's review. Releases are shared with macOS since 1.2.0: one `v*` tag, one release, `.github/workflows/release.yml`. +- **Issue #17, code signing and winget submission**: done. Signing with the Certum SimplySign certificate needs the `CERTUM_USERNAME`, `CERTUM_OTP_URI` and `CERTUM_KEY_ID` secrets (`docs/releasing.md`, "Windows signing secrets"; `scripts/Connect-SimplySign.ps1` opens the cloud session on the runner); winget submission needs `WINGET_TOKEN`. The first submissions were opened on 2026-09-15 and Microsoft published them: `Reothor.Elevate` and `Reothor.Elevate.CLI` at 1.7.0, `Reothor.Elevate.Audit` at 1.0.1. Releases are shared with macOS since 1.2.0: one `v*` tag, one release, `.github/workflows/release.yml`. - The Windows design canvas in `docs/design` predates the profiles row, the Approvals group and the new windows; refresh it when the next visual change lands. From d61f5b79efcfb830887db48ac29f963ccb891d69 Mon Sep 17 00:00:00 2001 From: Frode Hus Date: Sat, 19 Sep 2026 10:33:16 +0200 Subject: [PATCH 2/2] Lead the Windows install docs with winget The three packages are published in microsoft/winget-pkgs, so the install sections can name the command instead of the pending submission: the root README and the getting-started guide offer it beside the MSI, the Windows README opens with it and upgrades with it, and the CLI README drops the note about waiting on Azure Artifact Signing. The winget roadmap item is done, and it was the only one left in that section. Co-Authored-By: Claude Opus 5 --- README.md | 19 +++++++------------ cli/README.md | 7 ++++--- docs/getting-started.md | 4 ++-- windows/README.md | 21 +++++++++++++-------- 4 files changed, 26 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 35031751..f18a9949 100644 --- a/README.md +++ b/README.md @@ -26,12 +26,13 @@ tenants, and finding your way around the panel. The rest of the user guides are - **macOS 26**: Homebrew cask or DMG, see [macos/README.md](macos/README.md#install). The cask and the pkg also install the `elevate` CLI; the DMG is the app alone. -- **Windows 11**: per-user MSI, which installs the app and the `elevate` CLI, see - [windows/README.md](windows/README.md#install). -- **CLI on its own** (Linux, Intel Macs, servers): a single binary from the release, see - [cli/README.md](cli/README.md#install). -- **Audit tool**: Homebrew formula `frodehus/elevate/elevate-audit`, or a single binary from the - release, see [docs/audit.md](docs/audit.md#1-install). +- **Windows 11**: `winget install Reothor.Elevate`, or the per-user MSI from the release; either + installs the app and the `elevate` CLI, see [windows/README.md](windows/README.md#install). +- **CLI on its own** (Linux, Intel Macs, servers): `winget install Reothor.Elevate.CLI` on + Windows, or a single binary from the release, see [cli/README.md](cli/README.md#install). +- **Audit tool**: `winget install Reothor.Elevate.Audit` on Windows, the Homebrew formula + `frodehus/elevate/elevate-audit`, or a single binary from the release, see + [docs/audit.md](docs/audit.md#1-install). The app and the CLI sign in with an Entra app registration — your own, a company one, or the project's optional [shared Elevate app](docs/shared-app-registration.md), which has no SLA; the Microsoft @@ -121,12 +122,6 @@ build and test commands, and the conventions this repository keeps. Bugs and fea the [issue tracker](https://github.com/FrodeHus/elevate/issues); what changed in each release is in [CHANGELOG.md](CHANGELOG.md). -## Roadmap - -- **Windows: winget** — the first `Reothor.Elevate`, `Reothor.Elevate.CLI` and - `Reothor.Elevate.Audit` submissions are in `microsoft/winget-pkgs` review; every release - after that opens its update pull requests automatically. - ## License MIT, see [LICENSE](LICENSE). diff --git a/cli/README.md b/cli/README.md index ff9cb8cb..d87aeef7 100644 --- a/cli/README.md +++ b/cli/README.md @@ -42,9 +42,10 @@ brew install frodehus/elevate/elevate-cli Shell completions are installed with it. Upgrade with `brew upgrade frodehus/elevate/elevate-cli`. -**Windows, standalone.** `winget install Reothor.Elevate.CLI` (winget -moderation requires signed binaries, so the manifest is a release artifact until Azure Artifact -Signing is set up, like the app's). Until then, download `elevate-cli--win-x64.zip` (or +**Windows, standalone.** `winget install Reothor.Elevate.CLI`, and +`winget upgrade Reothor.Elevate.CLI` later. Each release opens its own pull request against +`microsoft/winget-pkgs`, so the published version can lag the GitHub release by a day or two; +to take a release the moment it lands, download `elevate-cli--win-x64.zip` (or `-win-arm64.zip`) from the [latest release](https://github.com/FrodeHus/elevate/releases/latest) and put `elevate.exe` on your PATH. Do not combine this with the MSI's copy: two `elevate` entries on the PATH means whichever comes first wins. diff --git a/docs/getting-started.md b/docs/getting-started.md index ab0aafb6..0b927256 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -22,10 +22,10 @@ Pick your platform: which also puts the `elevate` command on your PATH on Apple Silicon. Releases are signed and notarized, so the app opens without Gatekeeper prompts. After the first launch, its icon (a double chevron) sits in the menu bar. Click it to open the panel. -- **Windows 11.** Download the per-user MSI from the +- **Windows 11.** `winget install Reothor.Elevate`, or download the per-user MSI from the [latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it; the steps, including the .NET runtime it needs, are in [windows/README.md](../windows/README.md#install). - The MSI installs the app and the `elevate` command for the current user, no admin rights needed. + Either installs the app and the `elevate` command for the current user, no admin rights needed. The MSI is code-signed (publisher "Open Source Developer Frode Hus"). SmartScreen may still ask once while a new release builds reputation: check that the publisher name is shown, then choose **More info** and **Run anyway**. Elevate then lives in the notification area: diff --git a/windows/README.md b/windows/README.md index 7c43f30c..aa6a8826 100644 --- a/windows/README.md +++ b/windows/README.md @@ -9,10 +9,15 @@ flyout, windows, tray states and tokens; open the file in a browser, it follows ## Install -Download `Elevate--x64.msi` (or `-arm64.msi` for Arm PCs) from the -[latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it. The MSI -installs for the current user into `%LOCALAPPDATA%\Programs\Elevate` (no admin rights), adds a -Start Menu entry and can launch Elevate when it finishes. It also installs the `elevate` +```powershell +winget install Reothor.Elevate +``` + +Or download `Elevate--x64.msi` (or `-arm64.msi` for Arm PCs) from the +[latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it: both routes +install the same per-user MSI. It installs for the current user into +`%LOCALAPPDATA%\Programs\Elevate` (no admin rights), adds a Start Menu entry and can launch +Elevate when it finishes. It also installs the `elevate` command-line tool into a `cli` subfolder (`%LOCALAPPDATA%\Programs\Elevate\cli`) and adds that subfolder to your user PATH, so `elevate --version` works in a new terminal (an already-open terminal needs to be restarted). If you also installed the standalone CLI with winget @@ -30,10 +35,10 @@ for an independent check: (Get-FileHash .\Elevate--x64.msi).Hash ``` -Upgrade by running a newer MSI; uninstall from Settings > Apps, which removes the app, the CLI -and the PATH entry. Or install and upgrade with winget: `winget install Reothor.Elevate` (each -release is submitted to `microsoft/winget-pkgs` and published once Microsoft's checks pass, so -the newest version may lag the GitHub release by a day or two); see [Release](#release). +Upgrade with `winget upgrade Reothor.Elevate` or by running a newer MSI; uninstall from +Settings > Apps, which removes the app, the CLI and the PATH entry. Each release opens its own +pull request against `microsoft/winget-pkgs`, so the published version may lag the GitHub +release by a day or two; see [Release](#release). ## Use