Release 2.1.2: signed package integrity and collection/report fixes

.gitattributes

@@ -1,2 +1,17 @@
 # Language statistics: the guides are documentation, not code.
 package/docs/** linguist-documentation
+package/** whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+
+# Authenticode and the manifest authenticate exact raw bytes, on every checkout.
+package/Invoke-PurviewDlpReport.ps1 -text
+package/PurviewDlpReport.psm1 -text
+package/PurviewDlpReport.psd1 -text
+package/Test-PackageIntegrity.ps1 -text
+package/PackageIntegrity.psd1 -text
+package/src/PurviewDlpReport.Engine.cs -text
+package/templates/Report.template.html -text
+package/docs/PurviewDlpReport-Guide.html -text
+package/docs/PurviewDlpReport-UserGuide.html -text
+package/README.md -text
+package/THIRD-PARTY-NOTICES.md -text
+package/lib/sqlite/**/*.dll -text

.github/ci.json

@@ -3,7 +3,8 @@
   "testMode": "pester",
   "testEntry": null,
   "tests": [
-    "tests/PurviewDlpReport.Tests.ps1"
+    "tests/PurviewDlpReport.Tests.ps1",
+    "tests/PackageIntegrity.Tests.ps1"
   ],
   "packageBuilder": "tools/New-DlpPackage.ps1",
   "packageEntry": "Invoke-PurviewDlpReport.ps1"

CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes are listed here. Versions follow MAJOR.MINOR.PATCH (see the guide, Annex E).
 Author: Nicolas Fabert.
 
+## [2.1.2] — 2026-10-13
+
+### Added
+- SHA256 owner Authenticode signatures with RFC3161 timestamps on the launcher, module, module metadata, integrity verifier and stable-file manifest. Fail-closed verification authenticates sixteen mandatory raw-file hashes before runtime loading, warm initialization and report template use. Original SQLite vendor bytes and authorship are preserved.
+- Exact coverage/completeness and provisional durations in `report-metadata.json`, including CSV-only reports; compatible business CSV columns are unchanged.
+- Optional company branding and explicit opt-in tenant/environment display (off by default), independent of the fixed Nicolas Fabert author.
+
+### Fixed
+- Bind databases to the tenant verified by an authenticated collection; reject mismatched tenants and retain explicit unverified-legacy-history warnings.
+- Distinguish exact second-level source-boundary observations from unexpected timestamps, retaining records and reporting bounded diagnostics without duplicate insertion.
+- Decide completeness from exact gaps and failed refreshes, not rounded percentages; explain Status as a read-only queried-time snapshot and recent data as provisional.
+- Sort HTML chronology using UTC and display offsets/UTC details across daylight-saving changes.
+- Validate source retention (1–30 days), settling and storage/backfill consistency; reject configurable author overrides.
+
+### Changed
+- Compile authenticated C# in memory once per process rather than trusting unsigned `bin` engine caches. Startup recompilation and recurring checks add overhead; this release does not claim broad load or production validation.
+- Preserve existing runtime paths, README and both HTML guides in packages. The same trusted manifest works for source and distribution; only explicitly named, non-runtime repository documents are unhashed. Configuration stays editable and is sanitized by the existing packager, which now verifies authenticity before and after copying.
+- Keep the existing required PowerShell 7 validation, advisory analysis/CodeQL and pinned Actions. PowerShell 7.4+ is the business requirement; Windows PowerShell 5.1 is signature inspection only.
+- Preserve the canonical personal-project disclaimer in README, runtime README and launcher help.
+
 ## [2.1.1] — 2026-09-30
 
 First public release.

README.md

@@ -85,6 +85,14 @@ notepad .\config\PurviewDlpReport.config.psd1      # TenantId, PolicyId, RuleId,
 
 Activity Explorer keeps 30 days of data: schedule the daily collection. The `package` folder of this repository holds exactly the files needed to run Purview DLP Report, with both guides. The zip of each [release](https://github.com/Nico77600/PurviewDlpReport/releases) contains the same run-time files with the HTML guides; `.\tools\New-DlpPackage.ps1` builds that zip content from the repository.
 
+## Signed packages and integrity (2.1.2)
+
+The launcher, module, module metadata, integrity verifier and integrity manifest carry Nicolas Fabert's SHA256 Authenticode signatures with RFC3161 timestamps. The trusted owner certificate thumbprint is `0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6`. Automatic checks block loading on a missing manifest, invalid signature, absent timestamp, changed protected bytes, extra stable code or a protected reparse point. See the [developer guide](package/docs/PurviewDlpReport-Guide.md#signed-package-integrity) for the exact boundary, trust requirements and source-change procedure.
+
+Only `config\PurviewDlpReport.config.psd1` is editable. Stable runtime files, the report template, bundled DLLs, README and both distributed HTML guides are authenticated. SQLite binaries keep their original vendor bytes and authorship. Verified C# compiles in memory once per process; startup and warm integrity checks have overhead, and old `bin` caches are never loaded. Windows PowerShell 5.1 can inspect signatures but cannot run the tool; business runtime requires PowerShell 7.4 or later.
+
+Coverage is queried time, not an event-delivery percentage. Exact gaps and failed refreshes remain incomplete even when a rounded percentage says 100%; `report-metadata.json` records that status. HTML sorting uses UTC across daylight-saving changes. Company branding is separate from the fixed author; tenant/environment display is off by default and requires administrator opt-in. A database is bound to its first authenticated tenant, with explicit warnings for unverified legacy history.
+
 ## Documentation
 
 | Guide | Content |