From f81d9fa99804d1b5d68c121bb1d8ec7766ff3574 Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:01:39 +0900 Subject: [PATCH 1/8] feat(website): CLI v0.3.1 EN visual guide, signed Catalog trust and bilingual notes --- en/cli.html | 98 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 80 insertions(+), 18 deletions(-) diff --git a/en/cli.html b/en/cli.html index 3e9b9f8..7d589cf 100644 --- a/en/cli.html +++ b/en/cli.html @@ -3,38 +3,100 @@ - - pgextwin — Windows CLI v0.2.2 + + pgextwin — Windows CLI v0.3.1 +
-

pgextwin CLI

Windows CLI v0.2.2

Read-only pgextwin.exe for Windows x64. Discover 14 extension packages from a local Catalog snapshot. This preview is not an installer or a verified extension-package signature engine.

+

pgextwin CLI

Windows CLI v0.3.1

+

A safer one-line download, now 83.83% smaller.

Download current Catalog-registered PostgreSQL extension ZIPs for Windows x64. Signed Catalog selection, strict original ZIP SHA256, and an explicit frozen-snapshot mode. This read-only CLI does not install extensions.

+
-
-

Download and verify

-

CLI v0.2.2 on GitHub Releases

-

Download pgextwin.exe and SHA256SUMS.txt from the release; verify the SHA256 locally and the cryptographically signed GitHub build provenance.

+
+
+

Windows x64 · self-contained · prerelease

+

Get the Windows executable

+
+ Download pgextwin.exe (12.83 MB) + GitHub Release v0.3.1 + SHA256SUMS.txt +
+

Published EXE SHA256: baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580

+

Compare against the published SHA256SUMS.txt and validate the CLI build provenance:

Get-FileHash .\pgextwin.exe -Algorithm SHA256
-gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest 594df3d703d983d5978b640a03c64d498765035a
-

SHA256 (pgextwin.exe): 3567e34cf9f7347cfab7a1292f58965b7bd15e2d8a2bb5b1f0479685633862a0

+gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest a7a1d93d38d7338d80404c402eb5faaaa96b272e
-
-

Download all 70 ZIPs with one command

- 
.\pgextwin.exe download-all --pg all
-

Downloads 14 original extension ZIPs for each PostgreSQL major PG14–18 into a new pgextwin-pg14-18 folder under the current directory. Use --pg 18 for 14 ZIPs only.

-

The CLI embeds an independently source-pinned SHA256 of a historical candidate P1 policy. It fetches and hashes this policy and each Catalog original at immutable GitHub commits, without asking for a file or SHA256 input. Public original ZIP bytes are downloaded from the pinned GitHub Release browser URL with strict SHA256 checks, avoiding anonymous REST rate limits; original numeric IDs are policy-pinned, not live REST verified. This is a frozen October 2026 snapshot, not a latest-version update feed.

-

Incomplete batches are discarded; existing output is never overwritten. Result: INTEGRITY_ONLY, not formal historical P1 acceptance of all 70 signatures, a signed combined ZIP, an installer, or verified extension Sigstore provenance.

+
+

One-line usage

Default: newest release approved and registered in the Catalog; no GitHub REST API credentials required. ZIPs are written in a new folder under the working directory.

+
+
Latest Catalog · 70 ZIPs, PG14–18
.\pgextwin.exe download-all --pg all
+
Latest Catalog · 14 ZIPs, PG18 only
.\pgextwin.exe download-all --pg 18
+
Fixed historical snapshot · 70 ZIPs
.\pgextwin.exe download-all --pg all --fixed
+
-

Usage

Run the CLI with a locally extracted Catalog repository snapshot (including index.json and extensions/). Catalog results explicitly remain UNVERIFIED.

+
+

How it works / 動作のしくみ

+

How it works

The two download paths converge on the same original-ZIP integrity checks and atomic output. The displayed steps describe the CLI, not a Windows installer.

+
+
1 · Choose a source +
+
LATEST

Latest (default)

Fetch the published Catalog selection feed and its Sigstore bundle over HTTPS, and verify the signer, source, commit and immutable Catalog records.

+
FIXED

Fixed (--fixed)

Use the immutable historical Catalog/policy snapshot pinned by the CLI, with its independently pinned SHA256.

+
+
+
    +

  1. 2 · Select packages

    Choose the Catalog-registered Release tag and original ZIP for each requested PostgreSQL major. Never infer the upstream's latest tag.

    2. +

  2. 3 · Download & check

    Fetch original GitHub Release ZIP bytes over bounded HTTPS; verify each SHA256 and reject mismatches, unsafe redirects and partial batches.

    3. +

  3. 4 · Save & report

    Commit the verified set to a new output directory and write DOWNLOAD-INFO.json. Existing output is not overwritten.

    DOWNLOAD-INFO.json
    4. +
+
+
+
+

What is (and is not) verified

+
+
SIGSTORE VERIFIED

CLI executable

GitHub Actions Sigstore-attested build; SHA256 of public EXE independently checked.

+
SIGSTORE VERIFIED

Catalog feed (latest mode)

Independent Sigstore verification of the feed and immutable Catalog byte hashes.

+
INTEGRITY_ONLY

Extension ZIPs

SHA256 integrity against authenticated/pinned metadata only: INTEGRITY_ONLY. Individual extension signatures/provenance and install authorization are not established.

+
+

The CLI is download-only; it does not install ZIPs, modify services, create a signed combined bundle, or make original extension publication decisions.

+
+
+

v0.3.1 size improvement

+ +

−83.83% · Full .NET 10 trimming + single-file compression; original Windows x64 EXE sizes measured from published Releases.

+
+
+

Other commands

Local Catalog browsing is separate from authenticated latest downloads. Local listing/search results remain UNVERIFIED.

.\pgextwin.exe --version
 .\pgextwin.exe list --catalog-dir C:\path\to\catalog --pg 18
 .\pgextwin.exe search cron --catalog-dir C:\path\to\catalog --format json
+

UNVERIFIED · INTEGRITY_ONLY

+
+
+

v0.3.1

Release notes · English → 日本語

+
+

English

+

CLI v0.3.1 — smaller executable, same safety checks. The self-contained Windows x64 executable was reduced from 79,338,604 to 12,827,362 bytes (83.83%) using full trimming and single-file compression. JSON responses are generated with trim-compatible System.Text.Json metadata rather than suppressed IL2026 warnings.

+

By default, download-all --pg all authenticates the publicly signed Catalog selection feed and downloads the current Catalog-registered set of 14 extensions × PG14–18 (70 original ZIP files). Use --pg 18 to select one major or --fixed to use the historical immutable snapshot. Each downloaded ZIP is rehashed, and a failed batch is removed without overwriting existing downloads.

+

Security boundary: Sigstore verification authenticates the Catalog feed and independently attested CLI executable. Extension ZIP bytes are checked against Catalog-pinned SHA256 values (INTEGRITY_ONLY); their own Sigstore signatures, provenance and installation/publication authorizations are not verified or granted. CLI v0.3.1 is a published prerelease, not a Windows Authenticode-signed installer.

+

Independent public EXE and 70/70 ZIP Windows verification · Full GitHub Release

+
+

日本語

+

CLI v0.3.1 — 安全性を維持しながら軽量化。 Windows x64用の自己完結型EXEを、79,338,604バイトから12,827,362バイトへ83.83%削減しました。完全トリミングと単一ファイル圧縮を使用し、JSON出力はトリミング対応のSystem.Text.Jsonソース生成方式に変更。IL2026警告を無視・抑制することなく対応しました。

+

標準の download-all --pg all は、公開されたSigstore署名付きCatalog選択情報を検証し、現在Catalogに登録されている14拡張×PG14～18の元ZIPを70件取得します。--pg 18 で1バージョンだけ、--fixed で過去の不変スナップショットに切替可能です。ZIPごとのSHA256を再計算し、途中失敗時には一時出力を破棄して既存のダウンロードを上書きしません。

+

安全性の区別： Sigstoreによる真正性検証の対象はCatalogフィードとCLI本体です。拡張ZIPはCatalogのSHA256とのバイト整合性のみ（INTEGRITY_ONLY）です。個々の拡張ZIPのSigstore署名・来歴・インストール／配布認可が成立したことにはなりません。CLI v0.3.1は公開済みのプレリリースであり、Windows Authenticode署名付きインストーラーではありません。

+

公開EXEとZIP 70/70の独立Windows検証 · GitHub Release全文

+
-

Scope and safety

list/search and JSON output are supported. The frozen candidate policy hash is embedded for one-line downloads; each original ZIP is INTEGRITY_ONLY only. Genuine extension Sigstore verify, installation, automatic service changes and offline bundle generation are not provided. The CLI binary has Sigstore build provenance, not a Windows Authenticode signature.

- + + From a717319f4ed0aae19bec7025dc1e2f794d93a5cd Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:01:43 +0900 Subject: [PATCH 2/8] feat(website): CLI v0.3.1 JA visual guide, signed Catalog trust and bilingual notes --- ja/cli.html | 98 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 80 insertions(+), 18 deletions(-) diff --git a/ja/cli.html b/ja/cli.html index c00eed6..86e5d17 100644 --- a/ja/cli.html +++ b/ja/cli.html @@ -3,38 +3,100 @@ - - pgextwin — Windows CLI v0.2.2 + + pgextwin — Windows CLI v0.3.1 +
-

pgextwin CLI

Windows CLI v0.2.2

Windows x64用の読み取り専用pgextwin.exeです。ローカルのCatalog情報から14拡張を検索できます。拡張機能のインストーラーや拡張バイナリの真正署名検証器ではありません。

+

pgextwin CLI

Windows CLI v0.3.1

+

1行で最新版を取得。EXEは83.83%軽量化。

Windows x64向けPostgreSQL拡張ZIPを、Catalogに登録された最新版から安全に一括取得。署名付きCatalogの認証・元ZIPのSHA256再検証・過去の固定版への切替に対応します。インストーラーではありません。

+
-
-

ダウンロードと検証

-

CLI v0.2.2 GitHub Release

-

Releaseからpgextwin.exeとSHA256SUMS.txtを入手し、ファイルのSHA256とGitHubの署名付きビルド来歴を照合してください。

+
+
+

Windows x64 · self-contained · prerelease

+

Windows用EXEを入手

+
+ pgextwin.exeをダウンロード（12.83 MB） + GitHub Release v0.3.1 + SHA256SUMS.txt +
+

公開EXEのSHA256: baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580

+

公開SHA256SUMS.txtと一致することを確認し、CLI本体のビルド来歴も検証してください。

Get-FileHash .\pgextwin.exe -Algorithm SHA256
-gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest 594df3d703d983d5978b640a03c64d498765035a
-

SHA256 (pgextwin.exe): 3567e34cf9f7347cfab7a1292f58965b7bd15e2d8a2bb5b1f0479685633862a0

+gh attestation verify .\pgextwin.exe --repo pgextwin/catalog --signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml --source-ref refs/heads/main --source-digest a7a1d93d38d7338d80404c402eb5faaaa96b272e
-
-

1行で全70 ZIPをダウンロード

- 
.\pgextwin.exe download-all --pg all
-

PG14〜18の14拡張、合計70個の公開済み元ZIPを、実行フォルダーに新しいpgextwin-pg14-18フォルダーを作って保存します。PG18だけなら --pg 18 と指定します。

-

CLI内に固定した過去のP1候補ポリシーのSHA256を使用し、GitHub上の変更されないコミットからポリシーとCatalogの原本を取得・照合します。別途ファイルやSHA256を入力する必要はありません。ZIP本体は固定されたGitHub Release公開URLから取得しSHA256で照合するため、匿名REST APIの回数制限を回避します。数値IDはポリシー固定値であり、その都度RESTで検証するわけではありません。これは固定された2026年10月時点のカタログで、最新版の自動追従ではありません。

-

途中失敗時は一時ファイルを破棄し、既存ファイルは上書きしません。個別ZIPはINTEGRITY_ONLYで、正式な全70行のP1署名受入、統合署名ZIPの作成、インストールや拡張ZIPの真正署名検証を意味しません。

+
+

1行で使う

標準動作はCatalog承認・登録済みの最新Releaseです。GitHub REST APIの認証情報は不要。元ZIPは実行フォルダー内の新しいフォルダーに保存されます。

+
+
最新版Catalog · PG14～18の70 ZIP
.\pgextwin.exe download-all --pg all
+
最新版Catalog · PG18だけの14 ZIP
.\pgextwin.exe download-all --pg 18
+
過去の固定版 · PG14～18の70 ZIP
.\pgextwin.exe download-all --pg all --fixed
+
-

使い方

index.jsonとextensions/を含むCatalogリポジトリのローカル展開先を指定して実行します。Catalogの一覧情報は明示的にUNVERIFIEDです。

+
+

How it works / 動作のしくみ

+

動作のしくみ

最新版・固定版の2経路が、共通のZIPバイト整合性検証と安全な保存処理に合流します。インストール処理は含みません。

+
+
1 · 取得元を選択 +
+
LATEST

最新版（標準）

公開CatalogフィードとSigstore署名をHTTPSで取得。発行元、署名、コミット、固定Catalog原本を確認します。

+
FIXED

固定版（--fixed）

CLI内にSHA256で固定された過去の不変Catalog・ポリシースナップショットを使用します。

+
+
+
    +

  1. 2 · ZIPを選択

    Catalog登録済みのReleaseタグから、指定したPostgreSQLバージョン用の元ZIPを選択。上流の最新タグを独断で採用しません。

    2. +

  2. 3 · 取得・照合

    GitHub Releaseの元ZIPを制限付きHTTPS経由で取得し、各ファイルのSHA256を検証。危険なリダイレクトや一部失敗を拒否します。

    3. +

  3. 4 · 保存・証跡

    全件成功後に新しいフォルダーとして確定し、DOWNLOAD-INFO.jsonを出力。既存の成果物は上書きしません。

    DOWNLOAD-INFO.json
    4. +
+
+
+
+

検証できること・できないこと

+
+
SIGSTORE VERIFIED

CLI本体

GitHub ActionsのSigstore来歴を検証。公開EXEのSHA256も独立照合済みです。

+
SIGSTORE VERIFIED

Catalogフィード（最新版）

Sigstore署名と不変Catalog原本のSHA256を独立検証します。

+
INTEGRITY_ONLY

拡張機能の元ZIP

認証済み・固定済み情報とのSHA256整合性のみ（INTEGRITY_ONLY）。個別ZIPの真正署名・来歴やインストール認可は成立していません。

+
+

このCLIはダウンロード専用です。ZIPのインストール、サービス変更、統合署名ZIP作成、個別拡張の公開認可は実行しません。

+
+
+

v0.3.1の軽量化

+ +

−83.83% · .NET 10の完全トリミング＋単一ファイル圧縮。公開済みWindows x64 EXEの実バイト比較です。

+
+
+

そのほかのコマンド

ローカルCatalogの一覧・検索は認証済みの最新版取得とは別です。ローカル一覧の信頼状態はUNVERIFIEDです。

.\pgextwin.exe --version
 .\pgextwin.exe list --catalog-dir C:\path\to\catalog --pg 18
 .\pgextwin.exe search cron --catalog-dir C:\path\to\catalog --format json
+

UNVERIFIED · INTEGRITY_ONLY

+
+
+

v0.3.1

リリースノート · English → 日本語

+
+

English

+

CLI v0.3.1 — smaller executable, same safety checks. The self-contained Windows x64 executable was reduced from 79,338,604 to 12,827,362 bytes (83.83%) using full trimming and single-file compression. JSON responses are generated with trim-compatible System.Text.Json metadata rather than suppressed IL2026 warnings.

+

By default, download-all --pg all authenticates the publicly signed Catalog selection feed and downloads the current Catalog-registered set of 14 extensions × PG14–18 (70 original ZIP files). Use --pg 18 to select one major or --fixed to use the historical immutable snapshot. Each downloaded ZIP is rehashed, and a failed batch is removed without overwriting existing downloads.

+

Security boundary: Sigstore verification authenticates the Catalog feed and independently attested CLI executable. Extension ZIP bytes are checked against Catalog-pinned SHA256 values (INTEGRITY_ONLY); their own Sigstore signatures, provenance and installation/publication authorizations are not verified or granted. CLI v0.3.1 is a published prerelease, not a Windows Authenticode-signed installer.

+

Independent public EXE and 70/70 ZIP Windows verification · Full GitHub Release

+
+

日本語

+

CLI v0.3.1 — 安全性を維持しながら軽量化。 Windows x64用の自己完結型EXEを、79,338,604バイトから12,827,362バイトへ83.83%削減しました。完全トリミングと単一ファイル圧縮を使用し、JSON出力はトリミング対応のSystem.Text.Jsonソース生成方式に変更。IL2026警告を無視・抑制することなく対応しました。

+

標準の download-all --pg all は、公開されたSigstore署名付きCatalog選択情報を検証し、現在Catalogに登録されている14拡張×PG14～18の元ZIPを70件取得します。--pg 18 で1バージョンだけ、--fixed で過去の不変スナップショットに切替可能です。ZIPごとのSHA256を再計算し、途中失敗時には一時出力を破棄して既存のダウンロードを上書きしません。

+

安全性の区別： Sigstoreによる真正性検証の対象はCatalogフィードとCLI本体です。拡張ZIPはCatalogのSHA256とのバイト整合性のみ（INTEGRITY_ONLY）です。個々の拡張ZIPのSigstore署名・来歴・インストール／配布認可が成立したことにはなりません。CLI v0.3.1は公開済みのプレリリースであり、Windows Authenticode署名付きインストーラーではありません。

+

公開EXEとZIP 70/70の独立Windows検証 · GitHub Release全文

+
-

機能範囲と安全性

一覧・検索・JSON出力に対応します。一括ダウンロード用の過去の候補ポリシー固定値はCLIに内蔵されていますが、成功してもINTEGRITY_ONLYです。拡張の真正Sigstore検証、インストール、サービス自動変更、オフライン一括ZIP作成は未提供です。CLI本体はSigstore来歴に対応しますが、Windows Authenticode署名は付いていません。

- + + From 9d6920978361fa43d63b347b734dc902bfb1d36f Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:02:14 +0900 Subject: [PATCH 3/8] style(website): responsive, accessible CLI flow, trust cards and 83.83% comparison --- styles.css | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/styles.css b/styles.css index c4d5bc6..ffe158b 100644 --- a/styles.css +++ b/styles.css @@ -234,3 +234,70 @@ main{padding:3.7rem 0 6rem}main>section+section{margin-top:5rem} @media(max-width:860px){.extension-summary,.landscape-summary{grid-template-columns:minmax(0,1fr) auto;gap:.55rem}.extension-identity{grid-column:1/-1}.extension-summary-badges{grid-column:1}.summary-affordance{grid-column:2}.shell{width:min(calc(100% - 2.25rem),var(--max))}} @media(max-width:600px){.shell{width:min(calc(100% - 1.5rem),var(--max))}.site-header{padding:1rem 0 2.4rem}.site-header h1{font-size:clamp(1.85rem,8vw,2.6rem)}main{padding-top:2.25rem}main>section+section{margin-top:3.3rem}.section-heading button{width:auto}.filters{padding:1rem}.extension-summary,.landscape-summary{padding:1rem}.extension-details-body,.landscape-detail-body{padding:1.25rem 1rem 1.5rem}.binary-table th,.binary-table td{padding:.65rem;font-size:.85rem}.download-link--compact{width:auto}.language-nav{margin-bottom:1.5rem}} @media(prefers-reduced-motion:reduce){html{scroll-behavior:auto}} + + +/* CLI v0.3.1 feature explainer: accessible, dependency-free flowchart. */ +.cli-hero-description{max-width:80ch;color:#fff;margin-top:1rem;font-size:1.04rem} +.cli-page{max-width:100%} +.cli-page>section{min-width:0} +.cli-download{border:1px solid var(--border);border-radius:1rem;padding:clamp(1rem,3vw,2rem);background:var(--surface);box-shadow:0 3px 12px #122e4b17} +.cli-download-actions{display:flex;flex-wrap:wrap;align-items:center;gap:.7rem 1.4rem} +.cli-sha{overflow-wrap:anywhere;word-break:break-word} +.cli-sha code{font-size:.87rem} +.cli-page pre{max-width:100%;overflow-x:auto;border:1px solid var(--border);background:var(--surface-2);border-radius:.65rem;padding:1rem 1.25rem;white-space:pre;line-height:1.6} +.cli-page pre code{font-size:.9rem} +.cli-command-list{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,19rem),1fr));gap:1rem} +.cli-command-list>div{border:1px solid var(--border);border-radius:.8rem;background:var(--surface);padding:1rem;min-width:0} +.cli-command-list pre{margin-bottom:0} +.cli-flow{max-width:72rem;margin:1.5rem auto;display:grid;gap:1.55rem;text-align:center} +.cli-flow-start{display:grid;gap:.8rem} +.cli-paths{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;position:relative} +.cli-paths::after{content:"↓";position:absolute;bottom:-1.85rem;left:50%;transform:translateX(-50%);font-size:1.5rem;font-weight:900;color:var(--accent)} +.cli-flow-node{min-width:0;border:2px solid var(--border);border-radius:1rem;background:var(--surface);padding:1.1rem 1.25rem;text-align:left;box-shadow:0 2px 8px #122e4b12} +.cli-flow-node h3{margin:.25rem 0 .45rem;font-size:1.13rem} +.cli-flow-node p{margin:0;overflow-wrap:anywhere} +.cli-flow-node code{overflow-wrap:anywhere} +.cli-flow-latest{border-color:#336791} +.cli-node-label{display:inline-block;border-radius:.3rem;background:var(--surface-2);color:var(--accent);padding:.12rem .55rem;font-size:.74rem;font-weight:850;letter-spacing:.08em} +.cli-flow-steps{padding:0;margin:0;list-style:none;display:grid;gap:1.55rem} +.cli-flow-steps li{position:relative} +.cli-flow-steps li:not(:last-child)::after{content:"↓";position:absolute;bottom:-1.9rem;left:50%;font-size:1.55rem;color:var(--accent);font-weight:900} +.cli-trust-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:1rem} +.cli-trust-grid article{border:1px solid var(--border);border-radius:.9rem;padding:1.3rem;background:var(--surface);min-width:0} +.cli-trust-grid h3{margin:.55rem 0} +.cli-trust-grid p{margin:0} +.cli-trust-status{display:inline-block;border-radius:.35rem;background:#dcefe2;color:#14522e;border:1px solid #7ea98e;font-size:.74rem;font-weight:850;padding:.18rem .5rem;overflow-wrap:anywhere} +.cli-trust-status--limited{background:#fff0d0;color:#68400d;border-color:#d5ad6d} +.cli-caution{border-left:4px solid #b8833e;background:var(--surface-2);padding:1rem 1.2rem} +.cli-size-chart{max-width:56rem;display:grid;gap:1rem} +.cli-size-row{display:grid;grid-template-columns:6rem minmax(0,1fr) 7rem;align-items:center;gap:1rem} +.cli-size-track{height:1.55rem;border-radius:999px;background:var(--surface-2);overflow:hidden} +.cli-size-bar{display:block;height:100%;border-radius:999px;background:#336791} +.cli-size-bar--old{width:100%} +.cli-size-bar--new{width:16.17%;background:#2c8a59} +.cli-size-row strong{text-align:right;white-space:nowrap} +.cli-release-notes{display:grid;gap:1.25rem} +.cli-note-block{background:var(--surface);border:1px solid var(--border);border-radius:.9rem;padding:clamp(1rem,2.5vw,1.7rem)} +.cli-note-block h3{margin-top:0} +.cli-note-block p{max-width:90ch} +.cli-home-teaser{border:1px solid var(--border);border-radius:.95rem;padding:clamp(1rem,2.5vw,1.75rem);background:var(--surface)} +.cli-home-teaser h2{margin:.4rem 0 .65rem} +.cli-home-teaser p{max-width:85ch} +.cli-teaser-metrics{display:flex;flex-wrap:wrap;gap:.55rem 1rem;align-items:baseline} +.cli-teaser-metrics strong{color:var(--accent);font-size:1.6rem} +.cli-teaser-actions{display:flex;flex-wrap:wrap;gap:.8rem 1.5rem;align-items:center} +.cli-teaser-actions a{font-weight:800} +@media(prefers-color-scheme:dark){ + .cli-flow-latest{border-color:#86bce0} + .cli-trust-status{background:#153e2e;color:#a9ebbe;border-color:#568969} + .cli-trust-status--limited{background:#51371a;color:#ffda9e;border-color:#987448} + .cli-size-bar--old{background:#85bce0} + .cli-size-bar--new{background:#86efac} +} +@media(max-width:700px){ + .cli-paths,.cli-trust-grid{grid-template-columns:1fr} + .cli-size-row{grid-template-columns:5.1rem minmax(0,1fr) 5.5rem;gap:.55rem;font-size:.85rem} + .cli-page pre{padding:.7rem} + .cli-page pre code{font-size:.78rem} + .cli-trust-grid article{padding:1rem} +} From 6553cb8b3710b532e15d0e407bb4c7b11e13d82f Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:02:31 +0900 Subject: [PATCH 4/8] feat(website): announce 12.83 MB v0.3.1 CLI and one-line signed Catalog on en homepage --- en/index.html | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/en/index.html b/en/index.html index 473af59..0d2f073 100644 --- a/en/index.html +++ b/en/index.html @@ -21,7 +21,7 @@

PostgreSQL Extensions for Windows

Find Windows x64 extension binaries by PostgreSQL version, download the canonical Release asset directly, and inspect runtime requirements, CI-tested capabilities, checksums, and supply-chain evidence.

@@ -31,6 +31,15 @@

PostgreSQL Extensions for Windows

+
+

Windows CLI · v0.3.1

+

Download Catalog-registered ZIPs with one command

+

14 extensions × PostgreSQL 14–18 = 70 original ZIPs. The CLI authenticates the Sigstore-signed Catalog feed, checks each ZIP SHA256, and preserves an explicit historical --fixed mode. Original ZIP signatures remain INTEGRITY_ONLY.

+ 
.\pgextwin.exe download-all --pg all
+
−83.83%79.34 MB → 12.83 MB (v0.3.0 → v0.3.1)
+
Download CLI v0.3.1Visual guide, safety and release notes →
+
+
From cf097e9c18bc46b433cebcee09ec153d27669268 Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:02:38 +0900 Subject: [PATCH 5/8] feat(website): announce 12.83 MB v0.3.1 CLI and one-line signed Catalog on ja homepage --- ja/index.html | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ja/index.html b/ja/index.html index 5de43f5..29da3ca 100644 --- a/ja/index.html +++ b/ja/index.html @@ -21,7 +21,7 @@

PostgreSQL拡張機能のWindowsバイナリ

PostgreSQLのバージョンからWindows x64向け拡張機能を検索し、GitHub Releaseの正規バイナリを直接ダウンロードできます。導入要件、CIで検証した機能、チェックサム、サプライチェーンの検証情報を確認できます。

@@ -31,6 +31,15 @@

PostgreSQL拡張機能のWindowsバイナリ

+
+

Windows CLI · v0.3.1

+

Catalog登録済みのZIPを1行でまとめて取得

+

14拡張×PostgreSQL 14～18、計70個の元ZIPに対応。CLIはSigstore署名付きCatalogフィードを認証し、各ZIPのSHA256を照合します。過去の固定版は--fixedで指定できます。個々のZIPの真正署名は検証せず、INTEGRITY_ONLYです。

+ 
.\pgextwin.exe download-all --pg all
+
−83.83%79.34 MB → 12.83 MB（v0.3.0 → v0.3.1）
+
CLI v0.3.1をダウンロード図解・安全性・リリースノートを見る →
+
+
From 8496eab6b2a6e06e9247948ecaa9326d34807762 Mon Sep 17 00:00:00 2001 From: ShutenOishi Date: Mon, 19 Oct 2026 22:02:54 +0900 Subject: [PATCH 6/8] test(website): verify bilingual v0.3.1 visual flow, real SHA, trust boundaries and EN-before-JA notes --- tests/cli-preview.test.js | 45 ++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 17 deletions(-) diff --git a/tests/cli-preview.test.js b/tests/cli-preview.test.js index 2752707..757ddd2 100644 --- a/tests/cli-preview.test.js +++ b/tests/cli-preview.test.js @@ -1,27 +1,38 @@ import test from 'node:test'; import assert from 'node:assert/strict'; -import { readFileSync } from 'node:fs'; +import {readFileSync} from 'node:fs'; -const sha = '3567e34cf9f7347cfab7a1292f58965b7bd15e2d8a2bb5b1f0479685633862a0'; -const source = '594df3d703d983d5978b640a03c64d498765035a'; +const exeSha = 'baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580'; +const originalSource = 'a7a1d93d38d7338d80404c402eb5faaaa96b272e'; +const directExe = 'https://github.com/pgextwin/catalog/releases/download/cli-v0.3.1/pgextwin.exe'; -for (const locale of ['en', 'ja']) { - test('CLI preview ' + locale + ' guide and independent provenance', () => { - const page = readFileSync(new URL('../' + locale + '/cli.html', import.meta.url), 'utf8'); - const home = readFileSync(new URL('../' + locale + '/index.html', import.meta.url), 'utf8'); - assert.match(page, new RegExp(' { + const page = readFileSync(new URL('../' + lang + '/cli.html', import.meta.url), 'utf8'); + const home = readFileSync(new URL('../' + lang + '/index.html', import.meta.url), 'utf8'); + assert.ok(page.includes('')); + assert.ok(page.includes(directExe)); + assert.ok(home.includes(directExe) && home.includes('href="./cli.html"')); + assert.ok(page.includes(exeSha) && page.includes(originalSource)); assert.ok(page.includes('--signer-workflow pgextwin/catalog/.github/workflows/cli-candidate.yml')); assert.ok(page.includes('--source-ref refs/heads/main')); + assert.ok(page.includes('cli-flow-steps') && page.includes('cli-paths')); + assert.ok(page.includes('SIGSTORE VERIFIED') && page.includes('INTEGRITY_ONLY')); assert.ok(page.includes('UNVERIFIED')); - assert.ok(page.includes('INTEGRITY_ONLY')); - assert.ok(page.includes('download-all')); - assert.ok(page.includes('\\pgextwin.exe download-all --pg all')); - assert.ok(page.includes('INTEGRITY_ONLY')); - assert.ok(page.includes('--pg all')); + assert.ok(page.includes('DOWNLOAD-INFO.json')); + assert.ok(page.includes('download-all --pg all --fixed')); + assert.ok(page.includes('download-all --pg all')); + assert.ok(page.includes('download-all --pg 18')); + assert.ok(page.includes('83.83%')); + assert.ok(page.includes('12,827,362')); + assert.ok(home.includes('83.83%') && home.includes('CLI v0.3.1')); + assert.ok(!page.includes('cli-v0.2.2')); + assert.ok(!home.includes('CLI v0.2.2')); assert.ok(!page.includes('install --apply')); - assert.ok(home.includes('href="./cli.html"')); + assert.ok(!page.includes('signatureVerified=true')); + assert.ok(page.indexOf('
Date: Mon, 19 Oct 2026 22:03:07 +0900 Subject: [PATCH 7/8] test(website): remove redundant assertion from CLI v0.3.1 test --- tests/cli-preview.test.js | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/cli-preview.test.js b/tests/cli-preview.test.js index 757ddd2..44f5521 100644 --- a/tests/cli-preview.test.js +++ b/tests/cli-preview.test.js @@ -33,6 +33,5 @@ for (const lang of ['en','ja']) { assert.ok(page.indexOf('
Date: Mon, 19 Oct 2026 22:03:21 +0900 Subject: [PATCH 8/8] test(website): verify actual published EN/JA CLI diagram, signed release and order postmerge --- scripts/verify-published-pages.mjs | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/scripts/verify-published-pages.mjs b/scripts/verify-published-pages.mjs index 0bd9a71..31d29e4 100644 --- a/scripts/verify-published-pages.mjs +++ b/scripts/verify-published-pages.mjs @@ -26,6 +26,32 @@ async function verify() { assert.ok(page.includes('src="../locale.js"')); assert.ok(page.includes('hreflang="x-default"')); } + // CLI v0.3.1 public website launch smoke; verify BOTH languages and + // English-then-Japanese release notes, never stale v0.2.2 labels. + const [cliEnglish,cliJapanese] = await Promise.all([ + get(root+"en/cli.html").then(x=>x.text()), + get(root+"ja/cli.html").then(x=>x.text()) + ]); + const expectedSha="baee38b3aafdd1bbb7f61857747358dbd40ab056d989aa0f753c93b2025a7580"; + for (const [page,home,locale] of [ + [cliEnglish,html,"en"],[cliJapanese,japanese,"ja"] + ]) { + assert.ok(page.includes('') && + page.includes('cli-v0.3.1') && + page.includes(expectedSha) && + page.includes('cli-flow-steps') && + page.includes('SIGSTORE VERIFIED') && + page.includes('INTEGRITY_ONLY') && + page.includes('download-all --pg all --fixed') && + page.includes('83.83%'), + "Published CLI v0.3.1 incomplete ("+locale+")"); + assert.ok(page.indexOf('