From 86a3a1efdd8217a4903b7fe35cc91c8c4e620905 Mon Sep 17 00:00:00 2001 From: eric8810 Date: Wed, 5 Aug 2026 16:14:17 +0800 Subject: [PATCH] =?UTF-8?q?docs(release):=20=E5=90=8C=E5=8D=B0=E5=BE=85?= =?UTF-8?q?=E5=8F=91=EF=BC=8C=E5=8F=8C=E5=8D=B7=E8=AE=B0=E7=A8=8B=20=C2=B7?= =?UTF-8?q?=20prepare=20npm=200.5.7=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +- README.md | 6 +- README.zh-CN.md | 6 +- docs/implementation-status.md | 24 ++++- docs/releases/npm-0.5.7.en.md | 172 ++++++++++++++++++++++++++++++++++ docs/releases/npm-0.5.7.md | 157 +++++++++++++++++++++++++++++++ packages/light-ocr/README.md | 1 + 7 files changed, 366 insertions(+), 7 deletions(-) create mode 100644 docs/releases/npm-0.5.7.en.md create mode 100644 docs/releases/npm-0.5.7.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 4957e7b..a64309e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ This file records user-visible changes to `light-ocr`. Published artifact detail ## [Unreleased] +## [0.5.7] - 2026-08-05 + ### Fixed - On macOS only, accepted a re-signed native payload as an equivalent @@ -19,6 +21,9 @@ This file records user-visible changes to `light-ocr`. Published artifact detail acceptance is deliberately macOS-only and documented because ad-hoc signatures are reproducible by anyone. +Release record: [English](docs/releases/npm-0.5.7.en.md) / +[中文](docs/releases/npm-0.5.7.md). + ## [0.5.6] - 2026-07-31 ### Changed @@ -37,7 +42,7 @@ This file records user-visible changes to `light-ocr`. Published artifact detail page bytes, and end-to-end Chinese OCR without install-time or runtime downloads. -Release preparation: [English](docs/releases/npm-0.5.6.en.md) / +Release record: [English](docs/releases/npm-0.5.6.en.md) / [中文](docs/releases/npm-0.5.6.md). ## [0.5.5] - 2026-07-27 diff --git a/README.md b/README.md index b6efa9e..cfd8cad 100644 --- a/README.md +++ b/README.md @@ -231,8 +231,10 @@ selection guidance, and exit code reference: - [Build and release](docs/build-and-release.md) - [Roadmap](docs/roadmap.md) - [Changelog](CHANGELOG.md) -- [npm 0.5.6 release preparation — English](docs/releases/npm-0.5.6.en.md) -- [npm 0.5.6 发布准备记录 — 中文](docs/releases/npm-0.5.6.md) +- [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md) +- [npm 0.5.7 发布记录 — 中文](docs/releases/npm-0.5.7.md) +- [npm 0.5.6 release record — English](docs/releases/npm-0.5.6.en.md) +- [npm 0.5.6 发布记录 — 中文](docs/releases/npm-0.5.6.md) - [npm 0.3.0 release report](docs/releases/npm-0.3.0.md) ## Community and license diff --git a/README.zh-CN.md b/README.zh-CN.md index 84fea06..81c439b 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -223,8 +223,10 @@ AI Agent 使用。它提供场景驱动的工作流、命令选择建议和退 - [构建与发布](docs/build-and-release.md) - [路线图](docs/roadmap.md) - [更新日志](CHANGELOG.md) -- [npm 0.5.6 release preparation — English](docs/releases/npm-0.5.6.en.md) -- [npm 0.5.6 发布准备记录 — 中文](docs/releases/npm-0.5.6.md) +- [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md) +- [npm 0.5.7 发布记录 — 中文](docs/releases/npm-0.5.7.md) +- [npm 0.5.6 release record — English](docs/releases/npm-0.5.6.en.md) +- [npm 0.5.6 发布记录 — 中文](docs/releases/npm-0.5.6.md) - [npm 0.3.0 发布报告](docs/releases/npm-0.3.0.md) ## 社区与协议 diff --git a/docs/implementation-status.md b/docs/implementation-status.md index a7b1163..351ae42 100644 --- a/docs/implementation-status.md +++ b/docs/implementation-status.md @@ -1,7 +1,7 @@ # C++ Core 与 Node-API 实施状态 -更新时间：2026-07-31
-结论：npm `0.5.6` 已发布并晋升 `latest`。六个平台包内置校验锁定的官方 Noto Sans SC fallback 字体及 OFL 许可证，patched PDFium 初始化时只使用包内字体目录；用户安装与运行均无二次下载。最终 `main` 的 Core、sanitizer/fuzzer、oracle 和 WebGPU CI 已全绿，[发布 run 30599969242](https://github.com/arcships/light-ocr/actions/runs/30599969242) 完成六平台构建、离线安装、图片 OCR、非嵌入中文字体 PDF 端到端 smoke、registry 发布与回装验证，[晋升 run 30600575756](https://github.com/arcships/light-ocr/actions/runs/30600575756) 只将稳定 Small/runtime/native 闭包提升为默认安装。D116 记录修复契约，完整证据见 [npm 0.5.6 发布记录](releases/npm-0.5.6.md)（[English](releases/npm-0.5.6.en.md)）。 +更新时间：2026-08-05
+结论：npm `0.5.7` 已完成代码合并与发布前验证，尚未写入 registry。该补丁允许下游 macOS 打包器重新签名 `light_ocr_node.node` 与 ONNX Runtime dylib：descriptor 的 bytes/SHA-256 仍是首要门，仅当它因重签名变化时，才接受通过严格 `codesign` 验证且与宿主 TeamIdentifier 相同、或宿主与制品均为 ad-hoc 的 Mach-O。异签名、未签名篡改、非 Mach-O 与非 macOS 平台继续 fail closed。最终 `main` 的 [Core 30986015180](https://github.com/arcships/light-ocr/actions/runs/30986015180) 与 [Native WebGPU 30986015218](https://github.com/arcships/light-ocr/actions/runs/30986015218) 全绿，[六平台演练 30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237) 已完成构建、离线安装、图片/PDF OCR、签名策略与 manifest 审计。完整版本闭包见 [npm 0.5.7 发布记录](releases/npm-0.5.7.md)（[English](releases/npm-0.5.7.en.md)）。 状态含义： @@ -25,6 +25,26 @@ - workspace PR 运行 types、Node/server contract 和 Python package tests；只有 native/Core/model contract 路径进入完整构建。release 不重复 qualification、模型转换、Core test 或双重 npm pack。 - 本机新 Core 对三个真实 bundle 均识别 `HELLO 123`；Tiny/Small/Medium 初始化约 `0.9s / 1.5s / 6.4s`，单次 OCR 约 `58ms / 112ms / 457ms`（Apple M4 Max，仅为 smoke 快照，不作性能承诺）。 +## macOS 下游重签名兼容（0.5.7） + +状态：发布前验证完成 / registry 发布待执行 + +- runtime descriptor 的 bytes 与 SHA-256 精确匹配仍是正常加载路径；只有 + macOS 上已知的签名重写导致描述符不一致时才进入等价签名证明。 +- fallback 先检查 Mach-O magic，再执行 `codesign --verify --strict`，并要求 + 制品与宿主拥有相同 TeamIdentifier；只有双方均为 ad-hoc 时允许无 Team ID。 +- 异 Team、未签名篡改、非 Mach-O、畸形 descriptor 与 Linux/Windows + 仍保持 `package_load_failed`，native inventory 与 ABI contract 门不变。 +- PR CI 同时使用 GitHub runner 默认 Node 和复制后 ad-hoc 重签的 Node + 执行真实 `codesign` 集成测试；Developer ID signed host 的手工验证使用 + TeamIdentifier `3AA79YWT4C`，确认原始制品通过、未签名篡改拒绝、异签 + ad-hoc 制品拒绝。 +- 该兼容无需环境变量、postinstall、keychain 或额外依赖；ad-hoc 签名可由 + 任何人复现，因此其接受范围明确限制为同样 ad-hoc 的 macOS 宿主。 +- [六平台发布演练 30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237) + 的 14 个 jobs 全绿；13 包 manifest 绑定 `main` SHA `1a26d53`，11 个新 + package identity 再次确认未发布，可进入 `next` 发布。 + ## PDF fallback 字体修复（0.5.6 已发布） 状态：已发布至 npm registry / 稳定闭包已晋升 `latest` diff --git a/docs/releases/npm-0.5.7.en.md b/docs/releases/npm-0.5.7.en.md new file mode 100644 index 0000000..b719b4d --- /dev/null +++ b/docs/releases/npm-0.5.7.en.md @@ -0,0 +1,172 @@ +# npm 0.5.7 Release Record + +[中文版](npm-0.5.7.md) + +Status: pre-release validation complete. No candidate version has been written +to the npm registry; the current stable Small/runtime/native closure remains at +`0.5.6`. The six-platform rehearsal and manifest audit are green, so the +release may proceed. + +Release identity: + +- Implementation and release-gate hardening: + [PR #59](https://github.com/arcships/light-ocr/pull/59) +- Merged `main` commit: + [`1a26d53`](https://github.com/arcships/light-ocr/commit/1a26d53b97c4260bce2af6badeebd9cb3fe48484) +- Final `main` validation: + [Core 30986015180](https://github.com/arcships/light-ocr/actions/runs/30986015180) + and + [Native WebGPU 30986015218](https://github.com/arcships/light-ocr/actions/runs/30986015218) +- Six-platform release rehearsal: + [30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237) + (`publish_to_registry=false`) +- Registry publication and reinstall verification: pending +- Stable dist-tag promotion: pending +- GitHub Release: pending + +## User-visible changes + +- Fix native loading after Electron, notarization, or another downstream macOS + packaging pipeline re-signs the payload and thereby changes its size and + SHA-256. `light_ocr_node.node` and the ONNX Runtime dylib may now be re-signed + with the same Developer ID as the host application. +- Keep exact descriptor bytes/SHA-256 matching as the primary integrity gate. + Only when that gate diverges on macOS does the loader check the Mach-O magic, + run `codesign --verify --strict`, and require the artifact TeamIdentifier to + equal the host process TeamIdentifier. A both-ad-hoc host/artifact pair is + also accepted. +- Continue to return `package_load_failed` for different TeamIdentifiers, + unsigned mutations, non-Mach-O files, malformed descriptors, and every + descriptor mismatch on Linux or Windows. Native inventory and the post-load + ABI contract remain unchanged. +- Require no Electron configuration, environment variable, postinstall hook, + certificate keychain, or added dependency. `codesign` is used only for + verification. Because anyone can reproduce an ad-hoc signature, that branch + is explicitly limited to macOS cases where both the host and artifact are + ad-hoc signed. +- Preserve every public API and schema, including image, PDF, multi-page, CLI, + and provider behavior. + +## Candidate version closure + +| Maturity | Package | Candidate version | Target tags | +| --- | --- | ---: | --- | +| stable | `@arcships/light-ocr` | `0.5.7` | `next`, then `latest` after verification | +| stable | `@arcships/light-ocr-runtime` | `0.1.7` | `next`, then `latest` after verification | +| stable | six native platform packages | `0.5.7` | `next`, then `latest` after verification | +| compatibility | `@arcships/light-ocr-document` | `0.1.3` | `next` | +| preview | `@arcships/light-ocr-tiny` | `0.1.6` | `next` | +| preview | `@arcships/light-ocr-medium` | `0.1.6` | `next` | + +No model receives a new version. Small remains at `0.3.4`, while Tiny and +Medium remain at `0.1.0`. The publication workflow rebuilds or retrieves these +immutable model tarballs for complete offline installation testing and reuses +a registry version only after confirming identical integrity. + +## Six-platform native candidates + +The following values come from the rehearsal's `release-manifest.json`. Each +delta uses the published `0.5.6` tarball as its baseline. A customer installs +only the one native package selected for the current platform. + +| Platform package | Compressed bytes | Delta from 0.5.6 | Unpacked bytes | SHA-256 | +| --- | ---: | ---: | ---: | --- | +| `darwin-arm64` | 22,889,540 | -2 | 56,356,978 | `55f5539456e8da241d8101c7ca5f015b9ab130d77758b5a99552f3b5467c9554` | +| `darwin-x64` | 24,853,682 | +1 | 62,109,821 | `18975175b52da136d00e740f3a55ba4aab582732a80390b6c21f5b7053f0e51e` | +| `linux-arm64-gnu` | 20,453,508 | +23 | 40,261,084 | `ffb45dbff2f585010dade1978465b7e5b521c4da01db4dbc955cb20b27d889b7` | +| `linux-x64-gnu` | 27,033,573 | -18 | 59,390,897 | `a3bb20608d785a054b34c90a579f695a72648dae5db91e321167648b97c2e2c4` | +| `win32-arm64` | 16,661,617 | -2,136 | 30,977,284 | `7bbb501cfef7909ec319218c57fd5ed732aa619260ddbf5c39649c7005e3dc3c` | +| `win32-x64` | 30,386,121 | -1,022 | 63,065,652 | `84804a4fa8db6657361d59a2645c6140b00e48de2063a5dab182156ee4fb2d0e` | + +## Signing-policy verification + +- PR CI runs real `codesign` integration tests under the default Node host on + a GitHub macOS runner, covering pristine artifacts, unsigned mutations, + non-Mach-O payloads, different signers, and malformed descriptor records. +- The release workflow copies and ad-hoc signs setup-node's Node executable, + then runs the same tests again to deterministically exercise the positive + both-ad-hoc host/artifact path. +- A manual Developer ID signed-host check used TeamIdentifier `3AA79YWT4C`: + the pristine artifact passed, an unsigned mutation was rejected, and an + artifact re-signed ad-hoc was rejected as a different signer. If no matching + Developer ID is present in the runner keychain, the same-team positive test + explicitly skips instead of opening keychain UI or manufacturing evidence. + +## Release gates + +- [x] PR Linux native build and workspace Node tests +- [x] Post-merge six-platform Core, sanitizers, fuzzer, and oracle +- [x] Linux and Windows Native WebGPU contracts +- [x] Real signing-policy tests under the default macOS Node host +- [x] Positive both-ad-hoc test under an ad-hoc re-signed Node host +- [x] Developer ID signed-host pristine/tamper/different-signer manual checks +- [x] Malformed bytes/SHA-256 descriptor rejected before signature fallback +- [x] npm registry availability for all 11 new package identities +- [x] Native and PDFium addon rebuilt from pinned sources on all six platforms +- [x] Complete closure installed offline with installation scripts disabled on + all six platforms +- [x] Real image OCR and non-embedded Chinese-font PDF OCR on all six platforms +- [x] Candidate manifest, byte counts, SHA-256 values, and npm integrity audited +- [ ] Immutable candidates published to `next` with + `publish_to_registry=true` +- [ ] Registry reinstall, integrity, and network-disabled runtime verification +- [ ] Stable Small/runtime/native closure promoted to `latest` +- [ ] `v0.5.7` GitHub Release created + +## Publication and rollback sequence + +1. Run the `npm release` rehearsal only from the `main` SHA that passed final + validation. Download `light-ocr-npm-0.5.7` and audit package count, + versions, bytes, SHA-256 values, and npm integrity in the manifest. +2. After merging this record, rerun the same six-platform workflow with + `publish_to_registry=true`. It publishes new package identities only to + `next`, then reinstalls from the registry and executes offline image/PDF + smoke tests. +3. Only after the publication run succeeds, promote Small `0.5.7`, runtime + `0.1.7`, and the six native `0.5.7` packages to `latest` from that run's + immutable artifact. Document, Tiny, and Medium are not part of stable + promotion and remain on `next`. +4. If a blocking issue appears after promotion, do not overwrite or delete an + immutable version. Use the archived `0.5.6` release artifact from run + `30599969242` to restore the stable tags to Small/native `0.5.6` and runtime + `0.1.6`. + +## GitHub Release draft + +Release name: + +`同印随舟，重签安渡 · Support re-signed macOS artifacts in 0.5.7` + +Highlights: + +- Allow downstream macOS packaging pipelines to re-sign the native addon and + ONNX Runtime dylib with the same Developer ID as the host application. +- Keep descriptor bytes/SHA-256 as the primary integrity gate and use strict + code-signature equivalence only for a mismatched macOS Mach-O. +- Accept identical TeamIdentifier signatures or the explicitly documented + both-ad-hoc development case; reject different identities, unsigned + mutations, non-Mach-O payloads, and malformed descriptors. +- Require no Electron configuration, postinstall hook, keychain access, or new + dependency, while preserving every public API and non-macOS behavior. + +Versions: + +- `@arcships/light-ocr@0.5.7` +- `@arcships/light-ocr-runtime@0.1.7` +- six native platform packages at `0.5.7` +- Document compatibility facade `0.1.3` under `next` +- Tiny/Medium preview facades `0.1.6` under `next` +- unchanged Small `0.3.4` and Tiny/Medium `0.1.0` model packages + +Verification: + +- implementation and PR checks: + +- final Core: + +- final Native WebGPU: + +- pre-release dry-run: + +- release workflow: pending +- stable promotion: pending diff --git a/docs/releases/npm-0.5.7.md b/docs/releases/npm-0.5.7.md new file mode 100644 index 0000000..2ba196a --- /dev/null +++ b/docs/releases/npm-0.5.7.md @@ -0,0 +1,157 @@ +# npm 0.5.7 发布记录 + +[English version](npm-0.5.7.en.md) + +状态：发布前验证已完成。候选版本尚未写入 npm registry；当前稳定 +Small/runtime/native 闭包仍为 `0.5.6`。六平台演练与 manifest 审计全绿， +可进入正式发布。 + +发布身份： + +- 实现与发布门补强： + [PR #59](https://github.com/arcships/light-ocr/pull/59) +- 合并后的 `main` 提交： + [`1a26d53`](https://github.com/arcships/light-ocr/commit/1a26d53b97c4260bce2af6badeebd9cb3fe48484) +- 最终 `main` 验证： + [Core 30986015180](https://github.com/arcships/light-ocr/actions/runs/30986015180) + 与 + [Native WebGPU 30986015218](https://github.com/arcships/light-ocr/actions/runs/30986015218) +- 六平台发布演练： + [30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237) + （`publish_to_registry=false`） +- registry 发布与回装验证：待执行 +- 稳定 dist-tag 晋升：待执行 +- GitHub Release：待创建 + +## 用户可见变化 + +- 修复 Electron、notarization 或其他下游 macOS 打包流程重签原生载荷后， + runtime 因文件 size/SHA-256 改变而拒绝加载的问题。`light_ocr_node.node` + 与 ONNX Runtime dylib 现在可以随宿主应用使用同一 Developer ID 重签。 +- descriptor 的 bytes/SHA-256 精确匹配仍是首要完整性门。只有 macOS 上 + 该门不匹配时，loader 才检查 Mach-O magic、执行 + `codesign --verify --strict`，并要求制品 TeamIdentifier 与宿主进程相同； + 双方均为 ad-hoc 签名时也允许加载。 +- 不同 TeamIdentifier、未签名篡改、非 Mach-O 文件、畸形 descriptor， + 以及 Linux/Windows 的任何 descriptor 不匹配仍返回 + `package_load_failed`。native inventory 与加载后的 ABI contract 不变。 +- Electron 应用无需配置、环境变量、postinstall、证书 keychain 或新增依赖。 + `codesign` 只用于验证。由于 ad-hoc 签名可由任何人复现，该分支明确限制 + 为宿主与制品双方都采用 ad-hoc 的 macOS 场景。 +- 没有 public API 或 schema 破坏；图片、PDF、多页图片、CLI 与 provider + 行为保持不变。 + +## 待发布版本闭包 + +| 成熟度 | 包 | 候选版本 | 目标标签 | +| --- | --- | ---: | --- | +| stable | `@arcships/light-ocr` | `0.5.7` | `next`，验证后晋升 `latest` | +| stable | `@arcships/light-ocr-runtime` | `0.1.7` | `next`，验证后晋升 `latest` | +| stable | 六个平台 native | `0.5.7` | `next`，验证后晋升 `latest` | +| compatibility | `@arcships/light-ocr-document` | `0.1.3` | `next` | +| preview | `@arcships/light-ocr-tiny` | `0.1.6` | `next` | +| preview | `@arcships/light-ocr-medium` | `0.1.6` | `next` | + +模型包不重发新版本：Small 继续使用 `0.3.4`，Tiny/Medium 继续使用 +`0.1.0`。发布流水线重建或取得这些不可变模型 tarball 用于完整离线安装 +验证，并只在 registry 中同版本 integrity 完全一致时复用。 + +## 六平台 native 候选制品 + +下表来自发布演练的 `release-manifest.json`。增量以已发布 `0.5.6` +tarball 为基线；用户只安装当前平台对应的一个 native 包。 + +| 平台包 | 压缩 bytes | 相对 0.5.6 | 解包 bytes | SHA-256 | +| --- | ---: | ---: | ---: | --- | +| `darwin-arm64` | 22,889,540 | -2 | 56,356,978 | `55f5539456e8da241d8101c7ca5f015b9ab130d77758b5a99552f3b5467c9554` | +| `darwin-x64` | 24,853,682 | +1 | 62,109,821 | `18975175b52da136d00e740f3a55ba4aab582732a80390b6c21f5b7053f0e51e` | +| `linux-arm64-gnu` | 20,453,508 | +23 | 40,261,084 | `ffb45dbff2f585010dade1978465b7e5b521c4da01db4dbc955cb20b27d889b7` | +| `linux-x64-gnu` | 27,033,573 | -18 | 59,390,897 | `a3bb20608d785a054b34c90a579f695a72648dae5db91e321167648b97c2e2c4` | +| `win32-arm64` | 16,661,617 | -2,136 | 30,977,284 | `7bbb501cfef7909ec319218c57fd5ed732aa619260ddbf5c39649c7005e3dc3c` | +| `win32-x64` | 30,386,121 | -1,022 | 63,065,652 | `84804a4fa8db6657361d59a2645c6140b00e48de2063a5dab182156ee4fb2d0e` | + +## 签名策略验证 + +- PR CI 在 GitHub macOS runner 的默认 Node 宿主上执行真实 `codesign` + 集成测试，覆盖原始制品、未签名篡改、非 Mach-O、异签名和 descriptor + 畸形记录。 +- release workflow 复制 setup-node 的 Node 可执行文件并 ad-hoc 重签， + 再次运行相同测试，确定性覆盖“宿主与制品均为 ad-hoc”正向路径。 +- Developer ID signed host 的手工验证使用 TeamIdentifier `3AA79YWT4C`： + 原始制品通过；未签名篡改拒绝；由 ad-hoc 身份重签的制品因签名主体 + 不同而拒绝。若 runner keychain 没有匹配 Developer ID，测试会明确跳过 + 同 Team 正向路径，不触发 keychain UI 或伪造成功证据。 + +## 发布门 + +- [x] PR 的 Linux 原生构建与 workspace Node 测试 +- [x] 合并后的六平台 Core、sanitizer、fuzzer 与 oracle +- [x] Linux/Windows Native WebGPU contract +- [x] 默认 macOS Node 宿主的真实签名策略测试 +- [x] ad-hoc 重签 Node 宿主的双方 ad-hoc 正向测试 +- [x] Developer ID signed host 的原始/篡改/异签手工负向验证 +- [x] 畸形 bytes/SHA-256 descriptor 在 fallback 前 fail closed +- [x] 11 个新 package identity 的 npm registry 空位检查 +- [x] 六个平台从锁定源码重建 native 与 PDFium addon +- [x] 六个平台离线、禁用安装脚本安装完整闭包 +- [x] 六个平台真实图片 OCR 与非嵌入中文字体 PDF OCR +- [x] 候选 tarball manifest、bytes、SHA-256 与 npm integrity 审计 +- [ ] 以 `publish_to_registry=true` 发布不可变候选到 `next` +- [ ] 从 npm registry 回装并核对 integrity 与禁网运行 +- [ ] 将 stable Small/runtime/native 闭包晋升到 `latest` +- [ ] 创建 `v0.5.7` GitHub Release + +## 发布与回滚顺序 + +1. 只从通过主干验证的 `main` 运行 `npm release` dry-run；下载 + `light-ocr-npm-0.5.7`，审计 manifest、包数、版本、bytes、SHA-256 与 + npm integrity。 +2. 合并本记录后，以 `publish_to_registry=true` 重跑同一六平台流程。 + 新 package identity 只发布到 `next`，随后从 registry 回装并执行离线 + 图片/PDF smoke。 +3. 仅在发布 run 全绿后，使用该 run 的不可变 artifact 将 Small + `0.5.7`、runtime `0.1.7` 与六个 native `0.5.7` 晋升到 `latest`。 + Document、Tiny 与 Medium 不属于 stable promotion，继续保持 `next`。 +4. 如晋升后发现阻断问题，不覆盖或删除已发布版本；使用已归档的 + `0.5.6` 发布 artifact（run `30599969242`）将 stable 标签回退到 + Small/native `0.5.6` 与 runtime `0.1.6`。 + +## GitHub Release 草案 + +Release name： + +`同印随舟，重签安渡 · Support re-signed macOS artifacts in 0.5.7` + +Highlights： + +- Allow downstream macOS packaging pipelines to re-sign the native addon and + ONNX Runtime dylib with the same Developer ID as the host application. +- Keep descriptor bytes/SHA-256 as the primary integrity gate and use strict + code-signature equivalence only for a mismatched macOS Mach-O. +- Accept identical TeamIdentifier signatures or the explicitly documented + both-ad-hoc development case; reject different identities, unsigned + mutations, non-Mach-O payloads, and malformed descriptors. +- Require no Electron configuration, postinstall hook, keychain access, or new + dependency, while preserving every public API and non-macOS behavior. + +Versions： + +- `@arcships/light-ocr@0.5.7` +- `@arcships/light-ocr-runtime@0.1.7` +- six native platform packages at `0.5.7` +- Document compatibility facade `0.1.3` under `next` +- Tiny/Medium preview facades `0.1.6` under `next` +- unchanged Small `0.3.4` and Tiny/Medium `0.1.0` model packages + +Verification： + +- implementation and PR checks: + +- final Core: + +- final Native WebGPU: + +- pre-release dry-run: + +- release workflow: pending +- stable promotion: pending diff --git a/packages/light-ocr/README.md b/packages/light-ocr/README.md index 385d692..0c8dcf7 100644 --- a/packages/light-ocr/README.md +++ b/packages/light-ocr/README.md @@ -295,6 +295,7 @@ console.log(modelProfile); - [Project overview](https://github.com/arcships/light-ocr) - [Node.js and CLI reference](https://github.com/arcships/light-ocr/blob/main/bindings/node/README.md) +- [macOS re-signing 0.5.7 release notes](https://github.com/arcships/light-ocr/blob/main/docs/releases/npm-0.5.7.en.md) - [PDF 0.5.6 release notes](https://github.com/arcships/light-ocr/blob/main/docs/releases/npm-0.5.6.en.md) - [Agent Skill](https://github.com/arcships/light-ocr/blob/main/.agents/skills/local-ocr/SKILL.md) - [Changelog](https://github.com/arcships/light-ocr/blob/main/CHANGELOG.md)