Sync workflowa with test-workflows branch

Author: utelle

.github/workflows/build-release.yml

@@ -202,11 +202,68 @@ jobs:
             /p:Configuration=Release `
             /p:Platform=x64
 
+      # -------------------------------------------------
+      # Stage Windows PE files for signing
+      # -------------------------------------------------
+      - name: Stage Windows PE files for signing
+        if: ${{ env.MODE != 'sanity' }}
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force to-sign | Out-Null
+          # All signable DLLs are produced in dll/release, the shell EXEs in
+          # lib/release (same paths package-windows collects from). Names are
+          # unique across the variants, so a flat staging dir is collision-free.
+          Copy-Item bin/vc17/dll/release/sqlite3mc*.dll       to-sign/ -ErrorAction SilentlyContinue
+          Copy-Item bin/vc17/lib/release/sqlite3mc_shell*.exe to-sign/ -ErrorAction SilentlyContinue
+          Get-ChildItem to-sign
+
+      # -------------------------------------------------
+      # Upload unsigned PE files
+      # -------------------------------------------------
+      - name: Upload unsigned PE files
+        id: upload-unsigned-pe
+        if: ${{ env.MODE != 'sanity' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: unsigned-windows-pe       # must NOT start with sqlite3mc- (intermediate)
+          path: to-sign
+          if-no-files-found: error
+
+      # -------------------------------------------------
+      # Submit signing request (SignPath)
+      # -------------------------------------------------
+      - name: Submit signing request (SignPath)
+        if: ${{ env.MODE != 'sanity' }}
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'SQLite3MultipleCiphers'
+          artifact-configuration-slug: 'windows-binaries'
+          signing-policy-slug: ${{ env.MODE == 'release' && 'release-signing' || 'test-signing' }}
+          github-artifact-id: '${{ steps.upload-unsigned-pe.outputs.artifact-id }}'
+          wait-for-completion: true
+          # release-signing typically requires manual approval -> wait longer
+          wait-for-completion-timeout-in-seconds: 1800
+          output-artifact-directory: 'signed'
+
+      # -------------------------------------------------
+      # Restore signed PE files
+      # -------------------------------------------------
+      - name: Restore signed PE files
+        if: ${{ env.MODE != 'sanity' }}
+        shell: pwsh
+        run: |
+          # SignPath returns the same file names; put the signed DLLs/EXEs back
+          # exactly where package-windows picks them up.
+          Copy-Item signed/sqlite3mc*.dll       bin/vc17/dll/release/ -Force
+          Copy-Item signed/sqlite3mc_shell*.exe bin/vc17/lib/release/ -Force
+
       # -------------------------------------------------
       # Upload Win32 and Win64 binaries
       # -------------------------------------------------
       - name: Upload build output
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: build-output
           path: |
@@ -402,18 +459,34 @@ jobs:
           sdkmanager "ndk;26.3.11579264"
 
       # -------------------------------------------------
-      # Install Fossil
+      # Download and verify Fossil
+      # --------------
+      # SHA3-256 checksum (retrieved from https://www3.fossil-scm.org/home/uvlist on 2026-06-08)
+      # fossil-linux-x64-2.28.tar.gz cbd89e653e1b797802f2ee5bb55d6ad4959291ec6d6eb192c79ff62d9a224c33
       # -------------------------------------------------
-      - name: Install Fossil
+      - name: Download and verify Fossil
         shell: bash
         run: |
           set -euo pipefail
 
           FOSSIL_VERSION="2.28"
+          FOSSIL_SHA3="cbd89e653e1b797802f2ee5bb55d6ad4959291ec6d6eb192c79ff62d9a224c33"
 
           curl -fL --retry 3 --retry-delay 5 -o fossil.tar.gz \
             https://www.fossil-scm.org/home/uv/fossil-linux-x64-$FOSSIL_VERSION.tar.gz
 
+          python3 scripts/verify_sha3.py \
+            fossil.tar.gz \
+            "${FOSSIL_SHA3}"
+
+      # -------------------------------------------------
+      # Install Fossil
+      # -------------------------------------------------
+      - name: Install Fossil
+        shell: bash
+        run: |
+          set -euo pipefail
+
           tar -xzf fossil.tar.gz
           sudo mv fossil /usr/local/bin/
           fossil version
@@ -778,18 +851,34 @@ jobs:
           python scripts/build_context.py
 
       # -------------------------------------------------
-      # Install Fossil
+      # Download and verify Fossil
+      # --------------
+      # SHA3-256 checksum (retrieved from https://www3.fossil-scm.org/home/uvlist on 2026-06-08)
+      # fossil-linux-x64-2.28.tar.gz cbd89e653e1b797802f2ee5bb55d6ad4959291ec6d6eb192c79ff62d9a224c33
       # -------------------------------------------------
-      - name: Install Fossil
+      - name: Download and verify Fossil
         shell: bash
         run: |
           set -euo pipefail
 
           FOSSIL_VERSION="2.28"
+          FOSSIL_SHA3="cbd89e653e1b797802f2ee5bb55d6ad4959291ec6d6eb192c79ff62d9a224c33"
 
           curl -fL --retry 3 --retry-delay 5 -o fossil.tar.gz \
             https://www.fossil-scm.org/home/uv/fossil-linux-x64-$FOSSIL_VERSION.tar.gz
 
+          python3 scripts/verify_sha3.py \
+            fossil.tar.gz \
+            "${FOSSIL_SHA3}"
+
+      # -------------------------------------------------
+      # Install Fossil
+      # -------------------------------------------------
+      - name: Install Fossil
+        shell: bash
+        run: |
+          set -euo pipefail
+
           tar -xzf fossil.tar.gz
           sudo mv fossil /usr/local/bin/
           fossil version

.signpath/artifact-configurations/windows-binaries.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  SignPath Artifact Configuration for the SQLite3MultipleCiphers repo.
+  Register in the SignPath portal under project "SQLite3MultipleCiphers" with the
+  configuration slug "windows-binaries". The portal copy is authoritative.
+
+  The workflow stages the signable PE files into a FLAT directory ("to-sign/")
+  and uploads it with actions/upload-artifact, which wraps it in a ZIP -> root
+  element <zip-file>. The DLLs/EXEs therefore sit directly at the ZIP root by
+  file name (single level), so no recursive "**" is needed here.
+
+  min-matches="1" on the DLL pattern fails the request loudly if nothing was
+  staged (at least sqlite3mc.dll is always built); the shell EXE stays optional.
+-->
+<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
+  <zip-file>
+    <pe-file-set>
+      <include path="sqlite3mc*.dll"       min-matches="1" max-matches="unbounded" />
+      <include path="sqlite3mc_shell*.exe" min-matches="0" max-matches="unbounded" />
+      <for-each>
+        <authenticode-sign />
+      </for-each>
+    </pe-file-set>
+  </zip-file>
+</artifact-configuration>

packaging/autoconf/VERSION.in

@@ -0,0 +1 @@
+{SQLITE3MC_VERSION}

packaging/autoconf/sqlite3rc.h.in

@@ -0,0 +1,15 @@
+#ifndef SQLITE3MC_VERSION_MAJOR
+#define SQLITE3MC_VERSION_MAJOR      {SQLITE3MC_VERSION_MAJOR}
+#endif
+
+#ifndef SQLITE3MC_VERSION_MINOR
+#define SQLITE3MC_VERSION_MINOR      {SQLITE3MC_VERSION_MINOR}
+#endif
+
+#ifndef SQLITE3MC_VERSION_RELEASE
+#define SQLITE3MC_VERSION_RELEASE    {SQLITE3MC_VERSION_RELEASE}
+#endif
+
+#ifndef SQLITE3MC_VERSION_SUBRELEASE
+#define SQLITE3MC_VERSION_SUBRELEASE {SQLITE3MC_VERSION_SUBRELEASE}
+#endif