Add Windows installer, signing, and release build checks

[owenpkent]

What this changes

Offloader can now be built as a Windows x64 desktop/CLI bundle and an NSIS installer for machines without Python. A single version source supplies package metadata, runtime/report versions, and executable/installer versions. Runtime and packaging dependencies are pinned.

The build signs by default with the existing OK Studio certificate, verifies trusted publishers and timestamp coverage, signs the generated uninstaller during NSIS compilation, and signs the setup executable afterward. --no-sign produces development and CI artifacts without accessing the key. Source/file inventories reject stale --skip-build bundles; --verify-only checks existing outputs without the private key, and final checksums cover the installer, portable ZIP, and inventory.

Installed GUI and CLI processes hold lifetime locks that block maintenance while any instance is open. Maintenance blocks new launches, stages and checks replacements, preserves old owned files for rollback, recovers interrupted operations, and removes only inventoried files. Settings, history, and unrelated files are preserved. The wizard includes shortcut choices, silent installation, and an optional Finish launch using the desktop user's token and environment, with no elevated fallback.

CI builds unsigned installers and portable bundles, runs frozen smoke checks, and checks that the source archive includes the Windows builder. Setuptools output moves to .python-build because its default cleanup otherwise omitted the tracked build/windows directory. The earlier file-control test fixes remove disk-speed races without changing production copy or verification behavior.

Stacked on #6; targets timeline-offload. Timeline import remains source-only in this bundle. No release is published and no hardware-key signing was performed.

What you verified

• Local Windows/Python 3.12.10 suite: 727 passed, 5 skipped, with 85% line coverage. Ruff and diff checks passed.
• The real unsigned NSIS installer and portable bundle built with NSIS 3.12. Frozen executable versions match the source, and the GUI starts offscreen with isolated settings.
• The frozen CLI copies disposable data to two destinations, generates all five report formats, re-verifies both copies, and detects a flipped byte.
• The frozen maintenance helper installs, reinstalls, and uninstalls in temporary folders. Checks cover application/maintenance lock contention and preservation of unrelated files, without registry or shortcut changes on the workstation.
• Regression tests inject interrupted file moves, interrupted rollback, manifest-update gaps, and cleanup failures. Signing tests cover wrong publishers, missing timestamps, cancellation, and uninstaller finalizer failure without using the hardware key.
• Signing preflight and read-only verification of existing Microsoft, Python, and Qt dependency signatures passed.
• Wheel/sdist builds and isolated wheel installation passed. The final source archive contains the Windows builder and NSIS template; bundle provenance and output checksums match the completed build.

Hardware-key signing, the actual NSIS install lifecycle under UAC, alternate administrator credentials and desktop launch, independent clean-machine/real-storage qualification, and the complete third-party license inventory/SBOM remain pending. Hosted CI for this update must be evaluated separately from the local results above.

Checklist

• pytest passes locally (727 passed, 5 skipped)
• ruff check src tests scripts build/windows passes
• Tests cover installation failure, interruption, recovery, and signing refusal
• Copy verification verdicts and source-media handling are unchanged
• Data-safety and build/release documentation describe the implemented behavior and remaining limits
• README measurements and changelog are updated
• Clean-machine installation and real hardware-key signing qualification

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pyinstaller@​6.22.2
	pypi/​pyinstaller-hooks-contrib@​2026.7
	pypi/​pyside6-addons@​6.11.2
	pypi/​pyside6-essentials@​6.11.2
	pypi/​shiboken6@​6.11.2
	pypi/​pillow@​12.3.0
	pypi/​altgraph@​0.17.5
	pypi/​packaging@​26.3
	pypi/​pefile@​2024.8.26
	pypi/​pywin32-ctypes@​0.2.3

View full report