@gjsify/site 0.64.12-next.281 → 0.64.12

package/README.md

@@ -150,6 +150,7 @@ Lives in the root `package.json`, next to `ship` and `flatpak`.
 | `downloads` | `[{platform, format, url?, label?, available?, component?}]`: targets the release assets do not cover, e.g. browser stores or a source install. `platform` is an OS or `firefox` / `chromium`; `format` adds `store`, `xpi`, `source`. `url` is required unless `available` is `false`, which lists the target as "Not yet available" and never recommends it. `component` is a `components[].id`. |
 | `releaseAssets` | `false` ignores the GitHub release assets, so `downloads` is the whole list. Default `true`. |
 | `relatedApps` | `[url \| {url, name, summary, icon}]`: sites of other apps, listed in order under "More apps by <developer>" on the landing page, see below. Optional — without it there is no section and nothing is fetched. |
+| `developerUrl` | The developer's own site, e.g. a [developer site](#developer-sites): the "by <developer>" line under the app name links to it. Optional. |
 | `support`, `legal` | `support`: `{kind, url}` links, or `{kind: "sepa", name, iban, bic?, reference?}`, a bank transfer shown as IBAN plus an EPC QR code. `legal`: `{label, url}` links. Both empty by default: nothing is invented. |
 | `privacy` | `{statements: {<lang>: <path>}, hostingPolicyUrl?}`: a privacy page at `/<lang>/privacy/`, see below. Absent: no such page. |
 | `legalNotice` | `{statements: {<lang>: <path>}}`: a Legal Notice/Impressum page at `/<lang>/legal-notice/`, see below. Absent: no such page. |
@@ -281,7 +282,8 @@ Everything else in the directory — images, downloads — is published under `/
 relative path, so `![shot](shot.png)` works in the editor and on the page. A link to another post's
 `.md` file becomes a link to that post's page; one to a post the build does not render (a draft,
 a typo) fails the build, since no Markdown is ever published. Posts are `BlogPosting` JSON-LD with
-`article:*` meta, and the landing page shows the newest three of its language.
+`article:*` meta, and the landing page shows the newest three of its language. On a site with
+`support` entries, every post ends with a note linking to the support page.
 
 ## Theme
 

package/lib/client/site.css

@@ -1549,6 +1549,22 @@ app-support {
   color: var(--muted);
 }
 
+.post-support {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-block-start: 2.5rem;
+  padding: 1.25rem;
+  border-radius: var(--radius-lg);
+  background: var(--surface);
+}
+
+.post-support p {
+  margin: 0;
+}
+
 .latest-posts {
   margin-block: 2.5rem;
 }

package/lib/render/blog.d.ts

@@ -36,6 +36,8 @@ export interface BlogPostOptions {
         name: string;
         url?: string;
     };
+    /** The site's support page in the post's language; without one the post ends with its text. */
+    supportUrl?: string;
 }
 /** `/<lang>/blog/<slug>/`. */
 export declare function renderBlogPost(shell: Shell, post: BlogPost, options: BlogPostOptions): string;

package/lib/render/blog.js

@@ -178,9 +178,16 @@ ${postMeta(post, shell)}
 <div class="post-body">
 ${options.html}
 </div>
-</article>
+${options.supportUrl ? postSupport(shell, options.supportUrl) : ''}</article>
 </main>`, 'blog-post');
 }
+function postSupport({ t }, href) {
+    return `<aside class="post-support">
+<p>${esc(t('If this post was useful to you, you can support my work.'))}</p>
+<a class="button" href="${esc(href)}">${icon('heart')}<span>${esc(t('Support my work'))}</span></a>
+</aside>
+`;
+}
 /** The newest posts as a landing-page section; empty when the language has none. */
 export function latestPostsSection(shell, posts, count = LATEST_POSTS) {
     const { config, lang, t } = shell;

package/lib/render/i18n.d.ts

@@ -3,6 +3,8 @@ import { type Catalog, type AnySiteConfig } from '../site-data/index.js';
  * The msgids the renderer itself can emit: every translator call in its sources, plus the default
  * download labels. They belong to this package and are translated in its own `po/`.
  */
+/** The msgids of every translator call in one source file. */
+export declare function translatorCalls(source: string): string[];
 export declare function rendererMsgids(renderDir: string): Promise<string[]>;
 /**
  * The msgids a configuration introduces: the download labels its author wrote. They belong to the

package/lib/render/i18n.js

@@ -8,7 +8,9 @@ import { DOWNLOAD_LABELS, FORMAT_LABELS, SUPPORT_KIND_LABELS, UI_SOURCE_LANGUAGE
 // pattern then extracted nothing and the sync offered to delete every translated string in `po/`.
 // Hence also the floor below: an extractor that matches nothing must fail, never quietly empty the
 // catalogues. Note that this pattern reads THIS file too, so no prose here spells out a call.
-const T_CALL = /\bt\(\s*(['"])((?:\\.|(?!\1)[^\\])*)\1\s*\)/g;
+// The optional comma is the formatter's again: a msgid too long for one line is wrapped onto its
+// own and gets a trailing comma, and without `,?` that string silently left the catalogue.
+const T_CALL = /\bt\(\s*(['"])((?:\\.|(?!\1)[^\\])*)\1\s*,?\s*\)/g;
 /** Decodes a JS string literal body, whichever quote style it was written in. */
 function unquote(body, quote) {
     const json = quote === '"' ? body : body.replace(/\\'/g, "'").replace(/"/g, '\\"');
@@ -18,6 +20,10 @@ function unquote(body, quote) {
  * The msgids the renderer itself can emit: every translator call in its sources, plus the default
  * download labels. They belong to this package and are translated in its own `po/`.
  */
+/** The msgids of every translator call in one source file. */
+export function translatorCalls(source) {
+    return [...source.matchAll(T_CALL)].map((match) => unquote(match[2], match[1]));
+}
 export async function rendererMsgids(renderDir) {
     const msgids = new Set();
     let fromSources = 0;
@@ -25,8 +31,8 @@ export async function rendererMsgids(renderDir) {
         if (!file.endsWith('.ts') || file.endsWith('.spec.ts'))
             continue;
         const source = await readFile(join(renderDir, file), 'utf8');
-        for (const match of source.matchAll(T_CALL)) {
-            msgids.add(unquote(match[2], match[1]));
+        for (const msgid of translatorCalls(source)) {
+            msgids.add(msgid);
             fromSources++;
         }
     }

package/lib/render/pages.d.ts

@@ -63,6 +63,15 @@ export declare function relatedCard(app: RelatedApp, lang: string): string;
 export declare function relatedSection(ctx: Pick<RenderContext, 'data' | 'lang' | 't'>): string;
 /** A bank transfer as a card: the details to read or copy, and an EPC QR code that fills them into a banking app. */
 export declare function sepaCard(entry: SiteSupportSepa, t: Translate): string;
+/**
+ * Everything above the text: the icon and name, the install button, the facts row and the
+ * screenshots. One element, so the app's brand colour is behind all of it rather than behind the
+ * screenshots alone. The bar is its sibling and not its child — a `position: sticky` element
+ * cannot outlive its own containing block — but it is painted in the same colour, so it reads as
+ * the top of this header and needs no script to tell whether it has detached.
+ */
+/** "by <developer>" under the app name, linking to the developer's site when one is configured. */
+export declare function heroBy({ data, t }: Pick<RenderContext, 'data' | 't'>): string;
 /** The title and description of one page; also what the build checks for weak ones. */
 export declare function pageMeta(ctx: Pick<RenderContext, 'data' | 'lang' | 't'>, view?: 'app' | 'support' | 'privacy' | 'legal-notice'): {
     name: string;

package/lib/render/pages.js

@@ -1,4 +1,4 @@
-import { epcPayload, formatIban, isBrowserPlatform, PLATFORM_ORDER, pickByLanguage, relatedText, relatedUrl, } from '../site-data/index.js';
+import { epcPayload, formatIban, isBrowserPlatform, needsOpenAnywayHint, PLATFORM_ORDER, pickByLanguage, relatedText, relatedUrl, } from '../site-data/index.js';
 import { blogFeedUrl, blogIndexUrl } from './blog.js';
 import { attrs, esc, fmt, plain } from './html.js';
 import { icon } from './icons.js';
@@ -81,6 +81,23 @@ function osName(os, t) {
         chromium: t('Chromium'),
     }[os];
 }
+/**
+ * How to get past the OS's warning for a download without the signature it wants (ADR 0124). The
+ * wording follows each system's own button labels, which is what the visitor has to find.
+ */
+function openAnywayHint(os, t) {
+    if (os === 'darwin') {
+        return t('macOS asks before opening an app Apple has not checked. Try to open it once, then choose System Settings → Privacy & Security → Open Anyway.');
+    }
+    if (os === 'win32') {
+        return t('Windows may warn about an unknown publisher. Choose More info → Run anyway.');
+    }
+    return undefined;
+}
+/** The short form beside the target itself; the group's note says what to do about it. */
+function unsignedMark(os, t) {
+    return os === 'darwin' ? t('Not notarized') : t('Unsigned');
+}
 function sizeLabel(bytes, lang) {
     if (!bytes)
         return '';
@@ -228,10 +245,12 @@ function componentBlocks(data) {
 function targetItem(target, ctx) {
     const { t, lang } = ctx;
     const size = sizeLabel(target.size, lang);
+    const unsigned = target.available && needsOpenAnywayHint(target);
     const meta = [
         target.arch === 'noarch' ? '' : target.arch,
         target.recommended ? t('Recommended') : '',
         target.available ? '' : t('Not yet available'),
+        unsigned ? unsignedMark(target.os, t) : '',
     ]
         .filter(Boolean)
         .join(' · ');
@@ -244,6 +263,7 @@ ${size ? `<span class="target-size">${esc(size)}</span>` : ''}`;
         'data-arch': target.arch,
         'data-recommended': target.recommended,
         'data-unavailable': !target.available,
+        'data-unsigned': unsigned,
         'data-cta': target.available ? ctaLabel(target, t) : undefined,
         'data-size': size || undefined,
     })}>
@@ -282,6 +302,7 @@ function componentSection(block, slug, step, ctx) {
 ${own.map((target) => targetItem(target, ctx)).join('\n')}
 </ul>
 ${os === 'darwin' ? `<p class="os-note">${esc(t('Apple Silicon is assumed. Pick the Intel build if your Mac has an Intel processor.'))}</p>` : ''}
+${own.some((target) => target.available && needsOpenAnywayHint(target)) ? `<p class="os-note os-note-unsigned">${esc(openAnywayHint(os, t) ?? '')}</p>` : ''}
 </section>`);
     const head = block.name
         ? `<div class="component-head">
@@ -569,15 +590,23 @@ function tags(ctx) {
  * cannot outlive its own containing block — but it is painted in the same colour, so it reads as
  * the top of this header and needs no script to tell whether it has detached.
  */
-function masthead(ctx) {
-    const { data, lang, t } = ctx;
+/** "by <developer>" under the app name, linking to the developer's site when one is configured. */
+export function heroBy({ data, t }) {
     const developer = data.app.developer.name;
+    if (!developer)
+        return '';
+    const url = data.config.developerUrl;
+    const name = url ? `<a href="${esc(url)}">${esc(developer)}</a>` : esc(developer);
+    return `<p class="hero-by">${esc(t('by {developer}')).replace('{developer}', name)}</p>`;
+}
+function masthead(ctx) {
+    const { data, lang } = ctx;
     return `<header class="masthead">
 <div class="hero-inner">
 ${ctx.iconUrl ? `<div class="hero-icon" style="--icon-url:url(${esc(ctx.iconUrl)})"><img src="${esc(ctx.iconUrl)}" alt="" width="128" height="128"></div>` : ''}
 <div class="hero-text">
 <h1>${esc(localized(data.app.name, lang))}</h1>
-${developer ? `<p class="hero-by">${fmt(t('by {developer}'), { developer })}</p>` : ''}
+${heroBy(ctx)}
 </div>
 ${downloadWidget(ctx)}
 </div>

package/lib/site-data/config.js

@@ -340,6 +340,9 @@ export function parseSiteConfig(manifest) {
         downloads: parseDownloads(raw, components),
         releaseAssets: parseReleaseAssets(raw),
         relatedApps: parseRelatedApps(raw.relatedApps, 'gjsify.site.relatedApps'),
+        developerUrl: raw.developerUrl === undefined
+            ? undefined
+            : httpUrl(requireString(raw, 'developerUrl'), 'gjsify.site.developerUrl'),
     };
 }
 /** The `kind` labels the support page knows by name; the page catalogues translate them. */

package/lib/site-data/downloads.d.ts

@@ -1,4 +1,20 @@
-import type { DownloadTarget, ReleaseAsset, SiteComponent, SiteDownloadConfig, TargetArch, TargetFormat, TargetPlatform } from './types.js';
+import type { DownloadTarget, ReleaseAsset, Signing, SiteComponent, SiteDownloadConfig, TargetArch, TargetFormat, TargetPlatform } from './types.js';
+/** What `gjsify ship` appends to an artifact's name for its release record (ADR 0124). */
+export declare const RELEASE_RECORD_SUFFIX = ".gjsify-release.json";
+/** The artifact a release-record asset describes, or `undefined` when the asset is not a record. */
+export declare function recordedArtifact(name: string): string | undefined;
+/**
+ * What a release record proves about one asset. The record is a file anyone with upload rights can
+ * write, so it counts only when its hash is the one GitHub computed for the asset; an asset GitHub
+ * gave no digest, a record for other bytes, or no record at all is `unsigned`. An ad-hoc signature
+ * is `unsigned` too: Gatekeeper and SmartScreen both treat it as no publisher at all.
+ */
+export declare function signingOf(asset: ReleaseAsset, record: unknown): Signing;
+/**
+ * Whether the visitor's OS will stop this download and ask to be overruled. macOS opens only a
+ * notarised app without asking; Windows SmartScreen is content with a signature.
+ */
+export declare function needsOpenAnywayHint(target: Pick<DownloadTarget, 'os' | 'signing'>): boolean;
 /** Browser extensions are listed after the OS builds; a page usually has only one kind. */
 export declare const PLATFORM_ORDER: readonly TargetPlatform[];
 /** Platforms that are browsers: their targets are picked by the visitor's browser, not OS. */
@@ -33,6 +49,8 @@ export interface DownloadSources {
     configured?: readonly SiteDownloadConfig[];
     /** `gjsify.site.components`, in install order; empty when the product is one thing to download. */
     components?: readonly SiteComponent[];
+    /** Parsed release records, by the artifact name they describe; see {@link signingOf}. */
+    records?: ReadonlyMap<string, unknown>;
 }
 /**
  * Builds the sorted target list and marks the first available target of every platform as

package/lib/site-data/downloads.js

@@ -1,3 +1,41 @@
+/** What `gjsify ship` appends to an artifact's name for its release record (ADR 0124). */
+export const RELEASE_RECORD_SUFFIX = '.gjsify-release.json';
+/** The artifact a release-record asset describes, or `undefined` when the asset is not a record. */
+export function recordedArtifact(name) {
+    return name.endsWith(RELEASE_RECORD_SUFFIX) ? name.slice(0, -RELEASE_RECORD_SUFFIX.length) : undefined;
+}
+/**
+ * What a release record proves about one asset. The record is a file anyone with upload rights can
+ * write, so it counts only when its hash is the one GitHub computed for the asset; an asset GitHub
+ * gave no digest, a record for other bytes, or no record at all is `unsigned`. An ad-hoc signature
+ * is `unsigned` too: Gatekeeper and SmartScreen both treat it as no publisher at all.
+ */
+export function signingOf(asset, record) {
+    if (typeof record !== 'object' || record === null)
+        return 'unsigned';
+    const fields = record;
+    if (fields.schema !== 1 || fields.artifact !== asset.name)
+        return 'unsigned';
+    if (!asset.sha256 || typeof fields.sha256 !== 'string' || fields.sha256.toLowerCase() !== asset.sha256) {
+        return 'unsigned';
+    }
+    if (fields.signature?.kind !== 'identity')
+        return 'unsigned';
+    return fields.notarized === true ? 'notarized' : 'signed';
+}
+/**
+ * Whether the visitor's OS will stop this download and ask to be overruled. macOS opens only a
+ * notarised app without asking; Windows SmartScreen is content with a signature.
+ */
+export function needsOpenAnywayHint(target) {
+    if (target.signing === undefined)
+        return false;
+    if (target.os === 'darwin')
+        return target.signing !== 'notarized';
+    if (target.os === 'win32')
+        return target.signing === 'unsigned';
+    return false;
+}
 /** Browser extensions are listed after the OS builds; a page usually has only one kind. */
 export const PLATFORM_ORDER = [
     'linux',
@@ -173,6 +211,7 @@ export function buildDownloadTargets(sources) {
         const kind = classifyAsset(asset);
         if (!kind)
             continue;
+        const gated = kind.os === 'darwin' || kind.os === 'win32';
         targets.push({
             ...kind,
             component: componentOf(asset.name, components),
@@ -182,6 +221,7 @@ export function buildDownloadTargets(sources) {
             size: asset.size,
             downloadCount: asset.downloadCount,
             recommended: false,
+            ...(gated ? { signing: signingOf(asset, sources.records?.get(asset.name)) } : {}),
         });
     }
     if (sources.webAppUrl) {

package/lib/site-data/github.d.ts

@@ -1,7 +1,13 @@
 import { type NetworkOptions } from './network.js';
-import type { LatestRelease } from './types.js';
+import type { LatestRelease, ReleaseAsset } from './types.js';
 /** Parses the GitHub REST `releases/latest` payload; anything malformed throws so the caller can warn and degrade. */
 export declare function parseLatestRelease(payload: unknown): LatestRelease;
+/**
+ * Fetches every release record among `assets`, by the artifact it describes. A record that does not
+ * download is reported through `warn` and left out, which makes its artifact `unsigned` — the page
+ * then shows one hint too many rather than one too few.
+ */
+export declare function fetchReleaseRecords(assets: readonly ReleaseAsset[], options: NetworkOptions, warn: (message: string) => void): Promise<Map<string, unknown>>;
 /**
  * Fetches the latest published (non-draft, non-prerelease) release; `null` when the repository has
  * none yet, which is a state and not an error. `token` raises the rate limit.

package/lib/site-data/github.js

@@ -1,4 +1,12 @@
+import { recordedArtifact } from './downloads.js';
 import { fetchJson, HttpError } from './network.js';
+/** GitHub spells the digest `sha256:<hex>`; any other algorithm is not one a release record carries. */
+function sha256Of(digest) {
+    if (typeof digest !== 'string')
+        return undefined;
+    const match = /^sha256:([0-9a-f]{64})$/i.exec(digest);
+    return match ? match[1].toLowerCase() : undefined;
+}
 /** Parses the GitHub REST `releases/latest` payload; anything malformed throws so the caller can warn and degrade. */
 export function parseLatestRelease(payload) {
     const release = payload;
@@ -12,6 +20,7 @@ export function parseLatestRelease(payload) {
                 size: typeof asset.size === 'number' ? asset.size : 0,
                 downloadUrl: asset.browser_download_url,
                 downloadCount: typeof asset.download_count === 'number' ? asset.download_count : 0,
+                ...(sha256Of(asset.digest) ? { sha256: sha256Of(asset.digest) } : {}),
             },
         ]
         : []);
@@ -23,6 +32,26 @@ export function parseLatestRelease(payload) {
         assets,
     };
 }
+/**
+ * Fetches every release record among `assets`, by the artifact it describes. A record that does not
+ * download is reported through `warn` and left out, which makes its artifact `unsigned` — the page
+ * then shows one hint too many rather than one too few.
+ */
+export async function fetchReleaseRecords(assets, options, warn) {
+    const records = new Map();
+    await Promise.all(assets.map(async (asset) => {
+        const artifact = recordedArtifact(asset.name);
+        if (artifact === undefined)
+            return;
+        try {
+            records.set(artifact, await fetchJson(asset.downloadUrl, { Accept: 'application/json' }, options));
+        }
+        catch (error) {
+            warn(`Could not fetch the release record ${asset.name} (${String(error)}); treating ${artifact} as unsigned`);
+        }
+    }));
+    return records;
+}
 /**
  * Fetches the latest published (non-draft, non-prerelease) release; `null` when the repository has
  * none yet, which is a state and not an error. `token` raises the rate limit.

package/lib/site-data/load.js

@@ -2,9 +2,9 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { parseSiteConfig } from './config.js';
-import { buildDownloadTargets } from './downloads.js';
+import { buildDownloadTargets, recordedArtifact } from './downloads.js';
 import { fetchFlathubStats, fetchFlathubSummary } from './flathub.js';
-import { fetchLatestRelease } from './github.js';
+import { fetchLatestRelease, fetchReleaseRecords } from './github.js';
 import { parseMetainfo } from './metainfo.js';
 import { minimumAge } from './oars.js';
 import { completeLocalized, languageCandidates, parseCatalog } from './po.js';
@@ -85,6 +85,7 @@ export async function loadSiteData(options) {
     let latestRelease = null;
     let hasReleases = true;
     let flathubSize;
+    let records;
     const stats = {};
     if (!options.offline) {
         const network = options.network ?? {};
@@ -97,7 +98,12 @@ export async function loadSiteData(options) {
             latestRelease = release.value;
             hasReleases = latestRelease !== null;
             if (latestRelease) {
-                stats.githubDownloads = latestRelease.assets.reduce((sum, asset) => sum + asset.downloadCount, 0);
+                // A release record is fetched by every site build, not by a person installing.
+                stats.githubDownloads = latestRelease.assets
+                    .filter((asset) => recordedArtifact(asset.name) === undefined)
+                    .reduce((sum, asset) => sum + asset.downloadCount, 0);
+                if (config.releaseAssets)
+                    records = await fetchReleaseRecords(latestRelease.assets, network, warn);
             }
         }
         else {
@@ -158,6 +164,7 @@ export async function loadSiteData(options) {
                 assets: config.releaseAssets ? (latestRelease?.assets ?? []) : [],
                 configured: config.downloads,
                 components: config.components,
+                records,
                 flathub: config.flathub,
                 flathubSize,
                 webAppUrl: config.webApp ? `${config.base}${config.webApp.replace(/^\//, '')}` : undefined,

package/lib/site-data/types.d.ts

@@ -223,6 +223,8 @@ export interface SiteConfig extends SiteCommonConfig {
     releaseAssets: boolean;
     /** Sites of other apps to list under "More apps by <developer>", in order. Empty: no section. */
     relatedApps: SiteRelatedAppConfig[];
+    /** The developer's own site; the "by <developer>" line under the app name links to it. */
+    developerUrl?: string;
 }
 /**
  * One entry of the metainfo `<screenshots>` list, with its artwork located on disk. The same images
@@ -261,12 +263,23 @@ export interface DownloadTarget {
     downloadCount?: number;
     /** The one target to offer first for its OS. */
     recommended: boolean;
+    /**
+     * What the release record beside the asset proves (ADR 0124). Set on macOS and Windows release
+     * assets only — the two systems that stop an unsigned download; a store page or the web build
+     * has nothing to warn about. `unsigned` when no
+     * record exists or its hash does not match the asset, because a claim that cannot be checked is
+     * not shown.
+     */
+    signing?: Signing;
 }
+export type Signing = 'notarized' | 'signed' | 'unsigned';
 export interface ReleaseAsset {
     name: string;
     size: number;
     downloadUrl: string;
     downloadCount: number;
+    /** Lower-case hex SHA-256 GitHub computed on upload; absent on assets uploaded before it did. */
+    sha256?: string;
 }
 export interface LatestRelease {
     tag: string;

package/lib/site.js

@@ -163,6 +163,7 @@ async function writeBlog(config, out, pages) {
                 posts: blog.posts,
                 html,
                 author: { name: pages.author.name, url: pages.author.uri },
+                supportUrl: pages.supportUrl?.(lang),
             }));
             const card = ogCardSvg({ ...pages.card, name: post.title, summary: postDescription(post) });
             await writeFile(join(out, relative(postOgImage(config, post))), svgToPng(card));
@@ -273,6 +274,7 @@ async function buildAppSite(build) {
             card,
             iconUrl,
             ogImage: (lang) => `${data.config.base}og-${lang}.png`,
+            supportUrl: hasSupport ? (lang) => supportUrl(data, lang) : undefined,
         })));
     }
     await Promise.all(writeSitemap(data.config, target.out, pages, data.config.relatedApps));
@@ -358,6 +360,7 @@ async function buildDeveloperSite(config, build) {
             card,
             iconUrl: avatarUrl,
             ogImage: (lang) => `${config.base}og-${lang}.png`,
+            supportUrl: config.support.length > 0 ? (lang) => developerPageUrl({ data }, lang, 'support') : undefined,
         })));
     }
     await Promise.all(writeSitemap(config, target.out, pages, config.developer.apps));

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/site",
-    "version": "0.64.12-next.281",
+    "version": "0.64.12",
     "description": "Static landing page generator for a GNOME-style app, rendered from its AppStream metainfo — downloads, screenshots, release notes, support links, no JavaScript required.",
     "type": "module",
     "main": "lib/index.js",
@@ -54,26 +54,25 @@
     "license": "MIT",
     "dependencies": {
         "@girs/gdkpixbuf-2.0": "5.4.0",
-        "@gjsify/console": "0.64.12-next.281",
-        "@gjsify/crypto": "0.64.12-next.281",
-        "@gjsify/fs": "0.64.12-next.281",
-        "@gjsify/module": "0.64.12-next.281",
-        "@gjsify/os": "0.64.12-next.281",
-        "@gjsify/path": "0.64.12-next.281",
-        "@gjsify/process": "0.64.12-next.281",
-        "@gjsify/url": "0.64.12-next.281",
+        "@gjsify/console": "^0.64.12",
+        "@gjsify/crypto": "^0.64.12",
+        "@gjsify/fs": "^0.64.12",
+        "@gjsify/module": "^0.64.12",
+        "@gjsify/os": "^0.64.12",
+        "@gjsify/path": "^0.64.12",
+        "@gjsify/process": "^0.64.12",
+        "@gjsify/url": "^0.64.12",
         "fast-xml-parser": "^5.11.2",
         "qrcode-generator": "^2.0.4"
     },
     "devDependencies": {
-        "@gjsify/cli": "0.64.12-next.281",
+        "@gjsify/cli": "^0.64.12",
         "@gjsify/node-gi": "file:../../node-gi/node-gi",
-        "@gjsify/unit": "0.64.12-next.281",
+        "@gjsify/unit": "^0.64.12",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },
     "gjsify": {
         "tier": 2
-    },
-    "gitHead": "c4d2e266c0d9849860b9828c14ebfe37b6d493b8"
+    }
 }

package/po/de.po

@@ -30,6 +30,12 @@ msgstr "In dieser Sprache gibt es noch keine Beiträge."
 msgid "All posts"
 msgstr "Alle Beiträge"
 
+msgid "If this post was useful to you, you can support my work."
+msgstr "Wenn dir dieser Beitrag geholfen hat, kannst du meine Arbeit unterstützen."
+
+msgid "Support my work"
+msgstr "Meine Arbeit unterstützen"
+
 msgid "From the blog"
 msgstr "Aus dem Blog"
 
@@ -39,9 +45,6 @@ msgstr "Lebenslauf"
 msgid "Apps"
 msgstr "Apps"
 
-msgid "Support my work"
-msgstr "Meine Arbeit unterstützen"
-
 msgid "Read my CV"
 msgstr "Zum Lebenslauf"
 
@@ -141,6 +144,18 @@ msgstr "Firefox"
 msgid "Chromium"
 msgstr "Chromium"
 
+msgid "macOS asks before opening an app Apple has not checked. Try to open it once, then choose System Settings → Privacy & Security → Open Anyway."
+msgstr "macOS fragt nach, bevor es eine App öffnet, die Apple nicht geprüft hat. Einmal öffnen, dann Systemeinstellungen → Datenschutz & Sicherheit → Dennoch öffnen wählen."
+
+msgid "Windows may warn about an unknown publisher. Choose More info → Run anyway."
+msgstr "Windows warnt eventuell vor einem unbekannten Herausgeber. Weitere Informationen → Trotzdem ausführen wählen."
+
+msgid "Not notarized"
+msgstr "Nicht notarisiert"
+
+msgid "Unsigned"
+msgstr "Nicht signiert"
+
 msgid "Install from Flathub"
 msgstr "Über Flathub installieren"
 

package/po/site.pot

@@ -29,6 +29,12 @@ msgstr ""
 msgid "All posts"
 msgstr ""
 
+msgid "If this post was useful to you, you can support my work."
+msgstr ""
+
+msgid "Support my work"
+msgstr ""
+
 msgid "From the blog"
 msgstr ""
 
@@ -38,9 +44,6 @@ msgstr ""
 msgid "Apps"
 msgstr ""
 
-msgid "Support my work"
-msgstr ""
-
 msgid "Read my CV"
 msgstr ""
 
@@ -140,6 +143,18 @@ msgstr ""
 msgid "Chromium"
 msgstr ""
 
+msgid "macOS asks before opening an app Apple has not checked. Try to open it once, then choose System Settings → Privacy & Security → Open Anyway."
+msgstr ""
+
+msgid "Windows may warn about an unknown publisher. Choose More info → Run anyway."
+msgstr ""
+
+msgid "Not notarized"
+msgstr ""
+
+msgid "Unsigned"
+msgstr ""
+
 msgid "Install from Flathub"
 msgstr ""