trustcheck 2.0.2__tar.gz → 2.0.4__tar.gz

trustcheck-2.0.4/.github/workflows/binary-security.yml

@@ -0,0 +1,218 @@
+name: Binary Security
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  windows-defender:
+    name: Windows Defender
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install package and binary tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build Windows executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test Windows executable
+        shell: pwsh
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          & $binary --version
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+          & $binary --help | Out-Null
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Locate Microsoft Defender CLI
+        id: defender
+        shell: pwsh
+        run: |
+          $platformRoot = Join-Path $env:ProgramData "Microsoft\Windows Defender\Platform"
+          $candidates = @()
+          if (Test-Path $platformRoot) {
+            $candidates += Get-ChildItem -Path $platformRoot -Directory |
+              Sort-Object Name -Descending |
+              ForEach-Object { Join-Path $_.FullName "MpCmdRun.exe" }
+          }
+          $candidates += Join-Path $env:ProgramFiles "Windows Defender\MpCmdRun.exe"
+          $defender = $candidates |
+            Where-Object { Test-Path $_ } |
+            Select-Object -First 1
+          if (-not $defender) {
+            throw "MpCmdRun.exe was not found on the Windows runner."
+          }
+          "path=$defender" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          Write-Host "Using Microsoft Defender CLI: $defender"
+
+      - name: Verify Microsoft Defender is enabled
+        shell: pwsh
+        run: |
+          Set-Service -Name wuauserv -StartupType Manual
+          Start-Service -Name wuauserv
+          $status = Get-MpComputerStatus
+          $status |
+            Select-Object AMServiceEnabled, AntivirusEnabled, AntivirusSignatureVersion |
+            Format-List |
+            Out-File defender-status.txt
+          Get-Content defender-status.txt
+          if (-not $status.AMServiceEnabled -or -not $status.AntivirusEnabled) {
+            throw "Microsoft Defender Antivirus is not enabled on the runner."
+          }
+
+      - name: Update Microsoft Defender signatures
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+        run: |
+          "Microsoft Defender signature update" |
+            Set-Content -Path defender-signature-update.txt
+          $output = & $env:DEFENDER_CLI -SignatureUpdate 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-signature-update.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender signature update failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Scan executable with Microsoft Defender
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          "Microsoft Defender custom scan: $binary" |
+            Set-Content -Path defender-scan.txt
+          $output = & $env:DEFENDER_CLI `
+            -Scan `
+            -ScanType 3 `
+            -File $binary `
+            -DisableRemediation 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-scan.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender scan failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Generate Windows executable checksum
+        shell: pwsh
+        run: |
+          Get-FileHash "dist\standalone\trustcheck.exe" -Algorithm SHA256 |
+            Format-List |
+            Out-File "dist\standalone\trustcheck.exe.sha256.txt"
+
+      - name: Upload Microsoft Defender reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-defender-reports-${{ github.sha }}
+          path: defender-*.txt
+          if-no-files-found: warn
+
+      - name: Upload clean Windows executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: trustcheck-windows-${{ github.sha }}
+          path: |
+            dist/standalone/trustcheck.exe
+            dist/standalone/trustcheck.exe.sha256.txt
+          if-no-files-found: error
+
+  linux-clamav:
+    name: ClamAV
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install package and binary tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build Linux executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test Linux executable
+        run: |
+          test -x dist/standalone/trustcheck
+          dist/standalone/trustcheck --version
+          dist/standalone/trustcheck --help > /dev/null
+
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes clamav
+
+      - name: Update ClamAV signatures
+        run: |
+          sudo systemctl stop clamav-freshclam.service 2>/dev/null || true
+          sudo freshclam --verbose | tee clamav-signature-update.txt
+
+      - name: Scan executable with ClamAV
+        run: |
+          set +e
+          clamscan \
+            --official-db-only=yes \
+            --verbose \
+            --log=clamav-scan.txt \
+            dist/standalone/trustcheck
+          scan_status=$?
+          set -e
+          cat clamav-scan.txt
+          if [ "$scan_status" -ne 0 ]; then
+            echo "ClamAV scan failed with exit code ${scan_status}." >&2
+            exit "$scan_status"
+          fi
+
+      - name: Generate Linux executable checksum
+        run: sha256sum dist/standalone/trustcheck > dist/standalone/trustcheck.sha256
+
+      - name: Upload ClamAV reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: linux-clamav-reports-${{ github.sha }}
+          path: clamav-*.txt
+          if-no-files-found: warn
+
+      - name: Upload clean Linux executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: trustcheck-linux-${{ github.sha }}
+          path: |
+            dist/standalone/trustcheck
+            dist/standalone/trustcheck.sha256
+          if-no-files-found: error

{trustcheck-2.0.2 → trustcheck-2.0.4}/.github/workflows/publish.yml

@@ -86,8 +86,8 @@ jobs:
       - name: Run type checks
         run: mypy src
 
-  test-matrix:
-    needs: verify-tag
+  matrix-build:
+    needs: qa
     strategy:
       fail-fast: false
       matrix:
@@ -159,9 +159,7 @@ jobs:
           python -m build --sdist --wheel --outdir "$archive_root/dist" "$archive_root"
 
   coverage-build:
-    needs:
-      - qa
-      - test-matrix
+    needs: matrix-build
     runs-on: ubuntu-latest
 
     steps:
@@ -235,10 +233,54 @@ jobs:
           name: dist-${{ github.sha }}
           path: dist/*
 
+  clam-av:
+    needs: coverage-build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: dist-${{ github.sha }}
+          path: dist
+
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes clamav
+
+      - name: Update ClamAV signatures
+        run: |
+          sudo systemctl stop clamav-freshclam.service 2>/dev/null || true
+          sudo freshclam --verbose | tee clamav-signature-update.txt
+
+      - name: Scan release build with ClamAV
+        run: |
+          set +e
+          clamscan \
+            --recursive \
+            --official-db-only=yes \
+            --verbose \
+            --log=clamav-scan.txt \
+            dist
+          scan_status=$?
+          set -e
+          cat clamav-scan.txt
+          if [ "$scan_status" -ne 0 ]; then
+            echo "ClamAV scan failed with exit code ${scan_status}." >&2
+            exit "$scan_status"
+          fi
+
+      - name: Upload ClamAV reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-clamav-reports-${{ github.sha }}
+          path: clamav-*.txt
+          if-no-files-found: warn
+
   snap-qa:
-    needs:
-      - qa
-      - test-matrix
+    needs: clam-av
     runs-on: ubuntu-latest
 
     steps:
@@ -310,6 +352,25 @@ jobs:
           export PATH="/snap/bin:$PATH"
           test "$(command -v trustcheck)" = "/snap/bin/trustcheck"
           trustcheck --help > /dev/null
+          trustcheck inspect sampleproject \
+            --version 4.0.0 \
+            --format json \
+            > snap-verification-report.json
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          payload = json.loads(
+              Path("snap-verification-report.json").read_text(encoding="utf-8")
+          )
+          report = payload["report"]
+          assert report["coverage"]["verified_files"] > 0, report["coverage"]
+          failures = report["diagnostics"]["artifact_failures"]
+          assert not any(
+              item["subcode"] == "unexpected_verification_error"
+              for item in failures
+          ), failures
+          PY
 
       - name: Generate snap checksum
         env:
@@ -330,10 +391,204 @@ jobs:
             ${{ steps.snapcraft.outputs.snap }}.sha256
           if-no-files-found: error
 
+  build-windows-executable:
+    needs: coverage-build
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out tagged commit
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install PyInstaller tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build standalone Windows executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test and name release executable
+        id: executable
+        shell: pwsh
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          $releaseVersion = $env:TAG_NAME.TrimStart("v")
+          $versionOutput = & $binary --version
+          if ($LASTEXITCODE -ne 0) {
+            throw "The standalone executable failed its version smoke test."
+          }
+          if (-not $versionOutput.StartsWith("trustcheck $releaseVersion ")) {
+            throw "Executable version '$versionOutput' does not match $releaseVersion."
+          }
+          & $binary --help | Out-Null
+          if ($LASTEXITCODE -ne 0) {
+            throw "The standalone executable failed its help smoke test."
+          }
+
+          New-Item -ItemType Directory -Force "release\windows" | Out-Null
+          $releaseName = "trustcheck-$releaseVersion-windows-x86_64.exe"
+          $releasePath = Join-Path "release\windows" $releaseName
+          Move-Item -LiteralPath $binary -Destination $releasePath
+          "path=$releasePath" >> $env:GITHUB_OUTPUT
+          "name=$releaseName" >> $env:GITHUB_OUTPUT
+
+      - name: Generate executable checksum
+        shell: pwsh
+        env:
+          EXECUTABLE_NAME: ${{ steps.executable.outputs.name }}
+          EXECUTABLE_PATH: ${{ steps.executable.outputs.path }}
+        run: |
+          $hash = (Get-FileHash $env:EXECUTABLE_PATH -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $env:EXECUTABLE_NAME" |
+            Set-Content -Encoding ascii "$env:EXECUTABLE_PATH.sha256"
+
+      - name: Attest executable build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: ${{ steps.executable.outputs.path }}
+
+      - name: Upload executable for Microsoft Defender scan
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-executable-unscanned-${{ github.sha }}
+          path: |
+            ${{ steps.executable.outputs.path }}
+            ${{ steps.executable.outputs.path }}.sha256
+          if-no-files-found: error
+
+  windows-defender-scan:
+    needs: build-windows-executable
+    runs-on: windows-latest
+
+    steps:
+      - name: Download built Windows executable
+        uses: actions/download-artifact@v8
+        with:
+          name: windows-executable-unscanned-${{ github.sha }}
+          path: windows-executable
+
+      - name: Locate built Windows executable
+        id: executable
+        shell: pwsh
+        run: |
+          $binary = Get-ChildItem -Path "windows-executable" -Filter "*.exe" -File |
+            Select-Object -First 1
+          if (-not $binary) {
+            throw "The Windows executable from the build job was not found."
+          }
+          "path=$($binary.FullName)" >> $env:GITHUB_OUTPUT
+          Write-Host "Scanning executable produced by the build job: $($binary.FullName)"
+
+      - name: Locate Microsoft Defender CLI
+        id: defender
+        shell: pwsh
+        run: |
+          $platformRoot = Join-Path $env:ProgramData "Microsoft\Windows Defender\Platform"
+          $candidates = @()
+          if (Test-Path $platformRoot) {
+            $candidates += Get-ChildItem -Path $platformRoot -Directory |
+              Sort-Object Name -Descending |
+              ForEach-Object { Join-Path $_.FullName "MpCmdRun.exe" }
+          }
+          $candidates += Join-Path $env:ProgramFiles "Windows Defender\MpCmdRun.exe"
+          $defender = $candidates |
+            Where-Object { Test-Path $_ } |
+            Select-Object -First 1
+          if (-not $defender) {
+            throw "MpCmdRun.exe was not found on the Windows runner."
+          }
+          "path=$defender" >> $env:GITHUB_OUTPUT
+          Write-Host "Using Microsoft Defender CLI: $defender"
+
+      - name: Verify Microsoft Defender is enabled
+        shell: pwsh
+        run: |
+          Set-Service -Name wuauserv -StartupType Manual
+          Start-Service -Name wuauserv
+          $status = Get-MpComputerStatus
+          $status |
+            Select-Object AMServiceEnabled, AntivirusEnabled, AntivirusSignatureVersion |
+            Format-List |
+            Out-File defender-status.txt
+          Get-Content defender-status.txt
+          if (-not $status.AMServiceEnabled -or -not $status.AntivirusEnabled) {
+            throw "Microsoft Defender Antivirus is not enabled on the runner."
+          }
+
+      - name: Update Microsoft Defender signatures
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+        run: |
+          "Microsoft Defender signature update" |
+            Set-Content -Path defender-signature-update.txt
+          $output = & $env:DEFENDER_CLI -SignatureUpdate 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-signature-update.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender signature update failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Scan built executable with Microsoft Defender
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+          EXECUTABLE_PATH: ${{ steps.executable.outputs.path }}
+        run: |
+          "Microsoft Defender custom scan: $env:EXECUTABLE_PATH" |
+            Set-Content -Path defender-scan.txt
+          $output = & $env:DEFENDER_CLI `
+            -Scan `
+            -ScanType 3 `
+            -File $env:EXECUTABLE_PATH `
+            -DisableRemediation 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-scan.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender scan failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Regenerate executable checksum after scan
+        shell: pwsh
+        env:
+          EXECUTABLE_PATH: ${{ steps.executable.outputs.path }}
+        run: |
+          $name = Split-Path -Leaf $env:EXECUTABLE_PATH
+          $hash = (Get-FileHash $env:EXECUTABLE_PATH -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $name" | Set-Content -Encoding ascii "$env:EXECUTABLE_PATH.sha256"
+
+      - name: Upload Microsoft Defender reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-defender-reports-${{ github.sha }}
+          path: defender-*.txt
+          if-no-files-found: warn
+
+      - name: Upload scanned Windows executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-executable-${{ github.sha }}
+          path: |
+            windows-executable/*.exe
+            windows-executable/*.exe.sha256
+          if-no-files-found: error
+
   publish-pypi:
-    needs:
-      - coverage-build
-      - snap-qa
+    needs: coverage-build
     runs-on: ubuntu-latest
 
     steps:
@@ -358,7 +613,6 @@ jobs:
   publish-github-action:
     needs:
       - coverage-build
-      - snap-qa
       - verify-tag
     runs-on: ubuntu-latest
 
@@ -378,12 +632,6 @@ jobs:
           name: dist-${{ github.sha }}
           path: dist
 
-      - name: Download verified snap
-        uses: actions/download-artifact@v8
-        with:
-          name: snap-${{ github.sha }}
-          path: snap-artifact
-
       - name: Create GitHub Release with generated notes
         uses: softprops/action-gh-release@v3
         with:
@@ -394,20 +642,19 @@ jobs:
           body: |
             Published from immutable commit `${{ github.sha }}`.
             The release workflow publishes PyPI, GitHub Action, and Snap Store
-            distributions in parallel after shared package and Snap QA.
+            distributions after shared tag verification, QA, matrix, and coverage builds.
 
             Release artifacts:
             - `dist/*`
             - `dist/SHA256SUMS.txt`
             - `dist/trustcheck-sbom.json`
-            - verified `trustcheck_*.snap` with checksum
+            - standalone `trustcheck-*-windows-x86_64.exe` with checksum
 
             GitHub Action:
             - Immutable: `uses: Halfblood-Prince/trustcheck@${{ github.ref_name }}`
             - Compatible major: `uses: Halfblood-Prince/trustcheck@${{ needs['verify-tag'].outputs.action_major_tag }}`
           files: |
             dist/*
-            snap-artifact/*
 
       - name: Publish moving major action tag
         env:
@@ -463,10 +710,31 @@ jobs:
             echo "[Edit ${RELEASE_TAG} and select **Publish this Action to the GitHub Marketplace**](https://github.com/${GITHUB_REPOSITORY}/releases/edit/${RELEASE_TAG})."
           } >> "$GITHUB_STEP_SUMMARY"
 
-  publish-snap:
+  upload-windows-executable:
     needs:
-      - coverage-build
-      - snap-qa
+      - windows-defender-scan
+      - publish-github-action
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download Windows executable
+        uses: actions/download-artifact@v8
+        with:
+          name: windows-executable-${{ github.sha }}
+          path: windows-executable
+
+      - name: Attach executable to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          gh release upload "$RELEASE_TAG" \
+            windows-executable/* \
+            --clobber \
+            --repo "$GITHUB_REPOSITORY"
+
+  publish-snap:
+    needs: snap-qa
     runs-on: ubuntu-latest
 
     steps:

{trustcheck-2.0.2 → trustcheck-2.0.4}/CHANGELOG.md

@@ -31,6 +31,11 @@ The project follows Semantic Versioning for the supported public API described i
 - Renamed the reusable GitHub Action and Marketplace display name to `TrustCheck Package Scanner`.
 - Expanded the Snap Store listing with richer feature copy, quick-start examples, project links, and a dedicated storefront icon.
 - Updated Snap release smoke tests and installation documentation to verify the public `trustcheck` command and diagnose shells where `/snap/bin` is missing from `PATH`.
+- Redirected Sigstore XDG data, cache, and configuration into writable Snap-owned storage, fixing errno 13 provenance verification failures under strict confinement.
+- Expanded Snap release QA to perform live verified-provenance inspection from the installed snap and reject unexpected verification errors.
+- Added a push-triggered binary security workflow that builds standalone Windows and Linux executables with PyInstaller.
+- Added a parallel release job that builds, smoke-tests, checksums, and attests a versioned Windows executable, then attaches it to the GitHub release.
+- Added Microsoft Defender CLI and ClamAV scanning, retained scan reports, clean binary artifacts, checksums, and independent README check-run badges.
 
 ## [1.9.0] - 2026-06-09
 

{trustcheck-2.0.2 → trustcheck-2.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.0.2
+Version: 2.0.4
 Summary: Package trust and provenance verification for PyPI consumers.
 License: Trustcheck Personal Use License
         
@@ -113,13 +113,15 @@ Dynamic: license-file
 [![pip-audit](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=pip-audit)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Bandit](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml)
 [![Semgrep](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml)
+[![Windows Defender](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=Windows%20Defender&label=Windows%20Defender&logo=windows11)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
+[![ClamAV](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=ClamAV&label=ClamAV&logo=linux)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
 [![Ruff](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=ruff)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![mypy](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=mypy)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Coverage](docs/assets/images/coverage.svg)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/trustcheck.svg)](https://pypi.org/project/trustcheck/)
 [![Python 3.10 | 3.11 | 3.12 | 3.13 | 3.14](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13%20%7C%203.14-blue.svg)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![PyPI Downloads](https://static.pepy.tech/personalized-badge/trustcheck?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=GREEN&left_text=downloads)](https://pepy.tech/projects/trustcheck)
-[![TrustCheck Package Scanner](https://img.shields.io/badge/GitHub%20Action-TrustCheck%20Package%20Scanner-blue?logo=githubactions&logoColor=white)](https://github.com/Halfblood-Prince/trustcheck/blob/main/action.yml)
+[![TrustCheck Package Scanner](https://img.shields.io/badge/GitHub%20Action-TrustCheck%20Package%20Scanner-blue?logo=githubactions&logoColor=white)](https://github.com/marketplace/actions/trustcheck-package-scanner)
 
 `trustcheck` is a Python package and CLI for evaluating the trust posture of PyPI releases before they are installed, promoted, or approved.
 
@@ -140,6 +142,12 @@ For a selected package version, `trustcheck` can:
 - optionally inspect wheel and sdist contents without importing or executing package code
 - emit concise text output or structured JSON for automation
 
+Every push also builds standalone Windows and Linux executables. The Windows
+artifact is scanned with Microsoft Defender's `MpCmdRun.exe`; the Linux
+artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
+are retained as workflow artifacts by
+[Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
+
 ## Installation
 
 Install from PyPI:
@@ -318,7 +326,7 @@ Full documentation: https://halfblood-prince.github.io/trustcheck/
 - Integrations: [JSON contract](https://halfblood-prince.github.io/trustcheck/reference/json-contract/), [Python API](https://halfblood-prince.github.io/trustcheck/reference/python-api/), and [Compatibility](https://halfblood-prince.github.io/trustcheck/reference/compatibility/)
 - Trust model: [Verification model and repository matching](https://halfblood-prince.github.io/trustcheck/reference/trust-model/)
 - Automation: [CI integration](https://halfblood-prince.github.io/trustcheck/guides/ci-integration/)
-- Project details: [Development and release process](https://halfblood-prince.github.io/trustcheck/guides/development/), [release publishing](https://halfblood-prince.github.io/trustcheck/guides/release-publishing/), and [Changelog](https://halfblood-prince.github.io/trustcheck/changelog/)
+- Project details: [Changelog](https://halfblood-prince.github.io/trustcheck/changelog/)
 
 Project support: