docs: log Aug 17 Sentinel check-in, file per-language checksums idea

TLS fingerprint fix (v0.3.7) checked in 17 days post-release: aggregate CLI Sentinel-rejection rate still ~21%, unchanged -- inconclusive given mixed-version population, revisit once 0.3.7+ dominates usage. New backlog item: per-language SHA256 checksums on product pages. Confirmed live that Microsoft's own download pages publish a static per-locale hash table for the current build, not reachable through any API call MSDL/CLI already makes. Since it only changes when a product ID is replaced, no scraper needed -- just copy it by hand at the same time a new product gets added to the catalog. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(frontend): Windows 10 lifecycle text/badge were stale (dated Oct 2025, now Aug 2026)
2026-08-17 23:52:21 +05:30 · 2026-08-17 23:28:21 +05:30 · 2026-07-31 13:14:34 +05:30 · 2026-07-31 13:12:38 +05:30 · 2026-07-31 12:49:31 +05:30 · 2026-07-31 12:29:08 +05:30
12 changed files with 71 additions and 36 deletions
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@ -74,7 +74,14 @@ jobs:
            ```
            (formula is `msdl-cli`, not `msdl` -- homebrew/core has an unrelated package named `msdl`; the installed command is still just `msdl`)

-            **macOS/Linux (no Homebrew):**
+            **Arch Linux (AUR):**
+            ```bash
+            yay -S msdl-bin
+            # or: paru -S msdl-bin
+            ```
+            [aur.archlinux.org/packages/msdl-bin](https://aur.archlinux.org/packages/msdl-bin)
+
+            **macOS/Linux (no Homebrew/AUR):**
            ```bash
            curl -fsSL https://api.msdl.tech-latest.com/install.sh | bash
            ```
@ -108,8 +115,15 @@ jobs:
            msdl --list                                       # list all products
            ```

+  submit-winget:
+    # wingetcreate is a native Windows tool (needs .NET 6 + VC++ Redistributable) --
+    # it is NOT published as a NuGet/dotnet-tool package, so it can only run on a
+    # windows-latest runner, not ubuntu-latest like the release job above.
+    needs: release
+    runs-on: windows-latest
+    steps:
      - name: Submit winget update
-        if: success()
+        shell: bash
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
@ -117,10 +131,10 @@ jobs:
            echo "WINGET_TOKEN not set, skipping winget update"
            exit 0
          fi
-          dotnet tool install --global wingetcreate
+          curl -L -o wingetcreate.exe https://github.com/microsoft/winget-create/releases/latest/download/wingetcreate.exe
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#cli/v}"
-          wingetcreate update starkSV.msdl \
+          ./wingetcreate.exe update starkSV.msdl \
            --version "$VERSION" \
            --urls "https://github.com/starkSV/windows-iso-downloader/releases/download/${{ github.ref_name }}/msdl-windows-amd64.exe" \
            --submit \
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -61,16 +61,33 @@ signal, since Go's stdlib `crypto/tls` doesn't look like any real browser, indep
 - [x] **Validate `product_id` in `/proxy`** — was passing unknown IDs straight through to a
      real Microsoft session attempt (found via a stray `product_id=2861`, never a real
      product, in the logs). Now rejected with 404 before any outbound call. (same PR, merged)
- [ ] **CLI TLS/HTTP2 fingerprint hardening** — swapped the CLI's transport from stdlib
+- [x] **CLI TLS/HTTP2 fingerprint hardening** — swapped the CLI's transport from stdlib
      `net/http` to `github.com/bogdanfinn/tls-client` (wraps `utls` with a maintained Chrome
-      profile). Verified functionally correct (real link fetched + contributed end-to-end),
-      but does NOT yet prove the fingerprint theory — the old client already succeeded ~80%
-      of the time. Need to watch the Sentinel-rejection-rate telemetry over a comparable
-      multi-day window post-merge. (feat/cli-tls-fingerprint-hardening, not yet merged)
+      profile). Shipped in `cli/v0.3.7` (merged, released 2026-07-31). **Checked in on
+      2026-08-17, 17 days post-release: inconclusive-to-negative.** Aggregate CLI
+      Sentinel-rejection rate is still ~21%, statistically unchanged from every pre-fix
+      checkpoint. Real caveat: mixed-version population (`0.3.6`: 1156 actions vs `0.3.7`: 493
+      in that window) means a `0.3.7`-only improvement could still be masked — `/metrics`
+      doesn't break the error down by CLI version, so this can't be fully isolated yet. Revisit
+      once `0.3.7`+ dominates usage share; if the aggregate still hasn't moved by then, treat
+      the fingerprint theory as disproven.
 - [ ] **`/needs-warming` community page** — proposed, not built. Surfaces products currently
      failing web users (active Sentinel/rate-limit lockdown, no cached/stale link available)
      with a one-click CLI command to fix it. See
      `docs/superpowers/specs/2026-07-13-needs-warming-design.md`.
+- [ ] **Per-language SHA256 checksums on product pages** — Microsoft's own download pages
+      (e.g. `/software-download/windows11`) publish a static hash table (one SHA256 per
+      locale) for the *current* ISO build, confirmed live via direct network inspection
+      2026-08-18. It's not in any API response MSDL/CLI call (`GetProductDownloadLinksBySku`
+      never includes a hash, confirmed against Microsoft's own live page too) — it's static
+      HTML on the Windows-version download page, tied to the product/build, not the session.
+      Since it only changes when a product ID is replaced (same trigger as adding a new
+      catalog entry), no scraper/refresh job needed: copy the hash table by hand at the same
+      time a new product ID is added, per the existing "Adding a new consumer Windows release"
+      steps in CONTRIBUTING.md. Open questions before building: where to store it
+      (`products.json` field vs. separate file), which languages to cover (all 38 vs. just
+      the popular ones), and where to surface it (collapsible "Verify your download" section
+      on the product page, mirroring Microsoft's own UX; maybe CLI output too).

 ### Known bugs / open issues

--- a/README.md
+++ b/README.md
@ -70,7 +70,14 @@ brew install msdl-cli
 ```
 (the formula is named `msdl-cli`, not `msdl` — `homebrew/core` already has an unrelated package called `msdl`; the installed command is still just `msdl`)

-**macOS / Linux (no Homebrew):**
+**Arch Linux (AUR):**
+```bash
+yay -S msdl-bin
+# or: paru -S msdl-bin
+```
+Package: [aur.archlinux.org/packages/msdl-bin](https://aur.archlinux.org/packages/msdl-bin). Source tracked here at [`aur/msdl-bin`](./aur/msdl-bin).
+
+**macOS / Linux (no Homebrew/AUR):**
 ```bash
 curl -fsSL https://api.msdl.tech-latest.com/install.sh | bash
 ```
@ -86,8 +93,6 @@ Auto-detects OS/arch (including Termux on Android) and installs the latest relea
 | Linux (x86_64) | `msdl-linux-amd64` | `msdl` |
 | Linux (ARM64, incl. Termux on Android) | `msdl-linux-arm64` | `msdl` |

-An AUR package (`msdl-bin`) is prepared but not yet published — Arch Linux disabled new AUR registrations after a [malware incident](https://itsfoss.com/news/arch-linux-aur-malware-flood/); see [`aur/msdl-bin`](./aur/msdl-bin) for status.
-
 ### Crowdsourced cache

 By default, each successful fetch is contributed back to the web app's cache — so the next visitor gets a cached link instead of hitting Microsoft cold. Contribution is a background POST to `/contribute`. No personal data is sent — only the product ID, SKU ID, and the raw Microsoft JSON response. To opt out:
--- a/aur/msdl-bin/.SRCINFO
+++ b/aur/msdl-bin/.SRCINFO
@ -1,6 +1,6 @@
 pkgbase = msdl-bin
 	pkgdesc = Download Windows ISO files directly from Microsoft's servers
-	pkgver = 0.3.6
+	pkgver = 0.3.7
 	pkgrel = 1
 	url = https://msdl.tech-latest.com
 	arch = x86_64
@ -8,9 +8,9 @@ pkgbase = msdl-bin
 	license = MIT
 	provides = msdl
 	conflicts = msdl
-	source_x86_64 = msdl-bin-0.3.6-x86_64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.6/msdl-linux-amd64
-	sha256sums_x86_64 = b88d3ac5a1896ae107fc51603d6c9287c2eb79906511cd11758e65e1cb41d6a0
-	source_aarch64 = msdl-bin-0.3.6-aarch64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.6/msdl-linux-arm64
-	sha256sums_aarch64 = 350a80ff5f2857fc88c2ee6be78bb5218f3623dfdeaa51a2d875bb6277f3ddd7
+	source_x86_64 = msdl-bin-0.3.7-x86_64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.7/msdl-linux-amd64
+	sha256sums_x86_64 = 4714f47044814733ca2e20ae8f64327ad0b71b912d6fe6f677f18c90b3a5f1c0
+	source_aarch64 = msdl-bin-0.3.7-aarch64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.7/msdl-linux-arm64
+	sha256sums_aarch64 = 9059678043de3995f67ddc3083badf674b572d9bba8e8118e511f57d1f80d3eb

 pkgname = msdl-bin
--- a/aur/msdl-bin/PKGBUILD
+++ b/aur/msdl-bin/PKGBUILD
@ -1,6 +1,6 @@
 # Maintainer: starkSV <shekharvaidya2@gmail.com>
 pkgname=msdl-bin
-pkgver=0.3.6
+pkgver=0.3.7
 pkgrel=1
 pkgdesc="Download Windows ISO files directly from Microsoft's servers"
 arch=('x86_64' 'aarch64')
@ -10,10 +10,10 @@ provides=('msdl')
 conflicts=('msdl')

 source_x86_64=("$pkgname-$pkgver-x86_64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv${pkgver}/msdl-linux-amd64")
-sha256sums_x86_64=('b88d3ac5a1896ae107fc51603d6c9287c2eb79906511cd11758e65e1cb41d6a0')
+sha256sums_x86_64=('4714f47044814733ca2e20ae8f64327ad0b71b912d6fe6f677f18c90b3a5f1c0')

 source_aarch64=("$pkgname-$pkgver-aarch64::https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv${pkgver}/msdl-linux-arm64")
-sha256sums_aarch64=('350a80ff5f2857fc88c2ee6be78bb5218f3623dfdeaa51a2d875bb6277f3ddd7')
+sha256sums_aarch64=('9059678043de3995f67ddc3083badf674b572d9bba8e8118e511f57d1f80d3eb')

 package() {
  install -Dm755 "$srcdir/$pkgname-$pkgver-$CARCH" "$pkgdir/usr/bin/msdl"
--- a/aur/msdl-bin/README.md
+++ b/aur/msdl-bin/README.md
@ -1,12 +1,11 @@
 # msdl-bin (AUR)

-> **⚠️ Publishing blocked as of 2026-07-13:** Arch Linux disabled new AUR account
-> registrations on 2026-06-15 after a malware campaign compromised 1,500+ AUR
-> packages across several waves. There's no announced reopening date. This
-> package is ready to publish (`PKGBUILD` + `.SRCINFO` below) the moment
-> registration reopens — check the [aur-general mailing list](https://lists.archlinux.org/mailman3/lists/aur-general.lists.archlinux.org/)
-> or [aur.archlinux.org](https://aur.archlinux.org/register/) periodically.
-> Until then, macOS/Linux users should use the [Homebrew tap](https://github.com/starkSV/homebrew-msdl) instead.
+> **✅ Registration reopened as of 2026-07-31:** Arch Linux disabled new AUR
+> account registrations on 2026-06-15 after a malware campaign compromised
+> 1,500+ AUR packages across several waves; registration is open again.
+> This package (`PKGBUILD` + `.SRCINFO` below) is ready to publish — see
+> "Publishing" below once an account + SSH key are set up at
+> [aur.archlinux.org](https://aur.archlinux.org/register/).

 `PKGBUILD` and `.SRCINFO` for the [msdl-bin](https://aur.archlinux.org/packages/msdl-bin) AUR package, tracked here so version bumps have the same history/review as the winget manifests.

--- a/backend/main.go
+++ b/backend/main.go
@ -43,7 +43,7 @@ const (
 	CUSTOMER_ID = "560dc9f3-1aa5-4a2f-b63c-9e18f8d0e175"
 	PORT        = ":3002"

-	latestCLIVersion = "0.3.6"
+	latestCLIVersion = "0.3.7"
 )

 // --- Session cache (short-lived, used to chain /skuinfo → /proxy) ---
--- a/frontend/public/data/products.json
+++ b/frontend/public/data/products.json
@ -12,7 +12,7 @@
    },
    "2378": {
        "name": "Windows 10 22H2 Home China (19045.2006)",
-        "badge": "EOL SOON",
+        "badge": "EOL",
        "archs": [
            "x64"
        ],
@ -22,7 +22,7 @@
    },
    "2618": {
        "name": "Windows 10 22H2 v1 (19045.2965)",
-        "badge": "EOL SOON",
+        "badge": "EOL",
        "archs": [
            "x64",
            "x86"
--- a/frontend/src/pages/HomePage.tsx
+++ b/frontend/src/pages/HomePage.tsx
@ -35,7 +35,7 @@ const featured = [
    name: 'Windows 10',
    version: '22H2',
    build: '19045.2965',
-    description: 'The final Windows 10 feature update. Security support until October 2025.',
+    description: 'The final Windows 10 feature update. Support ended Oct 2025; ESU through Oct 2026.',
    badge: 'eol' as const,
    archs: ['x64', 'x86'],
  },
--- a/winget/manifests/starkSV.msdl.installer.yaml
+++ b/winget/manifests/starkSV.msdl.installer.yaml
@ -1,5 +1,5 @@
 PackageIdentifier: starkSV.msdl
-PackageVersion: 0.3.6
+PackageVersion: 0.3.7
 Platform:
  - Windows.Desktop
 MinimumOSVersion: 10.0.0.0
@ -8,7 +8,7 @@ Commands:
  - msdl
 Installers:
  - Architecture: x64
-    InstallerUrl: https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.6/msdl-windows-amd64.exe
-    InstallerSha256: 663690BCD5E95C91BA4E32171D243D9BD7C173E916332CDFF9EA16764F6DE6DA
+    InstallerUrl: https://github.com/starkSV/windows-iso-downloader/releases/download/cli%2Fv0.3.7/msdl-windows-amd64.exe
+    InstallerSha256: 44E9225BFE12DCE801301C2A68CBC114F57BA3313F775740BFC9A83CD87A431F
 ManifestType: installer
 ManifestVersion: 1.6.0
--- a/winget/manifests/starkSV.msdl.locale.en-US.yaml
+++ b/winget/manifests/starkSV.msdl.locale.en-US.yaml
@ -1,5 +1,5 @@
 PackageIdentifier: starkSV.msdl
-PackageVersion: 0.3.6
+PackageVersion: 0.3.7
 PackageLocale: en-US
 Publisher: starkSV
 PublisherUrl: https://github.com/starkSV
--- a/winget/manifests/starkSV.msdl.yaml
+++ b/winget/manifests/starkSV.msdl.yaml
@ -1,5 +1,5 @@
 PackageIdentifier: starkSV.msdl
-PackageVersion: 0.3.6
+PackageVersion: 0.3.7
 DefaultLocale: en-US
 ManifestType: version
 ManifestVersion: 1.6.0
Author	SHA1	Message	Date
Shekhar Vaidya	fba4502055	docs: log Aug 17 Sentinel check-in, file per-language checksums idea TLS fingerprint fix (v0.3.7) checked in 17 days post-release: aggregate CLI Sentinel-rejection rate still ~21%, unchanged -- inconclusive given mixed-version population, revisit once 0.3.7+ dominates usage. New backlog item: per-language SHA256 checksums on product pages. Confirmed live that Microsoft's own download pages publish a static per-locale hash table for the current build, not reachable through any API call MSDL/CLI already makes. Since it only changes when a product ID is replaced, no scraper needed -- just copy it by hand at the same time a new product gets added to the catalog. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-17 23:52:21 +05:30
Shekhar Vaidya	d562bf8d0e	fix(frontend): Windows 10 lifecycle text/badge were stale (dated Oct 2025, now Aug 2026) Homepage's featured card said "Security support until October 2025" -- that date has already passed, so it read as a future deadline that wasn't. Updated to reflect actual status (mainstream support ended, consumer ESU runs through Oct 2026) -- kept tight to match the other three cards' description length so the grid stays even (the first draft ran long enough to wrap to 3 lines and grow that one card's height past its siblings). Also found products.json still tagged both Windows 10 22H2 variants (2618, 2378) as "EOL SOON" -- inconsistent with the homepage's own "EOL"/"END OF LIFE" badge for the same product, and equally stale for the same reason. products.json's badge field renders verbatim on the product detail page, so this was live and user-facing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-17 23:28:21 +05:30
Shekhar Vaidya	f6659fcc42	docs(ci): add AUR install method to release notes template Now that msdl-bin is actually published on AUR, future releases' auto-generated "What's New" -> Install section should mention it too, matching what's already in README.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-31 13:14:34 +05:30
Shekhar Vaidya	34e2b35486	docs: msdl-bin is published on AUR now, not just prepared README still said the AUR package was "prepared but not yet published" -- it went live today (msdl-bin 0.3.7-1, now that AUR registration reopened). Added it as a proper install method alongside winget/Homebrew, matching their existing formatting. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-31 13:12:38 +05:30
Shekhar Vaidya	f27e2931b4	chore(aur): bump msdl-bin to v0.3.7, note AUR registration reopened .SRCINFO regenerated with real makepkg this time (Docker was running), confirming the same values as the manual field-mapping used previously. AUR disabled new account registrations 2026-06-15 after a malware campaign; reopened as of today. Updated the README note accordingly -- this package is ready to actually publish once an account + SSH key are set up, which is a manual step only the maintainer can do. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-31 12:49:31 +05:30
Shekhar Vaidya	33f3a46777	chore(release): bump to v0.3.7 -- backend version string + winget manifests; fix(ci): winget submission needs a Windows runner Version bump: backend/main.go latestCLIVersion and the local winget/manifests/*.yaml mirror to 0.3.7, with the real InstallerUrl/InstallerSha256 for the cli/v0.3.7 release asset. CI fix: the first real winget-submission attempt (v0.3.7, now that WINGET_TOKEN is finally set) failed immediately -- wingetcreate isn't published as a NuGet/dotnet-tool package at all, it's a native Windows binary requiring .NET 6 + VC++ Redistributable. `dotnet tool install --global wingetcreate` on ubuntu-latest could never have worked; this path was just never exercised before since the empty-token check always short-circuited it first. Split winget submission into its own job on windows-latest, downloading wingetcreate.exe directly from its GitHub release instead of dotnet tool install. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-31 12:29:08 +05:30