v2.1

.github/workflows/release.yml

@@ -55,6 +55,20 @@ jobs:
             - **Windows**: `*-setup.exe` (installer) or `.msi`
             - **macOS**: `.dmg` — unsigned build: on first launch, right-click the app → Open
             - **Linux**: `.AppImage` (portable, `chmod +x` then run), `.deb` or `.rpm`
+
+            ### Verify your download (optional)
+            `SHA256SUMS` lists the hash of every file above and is signed with the author's [minisign](https://jedisct1.github.io/minisign/) key:
+
+            ```
+            RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O
+            ```
+
+            1. Signature — proves the hash list comes from the author:
+               `minisign -Vm SHA256SUMS -P RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O`
+            2. Hashes — proves your file was not altered:
+               - Linux: `sha256sum --check SHA256SUMS --ignore-missing`
+               - macOS: `shasum -a 256 --check SHA256SUMS --ignore-missing`
+               - Windows: `(Get-FileHash .\<file>).Hash` must match the file's line in `SHA256SUMS`
           releaseDraft: true
           prerelease: false
           args: ${{ matrix.args }}

README.md

@@ -29,9 +29,48 @@ Grab the latest installer from the [Releases](https://github.com/LoicPandul/Imag
 - The ICC color profile is deliberately kept. It contains no personal information (it is a generic file shipped with your camera or screen), and removing it would visibly shift the colors of wide-gamut images.
 - To guarantee a precise weight, give a maximum size in KB: the app searches for the best quality that fits, and only downscales as a last resort. Lossy PNG relies on built-in palette quantization, so there is no external tool to install.
 - The EXIF orientation is applied before the metadata is stripped, so rotated phone photos come out upright.
+- Optional background removal on your machine: an AI model (ISNet) cuts the subject out and the background becomes transparent, for WEBP and PNG targets. Off by default; the first activation downloads the model and its runtime once (~250 MB, checksum-verified), then it runs fully offline. Images never leave your computer.
 - Every file is processed on its own CPU core.
 - Existing files are never overwritten (a numbered suffix is added instead), and an original is only deleted once its replacement is fully written.
-- Native on Windows, macOS and Linux: a few MB, instant startup, zero network access.
+- Native on Windows, macOS and Linux: a few MB, instant startup. The app never touches the network, with one exception: the explicit background-removal download above.
+
+## Verify your download
+
+Each release ships a `SHA256SUMS` manifest signed with the author's [minisign](https://jedisct1.github.io/minisign/) key. The public key is:
+
+```
+RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O
+```
+
+Download `SHA256SUMS` and `SHA256SUMS.minisig` into the same folder as your installer, then run the two checks for your platform: the signature proves the hash list comes from the author, the hash proves your file was not altered.
+
+### Windows (PowerShell)
+
+Get `minisign.exe` from the [official releases](https://github.com/jedisct1/minisign/releases) (win64 zip, `x86_64` folder).
+
+```powershell
+minisign -Vm SHA256SUMS -P RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O
+
+$file = "ImagesConverter_2.1.0_x64-setup.exe"   # the file you downloaded
+$hash = (Get-FileHash $file).Hash.ToLower()
+if (Select-String -Quiet -SimpleMatch "$hash  $file" SHA256SUMS) { "OK: $file matches" } else { "MISMATCH - do not run this file" }
+```
+
+### macOS
+
+```sh
+brew install minisign
+minisign -Vm SHA256SUMS -P RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O
+shasum -a 256 --check SHA256SUMS --ignore-missing
+```
+
+### Linux
+
+```sh
+sudo apt install minisign   # or your distribution's equivalent
+minisign -Vm SHA256SUMS -P RWTz3c4gUmglCX5Uvjthigz1ts3TS3ZSdhRNpFgOJRW/Wr4XjGlqTR3O
+sha256sum --check SHA256SUMS --ignore-missing
+```
 
 ## Build from source
 

scripts/sign-release.ps1

@@ -0,0 +1,36 @@
+# Sign a release with minisign: download its artifacts, hash them into a
+# SHA256SUMS manifest, sign the manifest, upload both files back.
+# The secret key never leaves this machine — CI only ever builds.
+#
+# Usage:  pwsh scripts/sign-release.ps1 v2.1.0
+#         (works on the draft release before you click Publish)
+
+param([Parameter(Mandatory)][string]$Tag)
+$ErrorActionPreference = "Stop"
+
+if (-not (Get-Command minisign -ErrorAction SilentlyContinue)) {
+    throw "minisign not found - install it first (https://jedisct1.github.io/minisign/)"
+}
+
+$dir = Join-Path ([System.IO.Path]::GetTempPath()) "imagesconverter-sign-$Tag"
+if (Test-Path $dir) { Remove-Item -Recurse -Force $dir }
+New-Item -ItemType Directory $dir | Out-Null
+
+Write-Output "downloading $Tag artifacts..."
+gh release download $Tag --dir $dir
+
+# sha256sum -c compatible manifest: "<hash>  <name>", sorted, lowercase.
+$files = Get-ChildItem $dir -File | Where-Object { $_.Name -notlike "SHA256SUMS*" } | Sort-Object Name
+$manifest = ($files | ForEach-Object {
+    "{0}  {1}" -f (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower(), $_.Name
+}) -join "`n"
+$sums = Join-Path $dir "SHA256SUMS"
+[System.IO.File]::WriteAllText($sums, $manifest + "`n")
+
+Write-Output "signing (minisign will ask for your key password)..."
+minisign -Sm $sums -t "ImagesConverter $Tag"
+if ($LASTEXITCODE -ne 0) { throw "minisign failed" }
+
+gh release upload $Tag $sums "$sums.minisig" --clobber
+Write-Output "done: SHA256SUMS + SHA256SUMS.minisig attached to $Tag."
+Write-Output "review the draft on GitHub, then click Publish."