From 9f5685b85f6728ebe3403bc85b4088a72b0ae5e5 Mon Sep 17 00:00:00 2001 From: HelloThisWorld Date: Tue, 28 Jul 2026 21:33:07 +0800 Subject: [PATCH 1/2] docs: add canonical code signing policy and SignPath readiness - Add CODE_SIGNING_POLICY.md with the SignPath attribution sentence, roles, manual-approval requirement, build provenance, artifact ownership boundaries, and the honest current unsigned status; link it and the status from the README code signing section. - Add .github/CODEOWNERS covering workflows, release/build/packaging scripts, version and branding metadata, and policy documents. - Extend CONTRIBUTING.md with the external-contribution review policy for CI, workflows, build scripts, packaging, dependency downloads, and signing configuration. - Make PRIVACY.md wording version-neutral and point SUPPORT.md at the latest official Release instead of a hard-coded stable version. - Add docs/signing/signpath-readiness.md separating completed, externally verified, manual, and blocked items, including the upstream-fork-visibility application blocker and the published-1.1.3 binary metadata gap. --- .github/CODEOWNERS | 30 ++++++++ CODE_SIGNING_POLICY.md | 76 ++++++++++++++++++++ CONTRIBUTING.md | 12 ++++ PRIVACY.md | 4 +- README.md | 8 ++- SUPPORT.md | 4 +- docs/signing/signpath-readiness.md | 108 +++++++++++++++++++++++++++++ 7 files changed, 237 insertions(+), 5 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 CODE_SIGNING_POLICY.md create mode 100644 docs/signing/signpath-readiness.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000..fc7109a8d --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,30 @@ +# Require maintainer review for build, release, signing, and policy surfaces. +# CODEOWNERS is enforced only when branch protection requires code owner +# reviews; see docs/signing/signpath-readiness.md for the server-side status. + +* @HelloThisWorld + +# CI and automation +/.github/ @HelloThisWorld + +# Build, packaging, installer, and release engineering +/scripts/winterm/ @HelloThisWorld +/build/ @HelloThisWorld +/packaging/ @HelloThisWorld +/custom.props @HelloThisWorld +/Directory.Build.props @HelloThisWorld +/Directory.Build.targets @HelloThisWorld + +# Version, branding, and release metadata +/src/winterm/Branding/ @HelloThisWorld +/src/winterm-tools/ @HelloThisWorld + +# Policies +/CODE_SIGNING_POLICY.md @HelloThisWorld +/PRIVACY.md @HelloThisWorld +/SECURITY.md @HelloThisWorld +/SUPPORT.md @HelloThisWorld +/LICENSE @HelloThisWorld +/NOTICE.md @HelloThisWorld +/THIRD_PARTY_NOTICES.md @HelloThisWorld +/docs/signing/ @HelloThisWorld diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md new file mode 100644 index 000000000..1d3017a2a --- /dev/null +++ b/CODE_SIGNING_POLICY.md @@ -0,0 +1,76 @@ +# winTerm code signing policy + +Free code signing provided by SignPath.io, certificate by SignPath Foundation. + +This document is the canonical winTerm code signing policy. The website copy at + mirrors it; if they disagree, this +repository is authoritative. + +## Current signing status + +The latest public release, winTerm 1.1.3, is **not Authenticode-signed**. The +SignPath Foundation certificate has not been issued for this project, and no +signed winTerm binaries exist yet. Windows may display Unknown Publisher or a +SmartScreen warning for the current Setup EXE. Verify every download against +`SHA256SUMS.txt` from the same official +[GitHub Release](https://github.com/HelloThisWorld/winTerm/releases/latest). +This section changes only after a downloaded release artifact passes +Authenticode verification. + +## Roles + +- Authors and committers: [HelloThisWorld](https://github.com/HelloThisWorld) +- Reviewers: [HelloThisWorld](https://github.com/HelloThisWorld) +- Approvers: [HelloThisWorld](https://github.com/HelloThisWorld) + +Changes from external contributors are accepted only through pull requests +reviewed by a maintainer. Review explicitly covers source code, CI +configuration, GitHub Actions workflows, build and packaging scripts, +dependency downloads, and signing-related configuration. See +[CONTRIBUTING.md](CONTRIBUTING.md). + +## Build provenance + +Official winTerm releases are built from this public repository by GitHub +Actions on GitHub-hosted runners, starting from an immutable release tag that +must match `src/winterm/Branding/version.json`. Release assets are published +with SHA-256 checksums, SBOMs, and GitHub artifact attestations, and every +Draft Release asset is re-downloaded and verified before publication. See +[.github/workflows/release.yml](.github/workflows/release.yml) and +[docs/release-process.md](docs/release-process.md). + +## Release signing approval + +Every release signing request requires manual approval by an approver listed +above. No artifact outside the official release pipeline is signed. + +## Artifact scope and ownership + +winTerm is based on the Microsoft Terminal open-source codebase (pinned +baseline `release-1.25@1cea42d433253d95c4487a3037db48197b5e72f4`, see +[docs/upstream-sync.md](docs/upstream-sync.md)). For signing purposes: + +- **winTerm-owned binaries** built from `src/winterm-tools` and the branded + installer (`winTerm.exe` launcher, `winterm-shim.exe`, the Inno Setup EXE) + carry `ProductName` `winTerm` and version metadata derived from + `src/winterm/Branding/version.json`. +- **Modified upstream outputs** (`WindowsTerminal.exe`, `OpenConsole.exe`, + `Microsoft.Terminal.*.dll`, and related binaries) are compiled from this + repository's source tree, which modifies Microsoft Terminal under its MIT + license. +- **Third-party redistributables** (for example `Microsoft.UI.Xaml` and + Visual C++ runtime components) come from their upstream packages and are + not signed by this project. + +## Privacy + +See [PRIVACY.md](PRIVACY.md). winTerm does not collect command text, terminal +output, clipboard content, Workspace contents, working-directory paths, or +usage analytics. + +## Installation and removal + +[docs/user/installation.md](docs/user/installation.md) documents what the +installer changes on a system; [docs/user/uninstall.md](docs/user/uninstall.md) +documents standard removal, which does not touch Microsoft Windows Terminal, +`wt.exe`, WSL, PowerShell profiles, or global fonts. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 83479acd8..b0723ac37 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,3 +32,15 @@ Do not claim a build, package, architecture, signature, installer, or runtime te ## Pull requests Describe scope, tests, security and privacy impact, accessibility impact, package impact, schema impact, and known limitations. Release pull requests must link the current release checklist and record signing, architecture, install, upgrade, uninstall, and coexistence status. + +## External contributions and protected review areas + +Every change from an external contributor is accepted only through a pull request reviewed and approved by a maintainer listed in `CODE_SIGNING_POLICY.md`. Maintainer review must explicitly cover, in addition to the code itself: + +- CI configuration and every file under `.github/workflows/`; +- build, packaging, installer, and release scripts under `scripts/winterm/` and `build/`; +- anything that downloads a dependency, tool, or other build input, including pinned URLs, versions, and hashes; +- signing configuration, release metadata, and version/branding sources such as `src/winterm/Branding/`; +- the policy documents `CODE_SIGNING_POLICY.md`, `PRIVACY.md`, and `SECURITY.md`. + +Changes in these areas must never be merged on the strength of passing checks alone. diff --git a/PRIVACY.md b/PRIVACY.md index e6502d399..d2560f3d6 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -4,7 +4,7 @@ winTerm does not collect general usage analytics. It does not collect or upload ## Network and optional features -- **Update checks are off.** winTerm 1.0 contains no enabled update request path because explicit user consent is not yet implemented. A future opt-in request may contain only application version, architecture, release channel, and public release metadata. +- **Update checks are off.** Current winTerm releases contain no enabled update request path because explicit user consent is not yet implemented. A future opt-in request may contain only application version, architecture, release channel, and public release metadata. - **Crash-report upload is off by default** and remains opt-in. Local crash metadata is not uploaded unless the user explicitly chooses a reviewed, redacted report. - **Diagnostic bundles are created only when the user requests one.** They exclude terminal output, commands, clipboard data, environment variables, SSH configuration, full settings, raw Workspace files, full paths, tokens, email addresses, and connection strings by default. @@ -16,7 +16,7 @@ winTerm may store settings, named Workspaces, recovery snapshots, imported Theme ## User control -Diagnostic bundles are generated and shared by the user. Review a bundle before attaching it to a report. Crash upload, if introduced after 1.0, must remain disabled until the user opts in and must be independently reversible. +Diagnostic bundles are generated and shared by the user. Review a bundle before attaching it to a report. Crash upload, if introduced in a future release, must remain disabled until the user opts in and must be independently reversible. ## Removing local data diff --git a/README.md b/README.md index 59d234fa9..bed9a42ec 100644 --- a/README.md +++ b/README.md @@ -103,6 +103,8 @@ off and opt-in. See [PRIVACY.md](PRIVACY.md), [SECURITY.md](SECURITY.md), and Free code signing provided by SignPath.io, certificate by SignPath Foundation. +The canonical policy is [CODE_SIGNING_POLICY.md](CODE_SIGNING_POLICY.md). + ### Roles - Authors, committers, and reviewers: @@ -111,10 +113,14 @@ Free code signing provided by SignPath.io, certificate by SignPath Foundation. [HelloThisWorld](https://github.com/HelloThisWorld) Official release artifacts are built from this public repository using -GitHub Actions. +GitHub Actions on GitHub-hosted runners, from an immutable release tag. Every release signing request requires manual approval. +**Current status:** the latest public release is not Authenticode-signed; no +SignPath certificate has been issued yet. See +[CODE_SIGNING_POLICY.md](CODE_SIGNING_POLICY.md) for the authoritative status. + See [PRIVACY.md](PRIVACY.md) for the winTerm privacy policy. ## License and upstream diff --git a/SUPPORT.md b/SUPPORT.md index 8df78907f..4b1deb23a 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -2,13 +2,13 @@ ## Supported releases -The latest public Stable winTerm release is supported. A prerelease is supported for testing and feedback only. winTerm 1.0.2 is the current Stable release. +The latest public Stable winTerm release is supported. A prerelease is supported for testing and feedback only. The current Stable release is always the version published at the [latest official Release](https://github.com/HelloThisWorld/winTerm/releases/latest). ## Platforms and architectures - Windows 11 x64 is the intended fully supported platform after clean installation, upgrade, uninstall, and runtime validation pass. - Windows 11 ARM64 is unsupported unless an ARM64 asset is actually published with native build, install, and launch evidence. -- Windows 10 is unsupported for the winTerm 1.0 Stable commitment. +- Windows 10 is unsupported for the winTerm Stable commitment. ## Shells and feature levels diff --git a/docs/signing/signpath-readiness.md b/docs/signing/signpath-readiness.md new file mode 100644 index 000000000..ae7062efc --- /dev/null +++ b/docs/signing/signpath-readiness.md @@ -0,0 +1,108 @@ +# SignPath Foundation readiness + +Status of the winTerm application for free OSS code signing from SignPath +Foundation, audited 2026-07-28 against , +, +, and +. + +The latest public release is winTerm 1.1.3 (`v1.1.3`, +`winTerm-1.1.3-setup-x64.exe`, `winTerm-1.1.3-portable-x64.zip`, +`SHA256SUMS.txt`, SBOMs, `release-metadata.json`, GitHub attestations). The +Setup EXE is **not Authenticode-signed**. + +## Completed in this repository + +- Canonical [CODE_SIGNING_POLICY.md](../../CODE_SIGNING_POLICY.md) with the + exact SignPath attribution sentence, roles (Authors/Committers, Reviewers, + Approvers), manual-approval statement, build provenance, artifact + ownership boundaries, and the honest current unsigned status. +- README `Code signing policy` section visible on the repository homepage, + linking the canonical policy and stating the current unsigned status. +- [CONTRIBUTING.md](../../CONTRIBUTING.md) explicit external-contribution + review policy covering CI, workflows, build/packaging scripts, dependency + downloads, and signing configuration. +- [.github/CODEOWNERS](../../.github/CODEOWNERS) covering workflows, release + scripts, packaging, version/branding metadata, and policy documents. +- [PRIVACY.md](../../PRIVACY.md) version-neutral wording; validated by + `scripts/winterm/test-privacy.ps1` (no analytics, no update requests, crash + upload off/opt-in, diagnostics user-initiated, uninstall data behavior). +- Release workflow ([.github/workflows/release.yml](../../.github/workflows/release.yml)) + builds from an immutable tag that must match + `src/winterm/Branding/version.json`, exclusively on GitHub-hosted + runners, with a pinned and signature-verified Inno Setup toolchain, an + exact release-asset allowlist, SHA-256 checksums, SPDX + CycloneDX SBOMs, + GitHub artifact attestations, and re-download verification before and + after publication. +- `winterm-shim.rc` version resources aligned with the canonical version + metadata (1.1.3), and `scripts/winterm/verify-version.ps1` now fails on any + future `winTerm.exe`/`winterm-shim.exe` version-resource drift. +- `scripts/winterm/generate-release-artifacts.ps1` no longer duplicates the + Signing section (the guard now recognizes "not Authenticode-signed") and + ensures every future Release body links the Code signing policy and the + Privacy policy. +- Release notes source `docs/releases/1.1.3.md` carries the Signing section + and policy links. +- Website (separate `winterm-site` repository): + `Code signing policy` link on the homepage download area and footer, the + policy page with the exact attribution sentence, roles, manual approval, + current unsigned status, and privacy/installation/uninstall links. + +## Verified externally (rechecked 2026-07-28) + +- Latest public Release `v1.1.3` exists with the expected asset list and is + explicitly unsigned in its notes. +- The published v1.1.3 Release body currently duplicates the Signing + section; a corrected body (single Signing section plus policy links) is + applied from `docs/releases/1.1.3.md` without touching the tag or assets. +- Repository metadata: `HelloThisWorld/winTerm` is public, MIT-licensed, and + **not** marked as a GitHub fork (see Blocked). + +## Known gaps in already-published artifacts + +- The binaries inside the published v1.1.3 packages predate the shim + version-resource fix: `winTerm.exe` and `winterm-shim.exe` report + ProductVersion 1.0.0 / FileVersion 1.0.8.0, while `WindowsTerminal.exe` + correctly reports 1.1.3. Published release assets are immutable and are + not replaced; the next release will carry consistent metadata enforced by + `verify-version.ps1`. +- `OpenConsole.exe` and `elevate-shim.exe` are upstream-derived binaries + built without version resources. Decide before configuring SignPath + artifacts whether they are in signing scope; if so, they need version + resources in a future release. + +## Manual prerequisites (cannot be completed from this repository) + +- GitHub account MFA enabled for `HelloThisWorld`. +- SignPath account creation and MFA enabled. +- Submitting the SignPath Foundation application. +- Installing the SignPath GitHub App and granting it repository access. +- SignPath-side organization, project, artifact configuration, and signing + policies; configuring the manual approver. +- `SIGNPATH_API_TOKEN` (or equivalent) as a repository secret. Do not add + placeholder IDs, slugs, or tokens to workflows before the SignPath + configuration exists; the release workflow must keep succeeding unsigned + until then. +- GitHub server-side branch protection / rulesets requiring code-owner + review for the protected paths in `.github/CODEOWNERS`. +- After certificate issuance: integrate the SignPath step into + `release.yml` (artifacts uploaded via `actions/upload-artifact` before the + signing request), then re-verify Authenticode signature, product/version + metadata, hashes, and install/uninstall on the signed outputs before + publication. + +## Blocked / needs SignPath confirmation + +- **Upstream fork visibility (high priority).** winTerm is modified + Microsoft Terminal (pinned baseline + `release-1.25@1cea42d433253d95c4487a3037db48197b5e72f4`, integration + process in [docs/upstream-sync.md](../upstream-sync.md)), but the GitHub + repository is not a GitHub-visible fork of `microsoft/terminal` + (`fork: false`, no parent). SignPath's modified-upstream terms expect the + project to "visibly fork" upstream. Recreating the repository as a GitHub + fork or rewriting history is intentionally out of scope. Next step for the + maintainer: ask SignPath whether the pinned-baseline provenance documented + here and in `upstream-sync.md` satisfies the requirement, or whether a + visible-fork migration is required before approval. +- SignPath Foundation's subjective review of project reputation and + popularity. From c9ae9f5ef10e0872b800d43d7dd2acb2357a46aa Mon Sep 17 00:00:00 2001 From: HelloThisWorld Date: Tue, 28 Jul 2026 21:33:21 +0800 Subject: [PATCH 2/2] release: align shim version metadata and fix duplicate Signing section - Update winterm-shim.rc so winTerm.exe and winterm-shim.exe carry ProductVersion/FileVersion 1.1.3 from the canonical version metadata, and make verify-version.ps1 fail on any future shim version-resource drift. - Broaden the release-notes signing disclosure guard so an existing 'not Authenticode-signed' section is recognized; the narrower match previously appended a duplicate Signing section to the published v1.1.3 Release body. - Ensure every generated Release body links the Code signing policy and the Privacy policy, and add the Policies section to the 1.1.3 release notes source; update test-release-workflow.ps1 boundaries accordingly. --- docs/releases/1.1.3.md | 5 ++++ .../winterm/generate-release-artifacts.ps1 | 30 +++++++++++++++---- scripts/winterm/test-release-workflow.ps1 | 6 ++-- scripts/winterm/verify-version.ps1 | 7 +++++ .../winterm-shim/winterm-shim.rc | 8 ++--- 5 files changed, 45 insertions(+), 11 deletions(-) diff --git a/docs/releases/1.1.3.md b/docs/releases/1.1.3.md index a9248f710..04470cfe4 100644 --- a/docs/releases/1.1.3.md +++ b/docs/releases/1.1.3.md @@ -54,3 +54,8 @@ Publisher: `helloThisWorld`. Tag: `v1.1.3`. The v1.1.3 Setup EXE is not Authenticode-signed. Windows may display Unknown Publisher or a SmartScreen warning. Download only from the official GitHub Release and verify the file against `SHA256SUMS.txt` before running it. + +## Policies + +- [Code signing policy](https://github.com/HelloThisWorld/winTerm/blob/main/CODE_SIGNING_POLICY.md) +- [Privacy policy](https://github.com/HelloThisWorld/winTerm/blob/main/PRIVACY.md) diff --git a/scripts/winterm/generate-release-artifacts.ps1 b/scripts/winterm/generate-release-artifacts.ps1 index 2fa3fefc0..cd2cab4e3 100644 --- a/scripts/winterm/generate-release-artifacts.ps1 +++ b/scripts/winterm/generate-release-artifacts.ps1 @@ -96,14 +96,34 @@ function Ensure-ReleaseNotesSigningDisclosure ) $notes = Get-Content -LiteralPath $Path -Raw - if ($Status -eq 'unsigned' -and $notes -notmatch '(?i)unsigned|not code-signed') + $additions = @() + + # "unsigned", "not code-signed", and "not Authenticode-signed" all count as + # an existing disclosure; a narrower match here previously duplicated the + # Signing section on the published Release. + if ($Status -eq 'unsigned' -and $notes -notmatch '(?i)\bunsigned\b|not\s+(?:code|authenticode)[-\s]signed') { - $disclosure = @( + $additions += @( '## Signing' '' - 'The Setup EXE is not code-signed. Windows may display a SmartScreen warning; verify the downloaded file against `SHA256SUMS.txt` before running it.' - ) -join [Environment]::NewLine - $updatedNotes = $notes.TrimEnd() + [Environment]::NewLine + [Environment]::NewLine + $disclosure + [Environment]::NewLine + 'The Setup EXE is not Authenticode-signed. Windows may display Unknown Publisher or a SmartScreen warning; verify the downloaded file against `SHA256SUMS.txt` before running it.' + ) + } + + if ($notes -notmatch '(?i)code signing policy') + { + if ($additions.Count -gt 0) { $additions += '' } + $additions += @( + '## Policies' + '' + '- [Code signing policy](https://github.com/HelloThisWorld/winTerm/blob/main/CODE_SIGNING_POLICY.md)' + '- [Privacy policy](https://github.com/HelloThisWorld/winTerm/blob/main/PRIVACY.md)' + ) + } + + if ($additions.Count -gt 0) + { + $updatedNotes = $notes.TrimEnd() + [Environment]::NewLine + [Environment]::NewLine + ($additions -join [Environment]::NewLine) + [Environment]::NewLine [IO.File]::WriteAllText($Path, $updatedNotes, [Text.UTF8Encoding]::new($false)) } diff --git a/scripts/winterm/test-release-workflow.ps1 b/scripts/winterm/test-release-workflow.ps1 index 8a1fdd7d2..540af991f 100644 --- a/scripts/winterm/test-release-workflow.ps1 +++ b/scripts/winterm/test-release-workflow.ps1 @@ -72,8 +72,10 @@ try } foreach ($required in @( 'Ensure-ReleaseNotesSigningDisclosure', - 'The Setup EXE is not code-signed.', - 'SHA256SUMS.txt' + 'The Setup EXE is not Authenticode-signed.', + 'SHA256SUMS.txt', + 'Code signing policy', + 'Privacy policy' )) { if (-not $releaseGenerator.Contains($required)) diff --git a/scripts/winterm/verify-version.ps1 b/scripts/winterm/verify-version.ps1 index 4f0993a7d..5c96ded8c 100644 --- a/scripts/winterm/verify-version.ps1 +++ b/scripts/winterm/verify-version.ps1 @@ -101,6 +101,13 @@ try Assert-Condition ($hostResource.Contains("`"FileVersion`", `"$($version.packageVersion)\0`"")) 'Terminal host display file version matches release metadata' Assert-Condition ($hostResource.Contains("`"ProductVersion`", `"$($version.applicationVersion)\0`"")) 'Terminal host display product version matches release metadata' + $shimResource = Get-Text 'src\winterm-tools\winterm-shim\winterm-shim.rc' + Assert-Condition ($shimResource.Contains("FILEVERSION $packageVersionTuple")) 'Shim launcher file version matches release metadata' + Assert-Condition ($shimResource.Contains("PRODUCTVERSION $packageVersionTuple")) 'Shim launcher numeric product version matches release metadata' + Assert-Condition ($shimResource.Contains("`"FileVersion`", `"$($version.packageVersion)\0`"")) 'Shim launcher display file version matches release metadata' + Assert-Condition ($shimResource.Contains("`"ProductVersion`", `"$($version.applicationVersion)\0`"")) 'Shim launcher display product version matches release metadata' + Assert-Condition ($shimResource.Contains('"ProductName", "winTerm\0"')) 'Shim launcher product name is winTerm' + Assert-Condition ((Get-Text 'src\winterm\Workspaces\Model\WorkspaceDescriptor.h').Contains('WorkspaceSchemaVersion{ 2 }')) 'Workspace model remains at Schema version 2' Assert-Condition ((Get-Text 'src\winterm\Workspaces\Model\WorkspaceDescriptor.h').Contains('DockingModelVersion{ 1 }')) 'Workspace model remains at Docking version 1' Assert-Condition ((Get-Text 'src\winterm\Shell\Protocol\ShellIntegrationProtocol.h').Contains('ShellProtocolVersion{ 1 }')) 'Shell protocol remains at version 1' diff --git a/src/winterm-tools/winterm-shim/winterm-shim.rc b/src/winterm-tools/winterm-shim/winterm-shim.rc index c47b31b39..e62f8557f 100644 --- a/src/winterm-tools/winterm-shim/winterm-shim.rc +++ b/src/winterm-tools/winterm-shim/winterm-shim.rc @@ -4,8 +4,8 @@ #include 1 VERSIONINFO - FILEVERSION 1,0,8,0 - PRODUCTVERSION 1,0,8,0 + FILEVERSION 1,1,3,0 + PRODUCTVERSION 1,1,3,0 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS VS_FF_DEBUG @@ -22,12 +22,12 @@ BEGIN BEGIN VALUE "CompanyName", "helloThisWorld\0" VALUE "FileDescription", "winTerm Shell Integration Helper\0" - VALUE "FileVersion", "1.0.8.0\0" + VALUE "FileVersion", "1.1.3.0\0" VALUE "InternalName", "winterm-shim\0" VALUE "LegalCopyright", "Copyright (c) winTerm contributors.\0" VALUE "OriginalFilename", "winterm-shim.exe\0" VALUE "ProductName", "winTerm\0" - VALUE "ProductVersion", "1.0.0\0" + VALUE "ProductVersion", "1.1.3\0" END END BLOCK "VarFileInfo"