# Build RedAction 1.0.21.0

The supported release build environment is Windows 11 x64, Python 3.14.3 x64,
PowerShell 5.1 or later, PyInstaller 6.20.0, Windows SDK 10.0.28000.0
(`MakeAppx.exe` and `SignTool.exe`) and Inno Setup 6.7.1 when the optional
standalone installer is built. Partner Center performs final Store signing.

## Prepare an isolated environment

```powershell
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install pip==25.3 setuptools==82.0.1 wheel==0.46.3
python -m pip install -r desktop\requirements-desktop-1.0.21.0.txt
```

## Run all tests

```powershell
python -m pytest -q tests
```

## Run from source

```powershell
python -m desktop.redact_desktop.entry
```

## Build the frozen application

```powershell
powershell -ExecutionPolicy Bypass -File desktop\build_redact.ps1
```

Output: `dist\REDACT\REDACT.exe` and its runtime files.

## Build the unsigned Store MSIX

```powershell
powershell -ExecutionPolicy Bypass -File desktop\build_msix_direct.ps1
```

Output: `Beartalk.RedActionPDFTool_1.0.21.0_x64.msix`.

The Store submission package is intentionally unsigned because Partner Center
performs Store signing. A third-party build must use a package identity and
signing certificate that the third party is authorised to use.

All commands use paths relative to the extracted source root. Private signing
keys and Partner Center credentials are not required to build or modify the app.

## Release records and source archive

After a clean build, regenerate the asset ledger, licence collection and SBOM:

```powershell
python installer\generate_asset_ledger.py
python installer\collect_third_party_licenses.py
python installer\generate_sbom.py
```

The version-specific source generator is
`installer\create_source_release.ps1`. It deliberately refuses to produce a
release while the asset ledger has `REQUIRES_REVIEW` rows or required clean
build and signed-Store evidence records are absent. Do not bypass that gate.

Final procedure: stage the source and MSIX, validate documented paths, scan for
secrets and local machine paths, compare source/frozen payloads, publish source
no later than the binary, then create detached SHA-256 records. A ZIP cannot
contain its own final hash.

Tesseract is not collected. OCR uses the packaged Python projections for the
local Windows.Media.Ocr operating-system API.

This repository validation build is not evidence of a clean-VM build. Record
the VM image, Windows build, tool paths/versions, installation log, test log,
PyInstaller log, MSIX log, SBOM log, warnings and file inventory separately.