TIFF, the twenty first format, and texts that tell the truth about signing - #19

Three things, in the order they happened.

TIFF

Uncompressed, RGB, one page, little-endian. The size is w*h*3 + 180, which is
arithmetic that can be inverted - so --size 300kb produces a picture worth
300 kB rather than a thumbnail followed by filler. Same shape as BMP, and for
the same reason.

Written by hand rather than taken from x/image/tiff, and that was measured
before it was decided. That encoder supports two of the five compressions its
own enum declares, gates Predictor on the one it cannot do, writes
little-endian only and emits a single directory - two of the four variant axes
this project documents for TIFF. It would also have been the first outside
encoder inside the D11 byte contract, and its version is raised by the window
toolkit, so updating Fyne would have moved TIFF hashes in a binary that links
no x/image package at all. Taking it was measured too, by building both
binaries: +109 056 B on the CLI.

Padding goes in the gap between the header and the pixel data, which
StripOffsets points past. Five channels passed measurement on five
independent readers at every size from 1 B to 10 MiB; this is the one the
format itself sets aside, the same shape as bfOffBits in BMP. The other four
rely on reader tolerance instead.

The structural check earns more here than anywhere else. Of six
deliberately broken files, a StripByteCounts announcing half the pixel data
was accepted by four readers of five - Pillow, exiftool, WIC and GDI+ all read
the image they could find and never asked whether the directory was telling the
truth. Its own negative control catches eight of nine defects; the ninth is a
flipped pixel, which is content rather than structure and is caught by the
pinned hash.

Six mutation entries, all caught. One came back NOT CAUGHT first: no golden
case reached the branch where one dimension is named and the other is worked
out, because one case named both sides and the other named neither. That was a
hole in the evidence rather than in the code, and a third case closes it.

The texts about signing

v0.2.0 is signed, so README and the site no longer say it is not. What they
say now was measured on the published file rather than assumed:
Get-AuthenticodeSignature on the binary inside tfg_0.2.0_windows_amd64.zip
answers Valid with a timestamp, and the macOS archive carries a signed .app
with the plain name beside it as a symlink. Linux is unsigned and the pages say
so.

Nothing from the certificate subject went into these texts. It carries a
person's name and location, which the repository does not.

The release notes for v0.2.0 say nothing about signing either way, so the
sentence pointing readers at them was removed rather than reworded.

The window shot

It was from v0.1.0 and showed an interface that no longer exists - "Group
name", explanations under every field, an open settings block. Rendered again
from the current build, and it is shorter now because the screen is, so the
width and height attributes moved with it and the social card was rebuilt on
top of it.

Full suite green, preflight --quick 11 of 11, format-status.py 12 of 12 for
tiff and 0 gaps across 21 formats.

⚠️ One thing is deliberately left open: the fidelity checklist row for TIFF
says the picture was not looked at. Paint opens the file without complaint
and WIC decodes it, but Paint on Windows 11 draws through WinUI composition and
its contents do not reach a screenshot. That row carries the reason rather than
a tick.

🤖 Generated with Claude Code