@@ -7,6 +7,10 @@ on:
   workflow_dispatch:
   workflow_call:
     inputs:
+      version:
+        description: Version to stamp and verify on built binaries; defaults to Cargo.toml
+        type: string
+        default: ''
       signing_environment:
         description: GitHub environment for signing; empty produces unsigned CI artifacts
         type: string
@@ -67,20 +71,71 @@ jobs:
           restore-keys: ${{ matrix.rid }}-
 
       - name: Build
+        env:
+          JIFFSHOT_VERSION: ${{ inputs.version }}
         run: cargo build --release --locked -p jiffshot --target ${{ matrix.target }}
 
       - name: Test
         if: matrix.test
+        env:
+          JIFFSHOT_VERSION: ${{ inputs.version }}
         run: cargo test --release --locked --workspace --target ${{ matrix.target }}
 
       - name: Package
         shell: pwsh
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
         run: |
+          $ErrorActionPreference = 'Stop'
           # The build script puts the Rustolonia host next to jiffshot.exe.
           $out = "target/${{ matrix.target }}/release"
           $dir = "jiffshot-${{ matrix.rid }}"
           New-Item -ItemType Directory -Path $dir | Out-Null
           Copy-Item "$out/jiffshot.exe", "$out/*.dll", "app/README-portable.txt" -Destination $dir
+          $cargoToml = Get-Content -LiteralPath Cargo.toml -Raw
+          if ($cargoToml -notmatch '(?ms)^\[workspace\.package\].*?^\s*version\s*=\s*"(?<v>[0-9]+\.[0-9]+\.[0-9]+)"') {
+            throw 'Could not read [workspace.package] version from Cargo.toml'
+          }
+          $workspaceVersion = $Matches['v']
+          $expectedVersion = if ([string]::IsNullOrWhiteSpace($env:EXPECTED_VERSION)) {
+            $workspaceVersion
+          } elseif ($env:EXPECTED_VERSION -ne $workspaceVersion) {
+            throw "Input version '$env:EXPECTED_VERSION' does not match Cargo.toml '$workspaceVersion'"
+          } else {
+            $env:EXPECTED_VERSION
+          }
+          $expectedFileVersion = "$expectedVersion.0"
+          $exeInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo((Resolve-Path "$dir/jiffshot.exe"))
+          if ($exeInfo.CompanyName -ne 'Devolutions Inc.') {
+            throw "jiffshot.exe CompanyName '$($exeInfo.CompanyName)' does not match 'Devolutions Inc.'"
+          }
+          if ($exeInfo.ProductName -ne 'Devolutions Jiffshot') {
+            throw "jiffshot.exe ProductName '$($exeInfo.ProductName)' does not match 'Devolutions Jiffshot'"
+          }
+          if ([string]::IsNullOrWhiteSpace($exeInfo.FileDescription)) {
+            throw 'jiffshot.exe is missing FileDescription'
+          }
+          if ($exeInfo.OriginalFilename -ne 'jiffshot.exe') {
+            throw "jiffshot.exe OriginalFilename '$($exeInfo.OriginalFilename)' does not match 'jiffshot.exe'"
+          }
+          if ($exeInfo.FileVersion -ne $expectedFileVersion) {
+            throw "jiffshot.exe FileVersion '$($exeInfo.FileVersion)' does not match '$expectedFileVersion'"
+          }
+          if ($exeInfo.ProductVersion -ne $expectedVersion) {
+            throw "jiffshot.exe ProductVersion '$($exeInfo.ProductVersion)' does not match '$expectedVersion'"
+          }
+          if ($cargoToml -notmatch 'rustolonia\s*=\s*\{[^}]*tag\s*=\s*"v(?<rv>[0-9]+\.[0-9]+\.[0-9]+)"') {
+            throw 'Could not read rustolonia tag from Cargo.toml'
+          }
+          $rustoloniaVersion = $Matches['rv']
+          $hostInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo((Resolve-Path "$dir/rustolonia_host.dll"))
+          if ($hostInfo.FileVersion -ne "$rustoloniaVersion.0") {
+            throw "rustolonia_host.dll FileVersion '$($hostInfo.FileVersion)' does not match '$rustoloniaVersion.0'"
+          }
+          if (-not $hostInfo.ProductVersion.StartsWith($rustoloniaVersion)) {
+            throw "rustolonia_host.dll ProductVersion '$($hostInfo.ProductVersion)' does not start with '$rustoloniaVersion'"
+          }
+          Write-Host "Version OK: jiffshot.exe FileVersion=$($exeInfo.FileVersion) ProductVersion=$($exeInfo.ProductVersion); rustolonia_host.dll FileVersion=$($hostInfo.FileVersion)"
           Get-ChildItem $dir | Format-Table Name, Length
 
       - name: Sign portable binaries
@@ -143,10 +198,38 @@ jobs:
 
       - name: Build the MSI
         shell: pwsh
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
         run: |
-          dotnet build package -c Release
+          $ErrorActionPreference = 'Stop'
+          $cargoToml = Get-Content -LiteralPath Cargo.toml -Raw
+          if ($cargoToml -notmatch '(?ms)^\[workspace\.package\].*?^\s*version\s*=\s*"(?<v>[0-9]+\.[0-9]+\.[0-9]+)"') {
+            throw 'Could not read [workspace.package] version from Cargo.toml'
+          }
+          $expectedVersion = if ([string]::IsNullOrWhiteSpace($env:EXPECTED_VERSION)) {
+            $Matches['v']
+          } elseif ($env:EXPECTED_VERSION -ne $Matches['v']) {
+            throw "Input version '$env:EXPECTED_VERSION' does not match Cargo.toml '$($Matches['v'])'"
+          } else {
+            $env:EXPECTED_VERSION
+          }
+          dotnet build package -c Release -p:Version=$expectedVersion
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          package/bin/Release/net472/Jiffshot.Package.exe -bin bin -platform ${{ matrix.platform }} -out msi
+          $pkgExe = Resolve-Path 'package/bin/Release/net472/Jiffshot.Package.exe'
+          $pkgInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($pkgExe)
+          if ($pkgInfo.CompanyName -ne 'Devolutions Inc.') {
+            throw "Jiffshot.Package.exe CompanyName '$($pkgInfo.CompanyName)' does not match 'Devolutions Inc.'"
+          }
+          if ($pkgInfo.ProductName -ne 'Devolutions Jiffshot') {
+            throw "Jiffshot.Package.exe ProductName '$($pkgInfo.ProductName)' does not match 'Devolutions Jiffshot'"
+          }
+          if ($pkgInfo.FileVersion -ne "$expectedVersion.0") {
+            throw "Jiffshot.Package.exe FileVersion '$($pkgInfo.FileVersion)' does not match '$expectedVersion.0'"
+          }
+          if (-not $pkgInfo.ProductVersion.StartsWith($expectedVersion)) {
+            throw "Jiffshot.Package.exe ProductVersion '$($pkgInfo.ProductVersion)' does not start with '$expectedVersion'"
+          }
+          & $pkgExe -bin bin -platform ${{ matrix.platform }} -version $expectedVersion -out msi
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           Get-ChildItem msi | Format-Table Name, Length
 
@@ -182,6 +265,10 @@ jobs:
             Where-Object { $_.DisplayName -eq 'Devolutions Jiffshot' })
           if ($product.Count -ne 1) { throw 'Expected one Devolutions Jiffshot entry in Programs and Features' }
           if ($product[0].Publisher -ne 'Devolutions Inc.') { throw "Expected Publisher 'Devolutions Inc.', got '$($product[0].Publisher)'" }
+          $installedVer = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($exe)
+          if ($installedVer.ProductVersion -ne $product[0].DisplayVersion -or $installedVer.FileVersion -ne "$($product[0].DisplayVersion).0") {
+            throw "Installed jiffshot.exe version ($($installedVer.FileVersion) / $($installedVer.ProductVersion)) does not match MSI DisplayVersion '$($product[0].DisplayVersion)'"
+          }
           $open = (Get-ItemProperty "HKLM:\Software\Classes\jiffshot.Document\shell\open\command").'(default)'
           if ($open -notlike "*jiffshot.exe*") { throw "the .jsd association is wrong: $open" }
           Get-ChildItem "$env:ProgramFiles\Devolutions\jiffshot" | Format-Table Name, Length
 
@@ -90,6 +90,7 @@ jobs:
       id-token: write
     uses: ./.github/workflows/ci.yml
     with:
+      version: ${{ needs.preflight.outputs.version }}
       signing_environment: ${{ needs.preflight.outputs.signing_environment }}
     secrets: inherit
 
@@ -196,6 +197,10 @@ jobs:
                 throw "Invalid release signature or timestamp for ${path}: $($signature.StatusMessage)"
               }
             }
+            $exeInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo((Resolve-Path "$portable\jiffshot.exe"))
+            if ($exeInfo.ProductVersion -ne $env:RELEASE_VERSION -or $exeInfo.FileVersion -ne "$env:RELEASE_VERSION.0") {
+              throw "Release jiffshot.exe ($arch) version ($($exeInfo.FileVersion) / $($exeInfo.ProductVersion)) does not match $env:RELEASE_VERSION"
+            }
             Copy-Item -LiteralPath $msi -Destination "release\$msiName"
             Compress-Archive -Path "$portable\*" `
               -DestinationPath "release\Devolutions.Jiffshot-$arch-$env:RELEASE_VERSION-portable.zip"
 
@@ -1,12 +1,13 @@
-//! Embeds the program icon (see assets/icon_res.rs) and puts Rustolonia's
-//! host next to `jiffshot.exe`, so the build output folder runs as it is and
-//! can be zipped as the portable app.
+//! Embeds the program icon and version resource (see assets/icon_res.rs) and
+//! puts Rustolonia's host next to `jiffshot.exe`, so the build output folder
+//! runs as it is and can be zipped as the portable app.
 
 include!("../assets/icon_res.rs");
 
 use std::path::PathBuf;
 
 fn main() {
+    println!("cargo:rerun-if-changed=../assets/icon_res.rs");
     embed_icon("../assets/jiffshot.ico");
     copy_host();
 }
 
@@ -540,3 +540,48 @@ fn main() -> rustolonia::Result<()> {
     ui::detach_all();
     result
 }
+
+#[cfg(test)]
+#[allow(dead_code)]
+mod resource_tests {
+    include!("../../assets/icon_res.rs");
+
+    #[test]
+    fn pe_version_parts_parses_semver_and_strips_suffixes() {
+        assert_eq!(pe_version_parts("0.1.0"), [0, 1, 0, 0]);
+        assert_eq!(pe_version_parts("1.2.3.4"), [1, 2, 3, 4]);
+        assert_eq!(pe_version_parts("2.5.14-rc.1+build.9"), [2, 5, 14, 0]);
+    }
+
+    #[test]
+    fn version_info_embeds_fixed_info_and_strings() {
+        let block = version_info("1.2.3");
+        let total_len = u16::from_le_bytes([block[0], block[1]]) as usize;
+        assert_eq!(total_len, block.len());
+        assert_eq!(u16::from_le_bytes([block[2], block[3]]), 52);
+        assert_eq!(u16::from_le_bytes([block[4], block[5]]), 0);
+        // VS_FIXEDFILEINFO starts at offset 40 (6-byte header + "VS_VERSION_INFO\0" in UTF-16 + 2-byte pad).
+        assert_eq!(u32::from_le_bytes(block[40..44].try_into().unwrap()), 0xFEEF_04BD);
+        assert_eq!(u32::from_le_bytes(block[48..52].try_into().unwrap()), 0x0001_0002);
+        assert_eq!(u32::from_le_bytes(block[52..56].try_into().unwrap()), 0x0003_0000);
+        assert_eq!(u32::from_le_bytes(block[56..60].try_into().unwrap()), 0x0001_0002);
+        assert_eq!(u32::from_le_bytes(block[60..64].try_into().unwrap()), 0x0003_0000);
+        let utf16: Vec<u16> = block
+            .as_chunks::<2>()
+            .0
+            .iter()
+            .map(|&b| u16::from_le_bytes(b))
+            .collect();
+        let decoded = String::from_utf16_lossy(&utf16);
+        for expected in [
+            "Devolutions Inc.",
+            "Devolutions Jiffshot",
+            "jiffshot.exe",
+            "1.2.3.0",
+            "1.2.3",
+        ] {
+            assert!(decoded.contains(expected), "missing {expected:?} in VS_VERSION_INFO");
+        }
+    }
+}
+
@@ -1,14 +1,14 @@
-// Included by the app's build script: turns `assets/jiffshot.ico` into a
-// compiled resource file holding the program icon, and hands it to the
-// linker. MSVC's linker takes `.res` files directly, so no resource compiler
-// (or Windows SDK) is needed.
+// Included by the app's build script: turns `assets/jiffshot.ico` and the
+// package metadata into a compiled resource file holding the program icon and
+// `VS_VERSION_INFO`, and hands it to the linker. MSVC's linker takes `.res`
+// files directly, so no resource compiler (or Windows SDK) is needed.
 
 use std::path::Path;
 
-/// Writes `ico` as a `.res` file: one RT_ICON per image, then the
-/// RT_GROUP_ICON (id 1) that lists them, which is the icon Windows shows
-/// for the executable.
-fn write_icon_res(ico: &[u8], out: &Path) -> std::io::Result<()> {
+/// Writes `ico` and `VS_VERSION_INFO` for `version` as a `.res` file: one
+/// `RT_ICON` per image, the `RT_GROUP_ICON` (id 1) that lists them, and
+/// `RT_VERSION` (id 1).
+fn write_icon_res(ico: &[u8], version: &str, out: &Path) -> std::io::Result<()> {
     let u16_at = |i: usize| u16::from_le_bytes([ico[i], ico[i + 1]]);
     let u32_at = |i: usize| u32::from_le_bytes([ico[i], ico[i + 1], ico[i + 2], ico[i + 3]]);
     let bad = || std::io::Error::new(std::io::ErrorKind::InvalidData, "not an .ico file");
@@ -39,9 +39,106 @@ fn write_icon_res(ico: &[u8], out: &Path) -> std::io::Result<()> {
     }
     // RT_GROUP_ICON.
     entry(&mut res, 14, 1, 0x1030, &group);
+    // RT_VERSION.
+    entry(&mut res, 16, 1, 0x0030, &version_info(version));
     std::fs::write(out, res)
 }
 
+/// Builds a `VS_VERSION_INFO` block for `jiffshot.exe` at `version`.
+fn version_info(version: &str) -> Vec<u8> {
+    let parts = pe_version_parts(version);
+    let file_version = format!("{}.{}.{}.{}", parts[0], parts[1], parts[2], parts[3]);
+    let mut fixed = Vec::with_capacity(52);
+    let ver_ms = (u32::from(parts[0]) << 16) | u32::from(parts[1]);
+    let ver_ls = (u32::from(parts[2]) << 16) | u32::from(parts[3]);
+    for word in [
+        0xFEEF_04BDu32, // dwSignature
+        0x0001_0000,    // dwStrucVersion (1.0)
+        ver_ms,         // dwFileVersionMS
+        ver_ls,         // dwFileVersionLS
+        ver_ms,         // dwProductVersionMS
+        ver_ls,         // dwProductVersionLS
+        0x0000_003F,    // dwFileFlagsMask (VS_FFI_FILEFLAGSMASK)
+        0,              // dwFileFlags
+        0x0004_0004,    // dwFileOS (VOS_NT_WINDOWS32)
+        0x0000_0001,    // dwFileType (VFT_APP)
+        0,              // dwFileSubtype
+        0,              // dwFileDateMS
+        0,              // dwFileDateLS
+    ] {
+        fixed.extend_from_slice(&word.to_le_bytes());
+    }
+
+    let strings = [
+        ("CompanyName", "Devolutions Inc."),
+        ("FileDescription", env!("CARGO_PKG_DESCRIPTION")),
+        ("FileVersion", file_version.as_str()),
+        ("InternalName", "jiffshot"),
+        ("LegalCopyright", "Copyright (c) Devolutions Inc."),
+        ("OriginalFilename", "jiffshot.exe"),
+        ("ProductName", "Devolutions Jiffshot"),
+        ("ProductVersion", version),
+    ];
+    let mut string_entries = Vec::with_capacity(strings.len());
+    for (key, val) in strings {
+        let mut value_bytes = Vec::new();
+        for u in val.encode_utf16().chain(std::iter::once(0)) {
+            value_bytes.extend_from_slice(&u.to_le_bytes());
+        }
+        let value_words = (value_bytes.len() / 2) as u16;
+        string_entries.push(ver_node(key, 1, value_words, &value_bytes, &[]));
+    }
+    let string_table = ver_node("040904b0", 1, 0, &[], &string_entries);
+    let string_file_info = ver_node("StringFileInfo", 1, 0, &[], &[string_table]);
+    // US English (0x0409), Unicode (1200 = 0x04B0).
+    let translation = ver_node("Translation", 0, 4, &[0x09, 0x04, 0xB0, 0x04], &[]);
+    let var_file_info = ver_node("VarFileInfo", 1, 0, &[], &[translation]);
+    ver_node(
+        "VS_VERSION_INFO",
+        0,
+        fixed.len() as u16,
+        &fixed,
+        &[string_file_info, var_file_info],
+    )
+}
+
+/// Parses up to four `u16` version components from `version` (stripping any
+/// `-prerelease` or `+build` suffix).
+fn pe_version_parts(version: &str) -> [u16; 4] {
+    let numeric = version.split(['-', '+']).next().unwrap_or(version);
+    let mut parts = [0u16; 4];
+    for (slot, part) in parts.iter_mut().zip(numeric.split('.')) {
+        if let Ok(value) = part.parse::<u16>() {
+            *slot = value;
+        }
+    }
+    parts
+}
+
+/// One node in a `VS_VERSION_INFO` tree: `(wLength, wValueLength, wType,
+/// szKey, padding, Value, padding, Children)`.
+fn ver_node(key: &str, kind: u16, value_len: u16, value: &[u8], children: &[Vec<u8>]) -> Vec<u8> {
+    let mut node = vec![0u8; 6];
+    for u in key.encode_utf16().chain(std::iter::once(0)) {
+        node.extend_from_slice(&u.to_le_bytes());
+    }
+    while !node.len().is_multiple_of(4) {
+        node.push(0);
+    }
+    node.extend_from_slice(value);
+    for child in children {
+        while !node.len().is_multiple_of(4) {
+            node.push(0);
+        }
+        node.extend_from_slice(child);
+    }
+    let len = node.len() as u16;
+    node[0..2].copy_from_slice(&len.to_le_bytes());
+    node[2..4].copy_from_slice(&value_len.to_le_bytes());
+    node[4..6].copy_from_slice(&kind.to_le_bytes());
+    node
+}
+
 /// One resource with a numeric type and name, in US English, padded to a
 /// 4-byte boundary.
 fn entry(res: &mut Vec<u8>, kind: u16, name: u16, flags: u16, data: &[u8]) {
@@ -56,19 +153,30 @@ fn entry(res: &mut Vec<u8>, kind: u16, name: u16, flags: u16, data: &[u8]) {
     res.extend_from_slice(&0u32.to_le_bytes());
     res.extend_from_slice(&0u32.to_le_bytes());
     res.extend_from_slice(data);
-    while res.len() % 4 != 0 {
+    while !res.len().is_multiple_of(4) {
         res.push(0);
     }
 }
 
-/// Embeds `ico` (a path relative to the crate) as the executable's icon.
+/// Embeds `ico` (a path relative to the crate) and `VS_VERSION_INFO` into the
+/// executable.
 fn embed_icon(ico: &str) {
     println!("cargo:rerun-if-changed={ico}");
-    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") || std::env::var("CARGO_CFG_TARGET_ENV").as_deref() != Ok("msvc") {
+    println!("cargo:rerun-if-env-changed=JIFFSHOT_VERSION");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows")
+        || std::env::var("CARGO_CFG_TARGET_ENV").as_deref() != Ok("msvc")
+    {
         return;
     }
+    let version = std::env::var("JIFFSHOT_VERSION")
+        .ok()
+        .map(|v| v.trim().to_string())
+        .filter(|v| !v.is_empty())
+        .or_else(|| std::env::var("CARGO_PKG_VERSION").ok())
+        .unwrap_or_else(|| "0.0.0".to_string());
     let bytes = std::fs::read(ico).unwrap_or_else(|e| panic!("reading {ico}: {e}"));
     let out = Path::new(&std::env::var("OUT_DIR").expect("cargo sets OUT_DIR")).join("icon.res");
-    write_icon_res(&bytes, &out).unwrap_or_else(|e| panic!("writing {}: {e}", out.display()));
+    write_icon_res(&bytes, &version, &out)
+        .unwrap_or_else(|e| panic!("writing {}: {e}", out.display()));
     println!("cargo:rustc-link-arg-bins={}", out.display());
 }
@@ -11,6 +11,11 @@
     <LangVersion>latest</LangVersion>
     <Nullable>enable</Nullable>
     <RootNamespace>Jiffshot.Package</RootNamespace>
+    <Version Condition="'$(Version)' == ''">0.1.0</Version>
+    <Company>Devolutions Inc.</Company>
+    <Product>Devolutions Jiffshot</Product>
+    <Description>Jiffshot MSI packager</Description>
+    <Copyright>Copyright (c) Devolutions Inc.</Copyright>
   </PropertyGroup>
 
   <ItemGroup>