[imattau]

Summary

• The local GetPackage lookup (0.9.2) verified the signature of every event in the catalogue before checking its name, so each details view cost time proportional to the whole catalogue (about 1 s for 3,000 releases in a debug build). select_release now checks name, platform, publisher, trust, version and revocation first and verifies only the remaining candidates (about 12 ms for the same catalogue). The set of filters is unchanged, so the result is the same.
• The lookup runs on a blocking thread so it cannot stall other daemon requests.
• A new test checks that a tampered event is still rejected after the filter reorder.
• Bumps npack and npack-gui to 0.9.4 (and Cargo.lock).

Notes

• This was meant to ship in 0.9.3 but was pushed after Give the npack CLI package a store listing; faster details; bump to 0.9.3 #42 had been merged, so 0.9.3 does not include it.
• The branch history includes a no-op merge of the old branch (its content is already in master), because the remote branch could not be force-pushed. A squash merge drops it.
• The catalogue file is still parsed on each details view (about 70 ms for 3,000 releases in a debug build); caching it in the daemon is a possible follow-up.

Test plan

• cargo fmt --all -- --check
• cargo test -p npack (188 passed)
• cargo clippy --all-targets --all-features clean
• packaging/check-release-version.sh 0.9.4
• CI
• After release, open details for an already-viewed package in the GUI and confirm it appears quickly (not run here)

---

Generated by Claude Code