@@ -1,5 +1,14 @@
|
||||
# Changelog
|
||||
|
||||
## 0.2.0 - 2026-09-02
|
||||
|
||||
- Replaced CRC/size equality with bounded on-demand decompressed SHA-256 and
|
||||
safe semantic text, JSON, XML and manifest diffs.
|
||||
- Added bounded dependency and licence declarations, signature-companion and
|
||||
declared-digest diagnostics, plus verified-entry Web Share handoff.
|
||||
- Declared accurate package input, report/extracted-file output and optional
|
||||
browser capability profiles for Toolbox handoff.
|
||||
|
||||
## 0.1.0 - 2026-09-01
|
||||
|
||||
- Add bounded ZIP/ZIP64 inventory, safe package tree and verified entry reads.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
==============================================================================
|
||||
@add-ideas/toolbox-contract@0.2.3
|
||||
@add-ideas/toolbox-contract@0.3.0
|
||||
Declared licence: Apache-2.0
|
||||
==============================================================================
|
||||
--- LICENSE ---
|
||||
@@ -198,7 +198,7 @@ Declared licence: Apache-2.0
|
||||
|
||||
|
||||
==============================================================================
|
||||
@add-ideas/toolbox-helpers@0.1.0
|
||||
@add-ideas/toolbox-helpers@0.2.0
|
||||
Declared licence: GPL-3.0-or-later
|
||||
==============================================================================
|
||||
--- LICENSE ---
|
||||
@@ -879,7 +879,7 @@ Public License instead of this License. But first, please read
|
||||
|
||||
|
||||
==============================================================================
|
||||
@add-ideas/toolbox-shell-react@0.2.3
|
||||
@add-ideas/toolbox-shell-react@0.3.0
|
||||
Declared licence: Apache-2.0
|
||||
==============================================================================
|
||||
--- LICENSE ---
|
||||
|
||||
+16
-4
@@ -6,7 +6,7 @@ bounded, format-aware interpretation for EPUB, OOXML (`.docx`, `.xlsx`,
|
||||
`.pptx`), OpenDocument (`.odt`, `.ods`, `.odp`), JAR, APK, and Chrome/Firefox
|
||||
extension packages.
|
||||
|
||||
Version 0.1.0 can:
|
||||
Version 0.2.0 can:
|
||||
|
||||
- inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
|
||||
- reject traversal, ambiguous, colliding and special-entry paths;
|
||||
@@ -14,12 +14,21 @@ Version 0.1.0 can:
|
||||
- interpret OOXML content types and internal/external relationships;
|
||||
- inspect EPUB container/package metadata and manifest/spine consistency;
|
||||
- inspect ODF manifests, JAR manifests and WebExtension manifests;
|
||||
- inventory known signature-material files without asserting validity or trust;
|
||||
- inventory signature-material pairs and declared digest algorithms without
|
||||
asserting validity or trust;
|
||||
- extract bounded dependency declarations from package.json, Python requirements,
|
||||
Maven metadata and JAR Class-Path, plus conventional licence-file evidence;
|
||||
- flag missing relationship/manifest targets and unreferenced embedded media;
|
||||
- preview bounded text, raster images, audio and video, and download a strictly
|
||||
re-read entry;
|
||||
- compare two package inventories by path, kind, size, compressed size and CRC;
|
||||
- compare two packages using bounded, on-demand SHA-256 of verified
|
||||
decompressed entries; matching metadata/CRC alone remains explicitly
|
||||
unverified;
|
||||
- summarize safe bounded JSON, XML, manifest and text differences without
|
||||
rendering or executing package content;
|
||||
- export an inert JSON inventory report.
|
||||
- explicitly hand a verified entry to the browser/OS share surface where
|
||||
supported, with verified download-and-reopen as the local-only fallback.
|
||||
|
||||
All processing happens in the browser. The app has no telemetry, remote parser,
|
||||
CDN assets or automatic network lookups.
|
||||
@@ -42,11 +51,14 @@ for the complete verification suite.
|
||||
Package Tools is an inspection aid, not a renderer for office/ebook content,
|
||||
an APK resource decoder, a Java class analyser, an extension sandbox, or a
|
||||
signature verifier. It never establishes authenticity or publisher trust.
|
||||
Dependency declarations are not resolved or vulnerability-checked, and licence
|
||||
evidence is not a legal interpretation. A chosen OS share target can upload a
|
||||
file even though Package Tools itself never does.
|
||||
Encrypted entries, split archives, unsafe paths, unsupported compression, and
|
||||
entries beyond the configured byte budgets remain inventory-only.
|
||||
|
||||
APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded
|
||||
in v0.1. Chrome CRX wrapper headers are not a guaranteed input format; use an
|
||||
in v0.2. Chrome CRX wrapper headers are not a guaranteed input format; use an
|
||||
unpacked ZIP-form extension package when needed.
|
||||
|
||||
## Licence
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
# Source identity
|
||||
|
||||
- Project: Package Tools
|
||||
- Version: 0.1.0
|
||||
- Version: 0.2.0
|
||||
- Canonical repository: https://git.add-ideas.de/lotobo/package-tools
|
||||
- Licence: GPL-3.0-or-later
|
||||
- Toolbox app id: `de.add-ideas.package-tools`
|
||||
|
||||
@@ -5,7 +5,8 @@ never loaded from a CDN. Their licence texts are copied into the production
|
||||
artifact at build time.
|
||||
|
||||
- React and React DOM — MIT
|
||||
- add·ideas Toolbox Contract, Shell React and Helpers — GPL-3.0-or-later
|
||||
- add·ideas Toolbox Contract and Shell React 0.3.0 — Apache-2.0
|
||||
- add·ideas Toolbox Helpers 0.2.0 — GPL-3.0-or-later
|
||||
- zip.js — BSD-3-Clause
|
||||
- @xmldom/xmldom — MIT
|
||||
|
||||
|
||||
@@ -7,12 +7,23 @@ The React workbench is a thin UI over four bounded layers:
|
||||
2. `src/package/analyze.ts` selects at most 512 metadata files / 16 MiB,
|
||||
determines a package adapter, parses static XML or bounded JSON, and builds
|
||||
references and diagnostics.
|
||||
3. Tree and comparison modules create deterministic projections without
|
||||
reading entry payloads.
|
||||
3. Tree comparison first reports metadata-only candidates as unverified. On an
|
||||
explicit user action it reopens up to 512 comparable entries within a 128 MiB
|
||||
expanded-byte budget, verifies container integrity and hashes decompressed
|
||||
bytes with SHA-256. Differing small JSON, static XML, manifest and text files
|
||||
receive bounded semantic summaries; DTDs/entities remain rejected.
|
||||
4. The preview path reopens the package and performs strict CRC/overlap checks
|
||||
for one bounded entry. Markup is text-only; only browser-supported raster
|
||||
image/audio/video blobs receive local object URLs.
|
||||
|
||||
Supply-chain inspection is declaration-only: bounded package.json,
|
||||
requirements, Maven/JAR and conventional licence paths produce evidence rows
|
||||
without registry access, resolution, vulnerability lookup or legal inference.
|
||||
Signature inventory correlates companion `.SF`/`.RSA`/`.DSA`/`.EC` entries and
|
||||
reports declared digest algorithm names, but never verifies signed bytes or a
|
||||
certificate chain. Explicit entry handoff uses the browser's user-mediated Web
|
||||
Share surface; verified download is retained as the predictable fallback.
|
||||
|
||||
The UI lazy-loads the workbench beneath the shared toolbox shell. The app uses
|
||||
relative URLs so it works under nested portal paths, and a service worker caches
|
||||
same-origin resources after first use.
|
||||
|
||||
@@ -4,7 +4,7 @@ Files remain in browser memory and are never uploaded. Package Tools performs
|
||||
no telemetry, DNS lookup, external relationship fetch, certificate lookup or
|
||||
signature validation. Export occurs only after an explicit button press.
|
||||
|
||||
Limits in v0.1 include 512 MiB source and aggregate declared expansion, 20,000
|
||||
Limits in v0.2 include 512 MiB source and aggregate declared expansion, 20,000
|
||||
entries, 256 MiB per entry, 200:1 compression ratio, 2 MiB per metadata entry,
|
||||
16 MiB total inspected metadata, and 512 metadata files. UI rendering is capped
|
||||
at 5,000 tree/comparison rows while diagnostics cover the bounded inventory.
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
const CACHE = "package-tools-v0.1.0";
|
||||
const CACHE = "package-tools-v0.2.0";
|
||||
const APP = [
|
||||
"./",
|
||||
"./index.html",
|
||||
|
||||
+50
-3
@@ -3,12 +3,21 @@
|
||||
"schemaVersion": 1,
|
||||
"id": "de.add-ideas.package-tools",
|
||||
"name": "Package Tools",
|
||||
"version": "0.1.0",
|
||||
"description": "Inspect compound packages locally.",
|
||||
"version": "0.2.0",
|
||||
"description": "Inspect, compare and extract compound packages locally.",
|
||||
"entry": "./",
|
||||
"icon": "./favicon.svg",
|
||||
"categories": ["documents", "developer", "forensics"],
|
||||
"tags": ["zip", "epub", "ooxml", "odf", "jar", "apk", "extension"],
|
||||
"tags": [
|
||||
"zip",
|
||||
"epub",
|
||||
"ooxml",
|
||||
"odf",
|
||||
"jar",
|
||||
"apk",
|
||||
"dependencies",
|
||||
"signatures"
|
||||
],
|
||||
"integration": {
|
||||
"contextVersion": 1,
|
||||
"launchModes": ["navigate", "new-tab"],
|
||||
@@ -21,6 +30,44 @@
|
||||
"crossOriginIsolated": false,
|
||||
"topLevelContext": false
|
||||
},
|
||||
"io": {
|
||||
"accepts": [
|
||||
{
|
||||
"mediaType": "application/zip",
|
||||
"extensions": [".zip", ".jar", ".apk", ".xpi"]
|
||||
},
|
||||
{ "mediaType": "application/epub+zip", "extensions": [".epub"] },
|
||||
{
|
||||
"mediaType": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
|
||||
"extensions": [".docx"]
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
||||
"extensions": [".xlsx"]
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
|
||||
"extensions": [".pptx"]
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oasis.opendocument.text",
|
||||
"extensions": [".odt"]
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oasis.opendocument.spreadsheet",
|
||||
"extensions": [".ods"]
|
||||
},
|
||||
{
|
||||
"mediaType": "application/vnd.oasis.opendocument.presentation",
|
||||
"extensions": [".odp"]
|
||||
}
|
||||
],
|
||||
"produces": [
|
||||
{ "mediaType": "application/json", "extensions": [".json"] },
|
||||
{ "mediaType": "application/octet-stream", "extensions": [] }
|
||||
]
|
||||
},
|
||||
"capabilities": { "required": [], "optional": ["web-crypto", "web-share"] },
|
||||
"privacy": {
|
||||
"processing": "local",
|
||||
"fileUploads": true,
|
||||
|
||||
Reference in New Issue
Block a user