68 lines
2.9 KiB
Markdown
68 lines
2.9 KiB
Markdown
# Package Tools
|
|
|
|
Package Tools is a production-oriented, local-first browser workbench for
|
|
inspecting ZIP/ZIP64 compound packages. It exposes the container tree and adds
|
|
bounded, format-aware interpretation for EPUB, OOXML (`.docx`, `.xlsx`,
|
|
`.pptx`), OpenDocument (`.odt`, `.ods`, `.odp`), JAR, APK, and Chrome/Firefox
|
|
extension packages.
|
|
|
|
Version 0.2.0 can:
|
|
|
|
- inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
|
|
- reject traversal, ambiguous, colliding and special-entry paths;
|
|
- detect excessive expansion and compression ratios before preview;
|
|
- interpret OOXML content types and internal/external relationships;
|
|
- inspect EPUB container/package metadata and manifest/spine consistency;
|
|
- inspect ODF manifests, JAR manifests and WebExtension manifests;
|
|
- inventory signature-material pairs and declared digest algorithms without
|
|
asserting validity or trust;
|
|
- extract bounded dependency declarations from package.json, Python requirements,
|
|
Maven metadata and JAR Class-Path, plus conventional licence-file evidence;
|
|
- flag missing relationship/manifest targets and unreferenced embedded media;
|
|
- preview bounded text, raster images, audio and video, and download a strictly
|
|
re-read entry;
|
|
- compare two packages using bounded, on-demand SHA-256 of verified
|
|
decompressed entries; matching metadata/CRC alone remains explicitly
|
|
unverified;
|
|
- summarize safe bounded JSON, XML, manifest and text differences without
|
|
rendering or executing package content;
|
|
- export an inert JSON inventory report.
|
|
- explicitly hand a verified entry to the browser/OS share surface where
|
|
supported, with verified download-and-reopen as the local-only fallback.
|
|
|
|
All processing happens in the browser. The app has no telemetry, remote parser,
|
|
CDN assets or automatic network lookups.
|
|
|
|
## Run and verify
|
|
|
|
```sh
|
|
npm ci
|
|
npm run dev
|
|
npm run check
|
|
npm run test:browser
|
|
npm run package:release -- --force
|
|
```
|
|
|
|
Node.js 22 or newer and the Chromium/Firefox Playwright browsers are required
|
|
for the complete verification suite.
|
|
|
|
## Boundaries
|
|
|
|
Package Tools is an inspection aid, not a renderer for office/ebook content,
|
|
an APK resource decoder, a Java class analyser, an extension sandbox, or a
|
|
signature verifier. It never establishes authenticity or publisher trust.
|
|
Dependency declarations are not resolved or vulnerability-checked, and licence
|
|
evidence is not a legal interpretation. A chosen OS share target can upload a
|
|
file even though Package Tools itself never does.
|
|
Encrypted entries, split archives, unsafe paths, unsupported compression, and
|
|
entries beyond the configured byte budgets remain inventory-only.
|
|
|
|
APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded
|
|
in v0.2. Chrome CRX wrapper headers are not a guaranteed input format; use an
|
|
unpacked ZIP-form extension package when needed.
|
|
|
|
## Licence
|
|
|
|
Copyright © 2026 Albrecht Degering. Package Tools is free software licensed
|
|
under the GNU General Public License v3.0 or later. See `LICENSE`.
|