56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
# Package Tools
|
|
|
|
Package Tools is a production-oriented, local-first browser workbench for
|
|
inspecting ZIP/ZIP64 compound packages. It exposes the container tree and adds
|
|
bounded, format-aware interpretation for EPUB, OOXML (`.docx`, `.xlsx`,
|
|
`.pptx`), OpenDocument (`.odt`, `.ods`, `.odp`), JAR, APK, and Chrome/Firefox
|
|
extension packages.
|
|
|
|
Version 0.1.0 can:
|
|
|
|
- inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
|
|
- reject traversal, ambiguous, colliding and special-entry paths;
|
|
- detect excessive expansion and compression ratios before preview;
|
|
- interpret OOXML content types and internal/external relationships;
|
|
- inspect EPUB container/package metadata and manifest/spine consistency;
|
|
- inspect ODF manifests, JAR manifests and WebExtension manifests;
|
|
- inventory known signature-material files without asserting validity or trust;
|
|
- flag missing relationship/manifest targets and unreferenced embedded media;
|
|
- preview bounded text, raster images, audio and video, and download a strictly
|
|
re-read entry;
|
|
- compare two package inventories by path, kind, size, compressed size and CRC;
|
|
- export an inert JSON inventory report.
|
|
|
|
All processing happens in the browser. The app has no telemetry, remote parser,
|
|
CDN assets or automatic network lookups.
|
|
|
|
## Run and verify
|
|
|
|
```sh
|
|
npm ci
|
|
npm run dev
|
|
npm run check
|
|
npm run test:browser
|
|
npm run package:release -- --force
|
|
```
|
|
|
|
Node.js 22 or newer and the Chromium/Firefox Playwright browsers are required
|
|
for the complete verification suite.
|
|
|
|
## Boundaries
|
|
|
|
Package Tools is an inspection aid, not a renderer for office/ebook content,
|
|
an APK resource decoder, a Java class analyser, an extension sandbox, or a
|
|
signature verifier. It never establishes authenticity or publisher trust.
|
|
Encrypted entries, split archives, unsafe paths, unsupported compression, and
|
|
entries beyond the configured byte budgets remain inventory-only.
|
|
|
|
APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded
|
|
in v0.1. Chrome CRX wrapper headers are not a guaranteed input format; use an
|
|
unpacked ZIP-form extension package when needed.
|
|
|
|
## Licence
|
|
|
|
Copyright © 2026 Albrecht Degering. Package Tools is free software licensed
|
|
under the GNU General Public License v3.0 or later. See `LICENSE`.
|