Release Privacy Tools 0.1.0
This commit is contained in:
@@ -0,0 +1,118 @@
|
||||
# Privacy Tools
|
||||
|
||||
Privacy Tools is a standalone, local-first browser workbench for inspecting
|
||||
image metadata and producing deliberately re-encoded sharing copies. It is part
|
||||
of the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal), but
|
||||
the static release also runs independently at any nested path.
|
||||
|
||||
Selected files stay in the browser. There are no accounts, analytics, remote
|
||||
lookups, telemetry, or runtime network calls. A source file is never modified.
|
||||
|
||||
## Version 0.1 workflow
|
||||
|
||||
1. Select or drop a bounded batch. Every file gets a safe display/download name,
|
||||
SHA-256 hash, byte-signature type detection, and claimed-vs-detected type
|
||||
result.
|
||||
2. Review categorized findings, parser coverage, dimensions, animation or
|
||||
multi-image status, and warnings.
|
||||
3. For a supported static JPEG, PNG, or WebP, explicitly re-encode the decoded
|
||||
pixels. EXIF orientation is normalized; source container blocks, embedded
|
||||
thumbnails, trailing bytes, and source profiles are not copied.
|
||||
4. An independently parsed output is mandatory. The result states what was
|
||||
removed, preserved, generated, unsupported, or incompletely checked, and
|
||||
includes source/output SHA-256 hashes and a bounded decoded-pixel sample
|
||||
comparison.
|
||||
5. Download an individual re-encoded image, a JSON report, or a ZIP containing
|
||||
re-encoded images and the report. The report itself may be sensitive because
|
||||
it contains source filenames and metadata values.
|
||||
|
||||
## Format support
|
||||
|
||||
| Format | Inventory | Deep project scan | Secondary scan | Pixel re-encode |
|
||||
| ------------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------ |
|
||||
| Static JPEG | Yes | EXIF/TIFF, IPTC/Photoshop, XMP, JFIF, ICC, COM, MPF, selected JUMBF/C2PA and trailing bytes | ExifReader | JPEG |
|
||||
| Static PNG | Yes | tEXt, zTXt, iTXt/XMP, eXIf/TIFF, iCCP, pHYs, tIME, private/unknown ancillary chunks, selected caBX/C2PA and trailing bytes | ExifReader | PNG |
|
||||
| Static WebP | Yes | RIFF/VP8 dimensions, EXIF/TIFF, XMP, ICC, META, animation and trailing bytes | ExifReader | WebP where the browser encoder supports it |
|
||||
| TIFF, HEIC/HEIF, AVIF, JPEG XL | Yes | No | Best-effort ExifReader inspection | No |
|
||||
| GIF | Yes | No | No supported deep adapter | No |
|
||||
| PDF, ZIP/Office, OLE/legacy Office, unknown | Yes | No | No | No |
|
||||
|
||||
Animation, multi-picture JPEG/MPF, and malformed or partially scanned
|
||||
JPEG/PNG/WebP inputs are inspect-only. Secondary coverage depends on what
|
||||
ExifReader can establish for the particular container. A browser may decode a
|
||||
format it cannot encode; that still does not make it eligible for output.
|
||||
|
||||
Findings are grouped as location; people/authorship/rights; dates; device,
|
||||
serial and lens; software/history; document identifiers; comments/titles/
|
||||
keywords; embedded previews; colour profiles; provenance; technical; or
|
||||
unclassified. Raw XMP is shown only as bounded inert text—never injected as
|
||||
markup.
|
||||
|
||||
## Security boundaries and limits
|
||||
|
||||
Inputs are untrusted. Container parsing runs in a terminable worker and checks
|
||||
declared lengths, CRCs, offsets, TIFF cycles/depth/counts, chunk/segment counts,
|
||||
compressed metadata expansion, dimensions, and aggregate batch size before
|
||||
continuing. Defaults are 100 files, 128 MiB per file, 512 MiB per batch, 4,096
|
||||
metadata blocks/findings, 8 MiB per metadata block, 4 MiB decompressed metadata,
|
||||
512-character labels, 16,384-character values, 256 KiB normalized finding text
|
||||
per file, 40 megapixels, a 32,768-pixel edge, and a 256 MiB ZIP payload.
|
||||
|
||||
The pixel decode/encode step uses browser-native image and Canvas APIs. It runs
|
||||
only after a complete project scan and bounded dimensions. The output gate does
|
||||
not trust successful encoding: it hashes and scans the newly encoded bytes
|
||||
again. C2PA/JUMBF provenance is authenticity information rather than ordinary
|
||||
tracking metadata; pixel re-encoding removes or invalidates it, and the report
|
||||
calls that out.
|
||||
|
||||
This is not an anonymity tool. Metadata removal does not remove visible faces
|
||||
or text, steganography, invisible or forensic watermarks, reverse-image
|
||||
matching, sidecar files, filesystem history, application caches, or cloud and
|
||||
recipient copies. JPEG and lossy WebP output may alter pixels. Colour profiles,
|
||||
resolution metadata, and provenance may be lost. Inspect the actual output and
|
||||
report before sharing it.
|
||||
|
||||
See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and
|
||||
[docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md) for the implementation and
|
||||
threat model.
|
||||
|
||||
## Browser and accessibility support
|
||||
|
||||
Current evergreen Chromium and Firefox are exercised in the browser gate;
|
||||
current Safari is an intended target. JavaScript modules, Web Workers, Blob,
|
||||
Canvas 2D, `createImageBitmap` where available, and Web Crypto are used. WebP
|
||||
output follows browser encoder support. The application supports the shared
|
||||
Toolbox system/light/dark themes, keyboard file selection, native table and
|
||||
disclosure semantics, visible focus, live progress, and non-colour status text.
|
||||
|
||||
## Development
|
||||
|
||||
Requirements: Node.js 22 or newer and npm 11 or newer.
|
||||
|
||||
```sh
|
||||
npm ci
|
||||
npm run check
|
||||
npm run test:browser
|
||||
npm run dev
|
||||
```
|
||||
|
||||
Vite uses `base: './'`, so `dist/` can be hosted at `/` or below a nested
|
||||
Toolbox path. `toolbox-check` validates the production manifest and bundle.
|
||||
|
||||
## Release
|
||||
|
||||
```sh
|
||||
npm run release:artifact
|
||||
```
|
||||
|
||||
This checks the manifest, types, lint, formatting, unit fixtures, production
|
||||
build, Toolbox contract, and Chromium/Firefox workflows, then creates the
|
||||
deterministic `release/privacy-tools-0.1.0.zip` plus its SHA-256 sidecar. The
|
||||
archive contains the static application, project documents, and exact runtime
|
||||
dependency licence texts.
|
||||
|
||||
## Licence
|
||||
|
||||
Privacy Tools is free software under `GPL-3.0-or-later`; see [LICENSE](LICENSE).
|
||||
Runtime dependencies keep their licences, including ExifReader under MPL-2.0.
|
||||
See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
|
||||
Reference in New Issue
Block a user