Release Repro Tools 0.1.0

2026-09-01 13:04:50 +02:00
commit 98b1e5c23c
57 changed files with 9817 additions and 0 deletions
@@ -0,0 +1,34 @@
+# Repro Tools
+
+Build, compare and package reproducible file inventories locally in the browser. No selected file is uploaded.
+
+## Features
+
+- Multi-file and directory selection with normalized, deterministic code-point path ordering.
+- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics.
+- Reference comparison showing matching, changed, missing and unexpected files.
+- Stable JSON and spreadsheet-safe CSV reports.
+- Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
+- Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
+- Offline PWA, responsive shell and light/dark/system themes.
+
+## Limits and interpretation
+
+Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
+
+Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible.
+
+## Development
+
+```sh
+npm ci
+npm run check
+npm run test:browser
+npm run package:release -- --force
+```
+
+Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.1.0.zip` with its SHA-256 sidecar.
+
+## Licence
+
+GPL-3.0-or-later.