lotobo/repro-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Repro Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 07:40:24 +02:00
parent 98b1e5c23c
commit bf5b72938a
23 changed files with 1315 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -4
View File
@@ -5,18 +5,20 @@ Build, compare and package reproducible file inventories locally in the browser.
## Features
- Multi-file and directory selection with normalized, deterministic code-point path ordering.
- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics.
- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics, with bounded cancellable chunk reads and byte progress.
- Reference comparison showing matching, changed, missing and unexpected files.
- Stable JSON and spreadsheet-safe CSV reports.
- Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
- Streaming ZIP-content manifests and compression-independent comparisons under explicit expansion limits.
- CycloneDX JSON, SPDX JSON and npm-lockfile inspection with portable evidence and an explicitly non-conformant local provenance statement.
- Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
- Offline PWA, responsive shell and light/dark/system themes.
## Limits and interpretation
Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. ZIP inspection is limited to 5,000 entries, 32 MiB per expanded file and 256 MiB expanded in total; entries remain inert browser data and are never written to a filesystem. Web Crypto exposes one-shot SHA finalization, so bounded chunks are retained for each file before the digest call. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible.
Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible. Provenance output is local evidence and deliberately makes no SLSA, attestation-authority or builder-identity claim.
## Development
@@ -27,7 +29,7 @@ npm run test:browser
npm run package:release -- --force
```
Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.1.0.zip` with its SHA-256 sidecar.
Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.2.0.zip` with its SHA-256 sidecar.
## Licence