Release Repro Tools 0.2.0

public/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.0 - 2026-09-02
+
+- Add streamed hashing, richer deterministic ZIP controls, SPDX-like SBOM
+  inventory and provenance statements with explicit local signing evidence.
+
 ## 0.1.0 - 2026-09-01
 
 - Initial local file/directory SHA-256 and SHA-512 manifest workflow.

public/LICENSES/npm-runtime-licenses.txt

@@ -1,5 +1,5 @@
 ==============================================================================
-@add-ideas/toolbox-contract@0.2.3
+@add-ideas/toolbox-contract@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---
@@ -198,7 +198,7 @@ Declared licence: Apache-2.0
 
 
 ==============================================================================
-@add-ideas/toolbox-helpers@0.1.0
+@add-ideas/toolbox-helpers@0.2.0
 Declared licence: GPL-3.0-or-later
 ==============================================================================
 --- LICENSE ---
@@ -879,7 +879,7 @@ Public License instead of this License.  But first, please read
 
 
 ==============================================================================
-@add-ideas/toolbox-shell-react@0.2.3
+@add-ideas/toolbox-shell-react@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---
@@ -1077,6 +1077,33 @@ Declared licence: Apache-2.0
       limitations under the License.
 
 
+==============================================================================
+fflate@0.8.2
+Declared licence: MIT
+==============================================================================
+--- LICENSE ---
+MIT License
+
+Copyright (c) 2023 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ==============================================================================
 react@19.2.8
 Declared licence: MIT

public/README.md

@@ -5,18 +5,20 @@ Build, compare and package reproducible file inventories locally in the browser.
 ## Features
 
 - Multi-file and directory selection with normalized, deterministic code-point path ordering.
-- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics.
+- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics, with bounded cancellable chunk reads and byte progress.
 - Reference comparison showing matching, changed, missing and unexpected files.
 - Stable JSON and spreadsheet-safe CSV reports.
 - Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
+- Streaming ZIP-content manifests and compression-independent comparisons under explicit expansion limits.
+- CycloneDX JSON, SPDX JSON and npm-lockfile inspection with portable evidence and an explicitly non-conformant local provenance statement.
 - Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
 - Offline PWA, responsive shell and light/dark/system themes.
 
 ## Limits and interpretation
 
-Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
+Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. ZIP inspection is limited to 5,000 entries, 32 MiB per expanded file and 256 MiB expanded in total; entries remain inert browser data and are never written to a filesystem. Web Crypto exposes one-shot SHA finalization, so bounded chunks are retained for each file before the digest call. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
 
-Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible.
+Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible. Provenance output is local evidence and deliberately makes no SLSA, attestation-authority or builder-identity claim.
 
 ## Development
 
@@ -27,7 +29,7 @@ npm run test:browser
 npm run package:release -- --force
 ```
 
-Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.1.0.zip` with its SHA-256 sidecar.
+Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.2.0.zip` with its SHA-256 sidecar.
 
 ## Licence
 

public/SOURCE.md

@@ -1,10 +1,10 @@
 # Source identity
 
 - Project: Repro Tools
-- Version: 0.1.0
+- Version: 0.2.0
 - Repository: https://git.add-ideas.de/lotobo/repro-tools
 - Licence: GPL-3.0-or-later
 - Build: Node.js 22+, npm 11, `npm ci && npm run release:artifact`
-- Artifact: `repro-tools-0.1.0.zip`
+- Artifact: `repro-tools-0.2.0.zip`
 
 Dependencies are exactly pinned by `package-lock.json`; runtime licence texts are bundled under `LICENSES/`.

public/THIRD_PARTY_NOTICES.md

@@ -1,3 +1,3 @@
 # Third-party notices
 
-Repro Tools is GPL-3.0-or-later. Runtime dependencies are React, React DOM and the add·ideas Toolbox Contract, Shell and Helpers packages. `fflate` is used only in tests to independently read generated ZIP archives. Exact versions and declared licences are in `package-lock.json`; detected runtime licence texts are generated into `LICENSES/npm-runtime-licenses.txt` in releases.
+Repro Tools is GPL-3.0-or-later. Runtime dependencies are React, React DOM, `fflate` (MIT), and the add·ideas Toolbox Contract, Shell and Helpers packages. `fflate` streams ZIP contents and independently verifies deterministic ZIP output in tests. Exact versions and declared licences are in `package-lock.json`; detected runtime licence texts are generated into `LICENSES/npm-runtime-licenses.txt` in releases.

public/sw.js

@@ -1,5 +1,5 @@
 const CACHE_PREFIX = "repro-tools-shell-";
-const CACHE_NAME = CACHE_PREFIX + "0.1.0";
+const CACHE_NAME = CACHE_PREFIX + "0.2.0";
 const CORE = ["./", "./manifest.webmanifest", "./favicon.svg"];
 self.addEventListener("install", (event) => {
   event.waitUntil(

public/toolbox-app.json

@@ -3,7 +3,7 @@
   "schemaVersion": 1,
   "id": "de.add-ideas.repro-tools",
   "name": "Repro Tools",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Build and verify reproducible file manifests locally.",
   "entry": "./",
   "icon": "./favicon.svg",
@@ -21,6 +21,19 @@
     "crossOriginIsolated": false,
     "topLevelContext": false
   },
+  "io": {
+    "accepts": [
+      { "mediaType": "*/*", "extensions": [] },
+      { "mediaType": "application/zip", "extensions": [".zip"] },
+      { "mediaType": "application/json", "extensions": [".json"] }
+    ],
+    "produces": [
+      { "mediaType": "application/json", "extensions": [".json"] },
+      { "mediaType": "text/csv", "extensions": [".csv"] },
+      { "mediaType": "application/zip", "extensions": [".zip"] }
+    ]
+  },
+  "capabilities": { "required": [], "optional": ["web-crypto"] },
   "privacy": {
     "processing": "local",
     "fileUploads": true,