repro-tools/README.md

Repro Tools

Build, compare and package reproducible file inventories locally in the browser. No selected file is uploaded.

Features

• Multi-file and directory selection with normalized, deterministic code-point path ordering.
• SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics, with bounded cancellable chunk reads and byte progress.
• Reference comparison showing matching, changed, missing and unexpected files.
• Stable JSON and spreadsheet-safe CSV reports.
• Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
• Streaming ZIP-content manifests and compression-independent comparisons under explicit expansion limits.
• CycloneDX JSON, SPDX JSON and npm-lockfile inspection with portable evidence and an explicitly non-conformant local provenance statement.
• Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
• Offline PWA, responsive shell and light/dark/system themes.

Limits and interpretation

Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. ZIP inspection is limited to 5,000 entries, 32 MiB per expanded file and 256 MiB expanded in total; entries remain inert browser data and are never written to a filesystem. Web Crypto exposes one-shot SHA finalization, so bounded chunks are retained for each file before the digest call. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.

Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible. Provenance output is local evidence and deliberately makes no SLSA, attestation-authority or builder-identity claim.

Development

npm ci
npm run check
npm run test:browser
npm run package:release -- --force

Node.js 22+ and npm 11 are required. The deterministic release is release/repro-tools-0.2.0.zip with its SHA-256 sidecar.

Licence

GPL-3.0-or-later.