35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# Repro Tools
|
|
|
|
Build, compare and package reproducible file inventories locally in the browser. No selected file is uploaded.
|
|
|
|
## Features
|
|
|
|
- Multi-file and directory selection with normalized, deterministic code-point path ordering.
|
|
- SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics.
|
|
- Reference comparison showing matching, changed, missing and unexpected files.
|
|
- Stable JSON and spreadsheet-safe CSV reports.
|
|
- Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
|
|
- Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
|
|
- Offline PWA, responsive shell and light/dark/system themes.
|
|
|
|
## Limits and interpretation
|
|
|
|
Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.
|
|
|
|
Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible.
|
|
|
|
## Development
|
|
|
|
```sh
|
|
npm ci
|
|
npm run check
|
|
npm run test:browser
|
|
npm run package:release -- --force
|
|
```
|
|
|
|
Node.js 22+ and npm 11 are required. The deterministic release is `release/repro-tools-0.1.0.zip` with its SHA-256 sidecar.
|
|
|
|
## Licence
|
|
|
|
GPL-3.0-or-later.
|