From ea5f76554a48a5ff4a6c39bf36dc903d631ef3de Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 1 Sep 2026 08:32:15 +0200 Subject: [PATCH] Publish Toolbox 0.18.1 with local-only Random Tools --- .env.example | 4 ++-- Containerfile.release | 4 ++-- README.md | 32 +++++++++++++++---------------- compose.example.yaml | 2 +- compose.yaml | 6 +++--- deploy/nginx.conf | 7 +------ package-lock.json | 4 ++-- package.json | 2 +- public/SOURCE.md | 4 ++-- release/toolbox.lock.example.json | 10 +++++----- release/toolbox.lock.json | 10 +++++----- scripts/assembler.test.ts | 2 +- scripts/deployment.test.ts | 10 ++++------ src/App.tsx | 4 ++-- 14 files changed, 47 insertions(+), 54 deletions(-) diff --git a/.env.example b/.env.example index 4695eb9..cfc1851 100644 --- a/.env.example +++ b/.env.example @@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal TRAEFIK_CERT_RESOLVER=netcup # Keep these two values paired when deploying a newer published toolbox release. -TOOLBOX_RELEASE_VERSION=0.18.0 -TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c +TOOLBOX_RELEASE_VERSION=0.18.1 +TOOLBOX_RELEASE_SHA256=bd9f088bac80071cfafc934bc7fc04ffbfb1ada5ef417dbbe85bde878cb34f85 diff --git a/Containerfile.release b/Containerfile.release index 784f501..3c715d6 100644 --- a/Containerfile.release +++ b/Containerfile.release @@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3 FROM ${NGINX_IMAGE} AS release -ARG TOOLBOX_RELEASE_VERSION=0.18.0 -ARG TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c +ARG TOOLBOX_RELEASE_VERSION=0.18.1 +ARG TOOLBOX_RELEASE_SHA256=bd9f088bac80071cfafc934bc7fc04ffbfb1ada5ef417dbbe85bde878cb34f85 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download RUN set -eu; \ diff --git a/README.md b/README.md index b6c1fb9..7202b2e 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # add·ideas Toolbox Portal `toolbox-portal` is the static launcher and release assembler for the add·ideas -browser toolbox. Version `0.2.20` reads one same-origin catalogue, shows each app +browser toolbox. Version `0.2.21` reads one same-origin catalogue, shows each app as a compact launch tile, and keeps personal pins, drag-and-drop ordering, visibility, and appearance in the current browser. Pinned tools have their own section; search, category, and clickable tag filters stay close to the tool @@ -74,7 +74,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported ## Production deployment behind Traefik The committed `compose.yaml` is the shortest production path. Its release -container downloads the immutable Toolbox 0.18.0 ZIP during the image build, +container downloads the immutable Toolbox 0.18.1 ZIP during the image build, verifies SHA-256 before extracting it, and then copies only the verified static files into the pinned unprivileged nginx image. Node.js and a local portal assembly are not required on the deployment host. @@ -138,7 +138,7 @@ The app release should also publish a matching `.sha256` sidecar. The manifest must declare the pinned reverse-DNS id and version. Application and portal versions are independent. -`release/toolbox.lock.json` is the reviewed Toolbox v0.18.0 / Portal v0.2.20 +`release/toolbox.lock.json` is the reviewed Toolbox v0.18.1 / Portal v0.2.21 lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, OTP & Passkey @@ -166,7 +166,7 @@ npm run assemble -- \ --lock release/toolbox.lock.json \ --portal-dist dist \ --output build/toolbox \ - --archive build/add-ideas-toolbox-0.18.0.zip + --archive build/add-ideas-toolbox-0.18.1.zip ``` Existing output is refused. Pass `--force` only when replacing those exact @@ -209,8 +209,8 @@ build/toolbox/ ├── text/ └── unicode/ -build/add-ideas-toolbox-0.18.0.zip -build/add-ideas-toolbox-0.18.0.zip.sha256 +build/add-ideas-toolbox-0.18.1.zip +build/add-ideas-toolbox-0.18.1.zip.sha256 ``` The assembler verifies SHA-256 before opening an artifact, validates every app @@ -231,7 +231,7 @@ directory separately: ```sh npm run package:static -- \ --input build/toolbox \ - --output artifacts/add-ideas-toolbox-0.18.0.zip + --output artifacts/add-ideas-toolbox-0.18.1.zip ``` This also emits a `.sha256` sidecar. @@ -249,9 +249,9 @@ default. It is granted to the dedicated `auth.toolbox.add-ideas.de` origin and, on the shared Toolbox host, only to `/apps/barcode/`; both apps still request it only after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host -at the same time. Random Tools is the only app whose path-specific CSP permits -an external connection, and only to `https://www.random.org`; the app requires -explicit per-session consent before making that optional request. +at the same time. Every Toolbox app, including Random Tools, is constrained to +same-origin connections. Random Tools implements its random generators locally +with browser APIs and never calls a third-party randomness service. The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's `ixsl:eval()` extension is therefore unsupported in this deployment profile; @@ -261,9 +261,9 @@ Assemble first, then: ```sh podman build -f Containerfile \ - -t git.add-ideas.de/lotobo/toolbox:0.18.0 . + -t git.add-ideas.de/lotobo/toolbox:0.18.1 . podman run --rm -p 8080:8080 \ - git.add-ideas.de/lotobo/toolbox:0.18.0 + git.add-ideas.de/lotobo/toolbox:0.18.1 ``` For a direct-port local deployment after assembly, use the separate example: @@ -280,7 +280,7 @@ docker login git.add-ideas.de docker buildx build \ --platform linux/amd64,linux/arm64 \ --file Containerfile.release \ - --tag git.add-ideas.de/lotobo/toolbox:0.18.0 \ + --tag git.add-ideas.de/lotobo/toolbox:0.18.1 \ --tag git.add-ideas.de/lotobo/toolbox:0.18 \ --push . ``` @@ -306,8 +306,8 @@ needs permission to push code, releases, and container packages to all 26 apps, switch between them, and confirm the encoded `toolbox` context. 5. Verify the distribution with - `(cd build && sha256sum -c add-ideas-toolbox-0.18.0.zip.sha256)`. -6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.0`), and + `(cd build && sha256sum -c add-ideas-toolbox-0.18.1.zip.sha256)`. +6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.1`), and push the branch and tag to Gitea. 7. In Gitea, open **Releases → New release**, select the tag, and upload the static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a @@ -344,7 +344,7 @@ must not re-resolve app versions or substitute a newer release. | **`network-tools`** | Initial offline v0.1.0 release; dedicated repository | Calculate IP networks and construct or inspect common network values | IPv4/IPv6 canonicalization and CIDR ranges; URL/query parsing without navigation; DNS-record construction; response-header inspection; CSP builder; MIME reference | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations | | **`geo-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, convert, simplify and analyse geospatial files | GeoJSON, GPX, KML and coordinate CSV; WGS 84 bounds, distance and elevation; Douglas–Peucker simplification; decimal/DMS conversion; coordinate-only sketch | Small Point/LineString/Polygon model with scalar properties; conversion losses are explicit; no CRS transformation, basemap request or survey-grade claim | | **`helper-tools`** | Initial v0.1.0 app and reusable package release | Encode, convert, inspect and calculate with shared bounded primitives | Base/byte/text/URL conversion; Unicode and line transforms; exact number and unit conversion; hashes; CIDR; timestamps; hardened JSON/CSV; secure and seeded random primitives; deep-linked calculator workspaces | Framework-free `@add-ideas/toolbox-helpers` package is consumed directly by eleven v0.1 apps; operations disclose strictness, limits and non-cryptographic seeded boundaries | -| **`rand-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; optional RANDOM.ORG integers | Secure local generation never falls back; deterministic output is not secret; the one remote source requires explicit per-session consent and a path-specific CSP and may still be unavailable through CORS or service limits | +| **`rand-tools`** | Local-only v0.1.1 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; all generators run entirely in the browser | Secure local generation never falls back; deterministic output is reproducible rather than secret; the app makes no third-party randomness request and the Portal grants it no external network destination | | **`data-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, format, query, flatten and convert structured data | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; all-format conversion with loss/coercion reports; spreadsheet-formula neutralization | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability | | **`diff-tools`** | Initial local-first v0.1.0 release; dedicated repository | Compare text, JSON, XML and delimited data semantically | Line/word/code-point/grapheme text diff; exact newline state; object-aware exact-number JSON and RFC 6902; namespace-aware XML rules; keyed CSV/TSV; unified/side-by-side views and portable reports | Normalization settings and ignored distinctions remain visible; bounded disposable worker; v0.1 intentionally excludes images, binary documents, directories and archives | | **`time-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert timestamps and explore zones, arithmetic and recurrence | Exact signed nanosecond epochs; IANA-zone comparisons and DST ambiguity; wall-clock versus elapsed arithmetic; bounded cron and RRULE previews; business days; escaped UTC ICS export | Uses the browser's IANA data and does not model leap seconds; regional holidays are never inferred; recurrence and skipped/ambiguous local-time choices are explicit | diff --git a/compose.example.yaml b/compose.example.yaml index f3672d7..ae369b1 100644 --- a/compose.example.yaml +++ b/compose.example.yaml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Containerfile - image: git.add-ideas.de/lotobo/toolbox:0.18.0 + image: git.add-ideas.de/lotobo/toolbox:0.18.1 restart: unless-stopped read_only: true ports: diff --git a/compose.yaml b/compose.yaml index 99c398c..0431b04 100644 --- a/compose.yaml +++ b/compose.yaml @@ -6,9 +6,9 @@ services: context: . dockerfile: Containerfile.release args: - TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.18.0}" - TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c}" - image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.18.0}" + TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.18.1}" + TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-bd9f088bac80071cfafc934bc7fc04ffbfb1ada5ef417dbbe85bde878cb34f85}" + image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.18.1}" restart: unless-stopped read_only: true tmpfs: diff --git a/deploy/nginx.conf b/deploy/nginx.conf index 179423d..a7bf4fe 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -20,11 +20,6 @@ map "$host:$uri" $toolbox_permissions_policy { "~^[^:]+:/apps/barcode(?:/|$)" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"; } -map $uri $toolbox_connect_sources { - default "'self'"; - "~^/apps/rand(?:/|$)" "'self' https://www.random.org"; -} - server { listen 8080; listen [::]:8080; @@ -43,7 +38,7 @@ server { add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always; add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always; add_header Permissions-Policy $toolbox_permissions_policy always; - add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src $toolbox_connect_sources; worker-src 'self' blob:; manifest-src 'self'" always; + add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always; add_header Cache-Control $toolbox_cache_control always; gzip on; diff --git a/package-lock.json b/package-lock.json index 1d6de38..bc2829b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.20", + "version": "0.2.21", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@add-ideas/toolbox-portal", - "version": "0.2.20", + "version": "0.2.21", "license": "AGPL-3.0-only", "dependencies": { "@add-ideas/toolbox-contract": "^0.2.3", diff --git a/package.json b/package.json index 2174d80..3666187 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.20", + "version": "0.2.21", "license": "AGPL-3.0-only", "private": true, "type": "module", diff --git a/public/SOURCE.md b/public/SOURCE.md index ee95b0d..2bacccf 100644 --- a/public/SOURCE.md +++ b/public/SOURCE.md @@ -1,8 +1,8 @@ # Corresponding source -The source code corresponding to add·ideas Toolbox Portal 0.2.20 is available at: +The source code corresponding to add·ideas Toolbox Portal 0.2.21 is available at: -https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.18.0 +https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.18.1 Each bundled application contains its own `SOURCE.md`, license, and third-party license materials. The application sources are also linked from the portal. diff --git a/release/toolbox.lock.example.json b/release/toolbox.lock.example.json index 405c5c5..94bfa5f 100644 --- a/release/toolbox.lock.example.json +++ b/release/toolbox.lock.example.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.18.0", - "portalVersion": "0.2.20", + "releaseVersion": "0.18.1", + "portalVersion": "0.2.21", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -155,9 +155,9 @@ }, { "id": "de.add-ideas.rand-tools", - "version": "0.1.0", - "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip", - "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25", + "version": "0.1.1", + "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.1/rand-tools-0.1.1.zip", + "sha256": "02dffcbbf1c3ff65236a83466aa750c3848777e4a69ac389fe24da02abfc0e77", "target": "rand" }, { diff --git a/release/toolbox.lock.json b/release/toolbox.lock.json index 405c5c5..94bfa5f 100644 --- a/release/toolbox.lock.json +++ b/release/toolbox.lock.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.18.0", - "portalVersion": "0.2.20", + "releaseVersion": "0.18.1", + "portalVersion": "0.2.21", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -155,9 +155,9 @@ }, { "id": "de.add-ideas.rand-tools", - "version": "0.1.0", - "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip", - "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25", + "version": "0.1.1", + "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.1/rand-tools-0.1.1.zip", + "sha256": "02dffcbbf1c3ff65236a83466aa750c3848777e4a69ac389fe24da02abfc0e77", "target": "rand" }, { diff --git a/scripts/assembler.test.ts b/scripts/assembler.test.ts index fe33bba..255ebc1 100644 --- a/scripts/assembler.test.ts +++ b/scripts/assembler.test.ts @@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) { return { schemaVersion: 1, releaseVersion: '0.1.0', - portalVersion: '0.2.20', + portalVersion: '0.2.21', catalogue: { id: 'de.add-ideas.toolbox', name: 'Test Toolbox', diff --git a/scripts/deployment.test.ts b/scripts/deployment.test.ts index 750c9c7..802fac6 100644 --- a/scripts/deployment.test.ts +++ b/scripts/deployment.test.ts @@ -214,14 +214,12 @@ describe('production deployment', () => { ).toHaveLength(1); }); - it('allows RANDOM.ORG only for the explicitly opt-in Random Tools path', () => { + it('keeps application network connections same-origin', () => { expect(nginxConfig).toMatch( - /map \$uri \$toolbox_connect_sources\s*\{\s*default "'self'";\s*"~\^\/apps\/rand\(\?:\/\|\$\)" "'self' https:\/\/www\.random\.org";\s*\}/mu + /^\s*add_header Content-Security-Policy "[^"]*connect-src 'self';[^"]*" always;$/mu ); - expect(nginxConfig).toMatch( - /^\s*add_header Content-Security-Policy "[^"]*connect-src \$toolbox_connect_sources;[^"]*" always;$/mu - ); - expect(nginxConfig.match(/https:\/\/www\.random\.org/gu)).toHaveLength(1); + expect(nginxConfig).not.toContain('$toolbox_connect_sources'); + expect(nginxConfig).not.toMatch(/https?:\/\//u); }); it('quotes nginx regular expressions that contain brace quantifiers', () => { diff --git a/src/App.tsx b/src/App.tsx index 3ccadff..510ac40 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -489,9 +489,9 @@ export default function App() {

- Portal v0.2.20 ·{' '} + Portal v0.2.21 ·{' '}