lotobo/toolbox-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Publish Toolbox 0.18.1 with local-only Random Tools

Browse Source
This commit is contained in:
zemion
2026-09-01 08:32:15 +02:00
parent 08a01d843a
commit ea5f76554a
14 changed files with 47 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -16
View File
@@ -1,7 +1,7 @@
# add·ideas Toolbox Portal
`toolbox-portal` is the static launcher and release assembler for the add·ideas
browser toolbox. Version `0.2.20` reads one same-origin catalogue, shows each app
browser toolbox. Version `0.2.21` reads one same-origin catalogue, shows each app
as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
visibility, and appearance in the current browser. Pinned tools have their own
section; search, category, and clickable tag filters stay close to the tool
@@ -74,7 +74,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
## Production deployment behind Traefik
The committed `compose.yaml` is the shortest production path. Its release
container downloads the immutable Toolbox 0.18.0 ZIP during the image build,
container downloads the immutable Toolbox 0.18.1 ZIP during the image build,
verifies SHA-256 before extracting it, and then copies only the verified static
files into the pinned unprivileged nginx image. Node.js and a local portal
assembly are not required on the deployment host.
@@ -138,7 +138,7 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
must declare the pinned reverse-DNS id and version. Application and portal
versions are independent.
`release/toolbox.lock.json` is the reviewed Toolbox v0.18.0 / Portal v0.2.20
`release/toolbox.lock.json` is the reviewed Toolbox v0.18.1 / Portal v0.2.21
lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools
0.4.3, OneNote Tools 0.3.4,
Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, OTP & Passkey
@@ -166,7 +166,7 @@ npm run assemble -- \
--lock release/toolbox.lock.json \
--portal-dist dist \
--output build/toolbox \
--archive build/add-ideas-toolbox-0.18.0.zip
--archive build/add-ideas-toolbox-0.18.1.zip
```
Existing output is refused. Pass `--force` only when replacing those exact
@@ -209,8 +209,8 @@ build/toolbox/
├── text/
└── unicode/
build/add-ideas-toolbox-0.18.0.zip
build/add-ideas-toolbox-0.18.0.zip.sha256
build/add-ideas-toolbox-0.18.1.zip
build/add-ideas-toolbox-0.18.1.zip.sha256
```
The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -231,7 +231,7 @@ directory separately:
```sh
npm run package:static -- \
--input build/toolbox \
--output artifacts/add-ideas-toolbox-0.18.0.zip
--output artifacts/add-ideas-toolbox-0.18.1.zip
```
This also emits a `.sha256` sidecar.
@@ -249,9 +249,9 @@ default. It is granted to the dedicated `auth.toolbox.add-ideas.de` origin and,
on the shared Toolbox host, only to `/apps/barcode/`; both apps still request it
only after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update
the exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host
at the same time. Random Tools is the only app whose path-specific CSP permits
an external connection, and only to `https://www.random.org`; the app requires
explicit per-session consent before making that optional request.
at the same time. Every Toolbox app, including Random Tools, is constrained to
same-origin connections. Random Tools implements its random generators locally
with browser APIs and never calls a third-party randomness service.
The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
`ixsl:eval()` extension is therefore unsupported in this deployment profile;
@@ -261,9 +261,9 @@ Assemble first, then:
```sh
podman build -f Containerfile \
-t git.add-ideas.de/lotobo/toolbox:0.18.0 .
-t git.add-ideas.de/lotobo/toolbox:0.18.1 .
podman run --rm -p 8080:8080 \
git.add-ideas.de/lotobo/toolbox:0.18.0
git.add-ideas.de/lotobo/toolbox:0.18.1
```
For a direct-port local deployment after assembly, use the separate example:
@@ -280,7 +280,7 @@ docker login git.add-ideas.de
docker buildx build \
--platform linux/amd64,linux/arm64 \
--file Containerfile.release \
--tag git.add-ideas.de/lotobo/toolbox:0.18.0 \
--tag git.add-ideas.de/lotobo/toolbox:0.18.1 \
--tag git.add-ideas.de/lotobo/toolbox:0.18 \
--push .
```
@@ -306,8 +306,8 @@ needs permission to push code, releases, and container packages to
all 26 apps, switch between them, and confirm the encoded `toolbox`
context.
5. Verify the distribution with
`(cd build && sha256sum -c add-ideas-toolbox-0.18.0.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.0`), and
`(cd build && sha256sum -c add-ideas-toolbox-0.18.1.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.1`), and
push the branch and tag to Gitea.
7. In Gitea, open **Releases → New release**, select the tag, and upload the
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -344,7 +344,7 @@ must not re-resolve app versions or substitute a newer release.
| **`network-tools`** | Initial offline v0.1.0 release; dedicated repository | Calculate IP networks and construct or inspect common network values | IPv4/IPv6 canonicalization and CIDR ranges; URL/query parsing without navigation; DNS-record construction; response-header inspection; CSP builder; MIME reference | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations |
| **`geo-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, convert, simplify and analyse geospatial files | GeoJSON, GPX, KML and coordinate CSV; WGS 84 bounds, distance and elevation; Douglas–Peucker simplification; decimal/DMS conversion; coordinate-only sketch | Small Point/LineString/Polygon model with scalar properties; conversion losses are explicit; no CRS transformation, basemap request or survey-grade claim |
| **`helper-tools`** | Initial v0.1.0 app and reusable package release | Encode, convert, inspect and calculate with shared bounded primitives | Base/byte/text/URL conversion; Unicode and line transforms; exact number and unit conversion; hashes; CIDR; timestamps; hardened JSON/CSV; secure and seeded random primitives; deep-linked calculator workspaces | Framework-free `@add-ideas/toolbox-helpers` package is consumed directly by eleven v0.1 apps; operations disclose strictness, limits and non-cryptographic seeded boundaries |
| **`rand-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; optional RANDOM.ORG integers | Secure local generation never falls back; deterministic output is not secret; the one remote source requires explicit per-session consent and a path-specific CSP and may still be unavailable through CORS or service limits |
| **`rand-tools`** | Local-only v0.1.1 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; all generators run entirely in the browser | Secure local generation never falls back; deterministic output is reproducible rather than secret; the app makes no third-party randomness request and the Portal grants it no external network destination |
| **`data-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, format, query, flatten and convert structured data | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; all-format conversion with loss/coercion reports; spreadsheet-formula neutralization | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability |
| **`diff-tools`** | Initial local-first v0.1.0 release; dedicated repository | Compare text, JSON, XML and delimited data semantically | Line/word/code-point/grapheme text diff; exact newline state; object-aware exact-number JSON and RFC 6902; namespace-aware XML rules; keyed CSV/TSV; unified/side-by-side views and portable reports | Normalization settings and ignored distinctions remain visible; bounded disposable worker; v0.1 intentionally excludes images, binary documents, directories and archives |
| **`time-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert timestamps and explore zones, arithmetic and recurrence | Exact signed nanosecond epochs; IANA-zone comparisons and DST ambiguity; wall-clock versus elapsed arithmetic; bounded cron and RRULE previews; business days; escaped UTC ICS export | Uses the browser's IANA data and does not model leap seconds; regional holidays are never inferred; recurrence and skipped/ambiguous local-time choices are explicit |