4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
magdevandClaude Opus 5	ac6d57562b	Release v0.1.1: the same BentoPDF on current packages ... Nothing in this repository's own code changed. What changed is that a build no longer ships whatever base image the runner had cached, so this image carries nginx 1.31.8 where v0.1.0 carried 1.31.6 - past five October CVEs, none of them reachable in a static file server configured like this one, which is why --pull is the fix rather than a pin. Out of bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). Gate, the same one CI runs, on this tree: shellcheck clean over scripts/; the image built with --pull, BentoPDF v2.8.8 verified at its pinned commit, 2776 pages tagged with a CSP carrying no host; the zero-hosts gate drove all 117 tool pages against the running image and nothing left the origin; nginx 1.31.8 in the built image. bau-pm still pins 0.1.0 in compose.yaml and .env.example, so this reaches a running instance only once that pin moves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> v0.1.1	2026-10-24 10:18:20 +02:00
magdevandClaude Opus 5	d0a2feff20	Pull the base images fresh on every build (bau-pm BAU-191) ... Finding 41 of bau-pm's v0.22.3 security review called this a pin to move. It is not a pin: both bases here are floating tags, so what ships is whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8, past five October CVEs - none of them reachable in a static file server configured like this one, which is why --pull is the fix rather than a pin. The CI build gets it too: a gate running against a months-old cached base is not testing what the release builds. A release is what applies this. The running image does not change until one is cut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-10-24 00:36:26 +02:00
magdevandClaude Opus 5.5	7ef389c18c	Release v0.1.0: BentoPDF v2.8.8 for bau-pm, without third-party hosts ... The image and the gate as in 47138dd: the zero-host gate green on all 117 enabled tool pages (CI form, private network, 3 min 52 s), red on the stock image (115 findings) and on a misspelled disabled id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> v0.1.0	2026-10-10 20:01:13 +02:00
magdevandClaude Opus 5.5	47138ddfbe	BentoPDF for bau-pm, without third-party hosts (bau-pm BAU-119) ... BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own air-gapped build options, every module it would load from a CDN vendored and checked against vendor.lock, a Content-Security-Policy without a single host, digital-sign-pdf and timestamp-pdf disabled because both need a third party, and the hand-off glue on every page: the AGPL source link, the hand-in of a file from bau-pm through a one-minute cookie into sessionStorage, confirmed by the tool's reaction, the hand-back of a result from every window, and the signing tool's flatten switch locked on. The zero-host gate drives all 117 enabled tool pages in Chromium and fails on any request to another origin, any CSP violation, a CSP that names a host, and a disabled id that names no page. Green on this image (3 min 52 s on a private network), red on the stock upstream image (115 findings) and on a misspelled id. CI runs it on every push, the release workflow before it pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 19:36:02 +02:00