bau-pm-pdf-tools

3 Commits

Author SHA1 Message Date

Author	SHA1	Message	Date
magdevandClaude Opus 5	d0a2feff20	Pull the base images fresh on every build (bau-pm BAU-191) Finding 41 of bau-pm's v0.22.3 security review called this a pin to move. It is not a pin: both bases here are floating tags, so what ships is whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8, past five October CVEs - none of them reachable in a static file server configured like this one, which is why --pull is the fix rather than a pin. The CI build gets it too: a gate running against a months-old cached base is not testing what the release builds. A release is what applies this. The running image does not change until one is cut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-10-24 00:36:26 +02:00
magdevandClaude Opus 5.5	7ef389c18c	Release v0.1.0: BentoPDF v2.8.8 for bau-pm, without third-party hosts CI / gate (push) Successful in 10m49s Details Release / release (push) Successful in 4m41s Details The image and the gate as in `47138dd`: the zero-host gate green on all 117 enabled tool pages (CI form, private network, 3 min 52 s), red on the stock image (115 findings) and on a misspelled disabled id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 20:01:13 +02:00
magdevandClaude Opus 5.5	47138ddfbe	BentoPDF for bau-pm, without third-party hosts (bau-pm BAU-119) BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own air-gapped build options, every module it would load from a CDN vendored and checked against vendor.lock, a Content-Security-Policy without a single host, digital-sign-pdf and timestamp-pdf disabled because both need a third party, and the hand-off glue on every page: the AGPL source link, the hand-in of a file from bau-pm through a one-minute cookie into sessionStorage, confirmed by the tool's reaction, the hand-back of a result from every window, and the signing tool's flatten switch locked on. The zero-host gate drives all 117 enabled tool pages in Chromium and fails on any request to another origin, any CSP violation, a CSP that names a host, and a disabled id that names no page. Green on this image (3 min 52 s on a private network), red on the stock upstream image (115 findings) and on a misspelled id. CI runs it on every push, the release workflow before it pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 19:36:02 +02:00

d0a2feff20

Pull the base images fresh on every build (bau-pm BAU-191)

Finding 41 of bau-pm's v0.22.3 security review called this a pin to move.
It is not a pin: both bases here are floating tags, so what ships is
whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while
quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8,
past five October CVEs - none of them reachable in a static file server
configured like this one, which is why --pull is the fix rather than a pin.

The CI build gets it too: a gate running against a months-old cached base
is not testing what the release builds.

A release is what applies this. The running image does not change until one
is cut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-10-24 00:36:26 +02:00

magdevandClaude Opus 5.5

7ef389c18c

Release v0.1.0: BentoPDF v2.8.8 for bau-pm, without third-party hosts

CI / gate (push) Successful in 10m49s

Details

Release / release (push) Successful in 4m41s

Details

The image and the gate as in 47138dd: the zero-host gate green on all 117
enabled tool pages (CI form, private network, 3 min 52 s), red on the stock
image (115 findings) and on a misspelled disabled id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-10 20:01:13 +02:00

magdevandClaude Opus 5.5

47138ddfbe

BentoPDF for bau-pm, without third-party hosts (bau-pm BAU-119)

BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own
air-gapped build options, every module it would load from a CDN vendored and
checked against vendor.lock, a Content-Security-Policy without a single host,
digital-sign-pdf and timestamp-pdf disabled because both need a third party,
and the hand-off glue on every page: the AGPL source link, the hand-in of a
file from bau-pm through a one-minute cookie into sessionStorage, confirmed by
the tool's reaction, the hand-back of a result from every window, and the
signing tool's flatten switch locked on.

The zero-host gate drives all 117 enabled tool pages in Chromium and fails on
any request to another origin, any CSP violation, a CSP that names a host, and
a disabled id that names no page. Green on this image (3 min 52 s on a private
network), red on the stock upstream image (115 findings) and on a misspelled
id. CI runs it on every push, the release workflow before it pushes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-10 19:36:02 +02:00