magdevandClaude Opus 5.5
47138ddfbe
BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own air-gapped build options, every module it would load from a CDN vendored and checked against vendor.lock, a Content-Security-Policy without a single host, digital-sign-pdf and timestamp-pdf disabled because both need a third party, and the hand-off glue on every page: the AGPL source link, the hand-in of a file from bau-pm through a one-minute cookie into sessionStorage, confirmed by the tool's reaction, the hand-back of a result from every window, and the signing tool's flatten switch locked on. The zero-host gate drives all 117 enabled tool pages in Chromium and fails on any request to another origin, any CSP violation, a CSP that names a host, and a disabled id that names no page. Green on this image (3 min 52 s on a private network), red on the stock upstream image (115 findings) and on a misspelled id. CI runs it on every push, the release workflow before it pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
1.9 KiB
Plaintext
24 lines
1.9 KiB
Plaintext
# Every module BentoPDF would otherwise load from cdn.jsdelivr.net at runtime,
|
|
# pinned by version and by the registry's integrity hash. The Dockerfile's
|
|
# vendor stage packs each one with `npm pack --json` and refuses the build when
|
|
# the integrity it receives differs from the one written here. One line per
|
|
# package: <spec> <integrity>.
|
|
#
|
|
# PyMuPDF (@bentopdf/pymupdf-wasm 0.11.16) and Ghostscript (@bentopdf/gs-wasm
|
|
# 0.1.1) are not listed: BentoPDF ships both tarballs in its own repository
|
|
# (bentopdf-airgap-bundle/), so they come from the pinned commit.
|
|
#
|
|
# Left out on purpose: the CJK fallback fonts of the PDF editor
|
|
# (@embedpdf/fonts-jp, -kr, -sc, -tc, 30 to 42 MB each). A document that needs
|
|
# them asks this server and gets a 404, never a third party.
|
|
coherentpdf@2.5.5 sha512-AAD3RG7lq2n34AtH352sbNDhJ82yfp2vFUp63/+Vu7snAqW0vyvY33XuhZdj6ubZUlFe1DNSSEaYcyc7+jTJ5Q==
|
|
tesseract.js@7.0.0 sha512-exPBkd+z+wM1BuMkx/Bjv43OeLBxhL5kKWsz/9JY+DXcXdiBjiAch0V49QR3oAJqCaL5qURE0vx9Eo+G5YE7mA==
|
|
tesseract.js-core@7.0.0 sha512-WnNH518NzmbSq9zgTPeoF8c+xmilS8rFIl1YKbk/ptuuc7p6cLNELNuPAzcmsYw450ca6bLa8j3t0VAtq435Vw==
|
|
@tesseract.js-data/deu@1.0.0 sha512-3ter1p2gFAiCd5CMC+PodZ9YY2UDomkKj+ytlKeeZqOUmhLx1SDnYPf5zog0g5MBbxYveW+8omI3PUflqHfZ4Q==
|
|
@tesseract.js-data/fra@1.0.0 sha512-pp58gMaoyidoBBLd5y5rnf0WW0Y1994QrGqZrYatITqIU/AReUJMykD+YY3JDgvnmgz7uAx1UmhjjuyEmV8JEA==
|
|
@tesseract.js-data/ita@1.0.0 sha512-Sx19NVYve5VAxEBDL6CWTX+evlvzV+iAS5ejJywcHVsmir/C9Tzw2fExoh97QFc06t48tYZA8VrMobsBzMAEhA==
|
|
@tesseract.js-data/eng@1.0.0 sha512-mbTumm6KQPUHyzTPQaF3ObXYnx0SqqfV2nabqFVQBwD6Kl7PhGSLSzOlfFTWy0P3BjghaSKA2W9GB19Jk+ZcTg==
|
|
@embedpdf/fonts-latin@1.0.0 sha512-LLYysdr8O6sRNzhmW3PbF3AeA8xnqvOi4XLFfIfNlW5uEZ+qsJdcfd78Q78sFJMhlaOAYFMziMMsnOzmx463rA==
|
|
@embedpdf/fonts-arabic@1.0.0 sha512-SnGvQb+LwPZQO2WjjvlmXrJZolJUfLYbLZQSaYUw1vrQyMyJKT4LewvJGG+hZ+Yz2fz7OMIQ+4Gc98mGODZtOg==
|
|
@embedpdf/fonts-hebrew@1.0.0 sha512-5HVAKGL7VqPeTxxADDrSqAFBxfmAXdP8fIqrPwJIKkqdK2643bOer8CqnnpO3/nPoFhkzxhttWMB9BGiqSW62w==
|