magdevandClaude Opus 5.5
47138ddfbe
BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own air-gapped build options, every module it would load from a CDN vendored and checked against vendor.lock, a Content-Security-Policy without a single host, digital-sign-pdf and timestamp-pdf disabled because both need a third party, and the hand-off glue on every page: the AGPL source link, the hand-in of a file from bau-pm through a one-minute cookie into sessionStorage, confirmed by the tool's reaction, the hand-back of a result from every window, and the signing tool's flatten switch locked on. The zero-host gate drives all 117 enabled tool pages in Chromium and fails on any request to another origin, any CSP violation, a CSP that names a host, and a disabled id that names no page. Green on this image (3 min 52 s on a private network), red on the stock upstream image (115 findings) and on a misspelled id. CI runs it on every push, the release workflow before it pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.8 KiB
1.8 KiB
Third-party components in the image
The image contains BentoPDF and the modules below, unmodified, at the versions listed; the licences are as each package declares it on npm (read 2026-10-10). The source links are the corresponding source of what the image serves under /wasm/.
| Component | Version | Licence | Source |
|---|---|---|---|
| BentoPDF | v2.8.8 (f96cd4e5166f3d51393dfe9f3c440b5bb77802f1) |
AGPL-3.0 (or BentoPDF's commercial licence) | https://github.com/alam00000/bentopdf/tree/v2.8.8 |
PyMuPDF (WASM, @bentopdf/pymupdf-wasm) |
0.11.16 | AGPL-3.0-only | https://github.com/alam00000/bentopdf-pymupdf-wasm; the tarball from BentoPDF's bentopdf-airgap-bundle/ at the commit above |
Ghostscript (WASM, @bentopdf/gs-wasm) |
0.1.1 | AGPL-3.0-only | https://github.com/alam00000/bentopdf-gs-wasm; the tarball from BentoPDF's bentopdf-airgap-bundle/ at the commit above |
CoherentPDF (coherentpdf) |
2.5.5 | AGPL-3.0-or-later | https://www.npmjs.com/package/coherentpdf/v/2.5.5, https://github.com/coherentgraphics/coherentpdf.js |
Tesseract.js (tesseract.js, tesseract.js-core) |
7.0.0 | Apache-2.0 | https://github.com/naptha/tesseract.js, https://github.com/naptha/tesseract.js-core |
Tesseract language data (@tesseract.js-data/deu, fra, ita, eng) |
1.0.0 (4.0.0_best_int) |
MIT (as published on npm) | https://github.com/naptha/tessdata |
| Noto Sans (OCR text layer) | noto-fonts ffebf8c1ee449e544955a7e813c54f9b73848eac |
OFL-1.1 | https://github.com/googlefonts/noto-fonts |
EmbedPDF fonts (@embedpdf/fonts-latin, -arabic, -hebrew) |
1.0.0 | OFL-1.1 | https://github.com/embedpdf/embed-pdf-viewer |
The npm tarballs are checked against the integrity hashes in vendor.lock, the Noto Sans file against the SHA-256 in scripts/vendor.sh.