Fork 1

Files

T

magdevandClaude Opus 5 d0a2feff20 Pull the base images fresh on every build (bau-pm BAU-191)

Finding 41 of bau-pm's v0.22.3 security review called this a pin to move.
It is not a pin: both bases here are floating tags, so what ships is
whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while
quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8,
past five October CVEs - none of them reachable in a static file server
configured like this one, which is why --pull is the fix rather than a pin.

The CI build gets it too: a gate running against a months-old cached base
is not testing what the release builds.

A release is what applies this. The running image does not change until one
is cut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-10-24 00:36:26 +02:00

2.5 KiB

Raw Blame History

Changelog

All notable changes to this project are documented in this file. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Security

The CI and release builds pull their base images fresh (docker build --pull). Both bases are floating tags, so what shipped was whatever the runner had cached: v0.1.0 went out with nginx 1.31.6 while the tag had already moved to 1.31.8, past five October CVEs. None of the five is reachable in a static file server configured like this one, which is why this is the fix rather than a pin. From bau-pm's v0.22.3 security review, finding 41 (bau-pm BAU-191). A release is what applies it - the running image does not change until one is cut.

[0.1.0] - 2026-10-10

The first release: BentoPDF v2.8.8 for bau-pm, about 120 PDF tools that run in the browser and talk to no third party, with the hand-off that brings a PDF from bau-pm into a tool and the result back.

Added

BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's air-gapped build options: Simple Mode, German by default, every module served from the image's own /wasm/, the CORS proxy off.
The CDN modules vendored and checked against vendor.lock (PyMuPDF, Ghostscript, CoherentPDF, Tesseract with German, French, Italian and English, the OCR font, the PDF editor's Latin, Arabic and Hebrew fallback fonts). Ghostscript is served as its whole package with gs.js and gs.wasm linked at its root, because BentoPDF's own loader and PyMuPDF's wrapper expect the two different layouts (upstream's air-gap layout left pdf-to-docx with a 404).
A Content-Security-Policy without any host, img-src included; the build fails if one survives.
digital-sign-pdf and timestamp-pdf disabled: both need a third party by design.
The hand-off glue on every page: a source link (AGPL), the hand-in of a file from bau-pm through a one-minute cookie into the tab's sessionStorage, confirmed by the tool's own reaction and retried while it has none (BentoPDF attaches its listener late, and its service worker made the glue win that race), the hand-back of a result caught in every window, the viewer's frame included, and waiting for the hand-off's details when a save comes before them, and the signing tool's flatten switch locked on.
The zero-host gate (test/zero-hosts.mjs) over every tool page, in CI and in the release workflow.