magdevandClaude Opus 5.5
47138ddfbe
BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own air-gapped build options, every module it would load from a CDN vendored and checked against vendor.lock, a Content-Security-Policy without a single host, digital-sign-pdf and timestamp-pdf disabled because both need a third party, and the hand-off glue on every page: the AGPL source link, the hand-in of a file from bau-pm through a one-minute cookie into sessionStorage, confirmed by the tool's reaction, the hand-back of a result from every window, and the signing tool's flatten switch locked on. The zero-host gate drives all 117 enabled tool pages in Chromium and fails on any request to another origin, any CSP violation, a CSP that names a host, and a disabled id that names no page. Green on this image (3 min 52 s on a private network), red on the stock upstream image (115 findings) and on a misspelled id. CI runs it on every push, the release workflow before it pushes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 lines
1.8 KiB
Markdown
17 lines
1.8 KiB
Markdown
# Third-party components in the image
|
|
|
|
The image contains BentoPDF and the modules below, unmodified, at the versions listed; the licences are as each package declares it on npm (read 2026-10-10). The source links are the corresponding source of what the image serves under `/wasm/`.
|
|
|
|
| Component | Version | Licence | Source |
|
|
| --- | --- | --- | --- |
|
|
| BentoPDF | v2.8.8 (`f96cd4e5166f3d51393dfe9f3c440b5bb77802f1`) | AGPL-3.0 (or BentoPDF's commercial licence) | <https://github.com/alam00000/bentopdf/tree/v2.8.8> |
|
|
| PyMuPDF (WASM, `@bentopdf/pymupdf-wasm`) | 0.11.16 | AGPL-3.0-only | <https://github.com/alam00000/bentopdf-pymupdf-wasm>; the tarball from BentoPDF's `bentopdf-airgap-bundle/` at the commit above |
|
|
| Ghostscript (WASM, `@bentopdf/gs-wasm`) | 0.1.1 | AGPL-3.0-only | <https://github.com/alam00000/bentopdf-gs-wasm>; the tarball from BentoPDF's `bentopdf-airgap-bundle/` at the commit above |
|
|
| CoherentPDF (`coherentpdf`) | 2.5.5 | AGPL-3.0-or-later | <https://www.npmjs.com/package/coherentpdf/v/2.5.5>, <https://github.com/coherentgraphics/coherentpdf.js> |
|
|
| Tesseract.js (`tesseract.js`, `tesseract.js-core`) | 7.0.0 | Apache-2.0 | <https://github.com/naptha/tesseract.js>, <https://github.com/naptha/tesseract.js-core> |
|
|
| Tesseract language data (`@tesseract.js-data/deu`, `fra`, `ita`, `eng`) | 1.0.0 (`4.0.0_best_int`) | MIT (as published on npm) | <https://github.com/naptha/tessdata> |
|
|
| Noto Sans (OCR text layer) | noto-fonts `ffebf8c1ee449e544955a7e813c54f9b73848eac` | OFL-1.1 | <https://github.com/googlefonts/noto-fonts> |
|
|
| EmbedPDF fonts (`@embedpdf/fonts-latin`, `-arabic`, `-hebrew`) | 1.0.0 | OFL-1.1 | <https://github.com/embedpdf/embed-pdf-viewer> |
|
|
|
|
The npm tarballs are checked against the integrity hashes in `vendor.lock`, the Noto Sans file against the SHA-256 in `scripts/vendor.sh`.
|