CyberSnapper 2.3.1: content blocking and verified packages

.github/workflows/release.yml

@@ -29,9 +29,11 @@ jobs:
           sudo apt-get install -y ninja-build libgl1-mesa-dev libxkbcommon-x11-0 libxcb-cursor0
       - name: Worker checks with all engines
         shell: bash
+        env:
+          CYBERSNAPPER_REQUIRED_BROWSERS: chromium,firefox,webkit
         run: |
           npm ci
-          npx playwright install chromium firefox webkit
+          npx playwright install --with-deps chromium firefox webkit
           npm run typecheck:worker
           npm run build:worker
           npm run test:worker
@@ -43,26 +45,26 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: ubuntu-22.04
             arch: x64
-            linuxdeploy_asset: 497463883
-            linuxdeploy_sha256: 421ca71d5c69ea97c6309276232990d43df1dcece0edfaa26bbf926ff96ed12e
-            qt_plugin_asset: 421996681
-            qt_plugin_sha256: be1b7e166bf9975cfb694ebe6759ba40502ffc6196440d3e64aa90c4dbd67e9f
-            appimagetool_asset: 324406736
+            node_arch: x64
+            qt_host: linux
+            qt_arch: linux_gcc_64
+            tool_arch: x86_64
+            linuxdeploy_sha256: c20cd71e3a4e3b80c3483cef793cda3f4e990aca14014d23c544ca3ce1270b4d
+            qt_plugin_sha256: 15106be885c1c48a021198e7e1e9a48ce9d02a86dd0a1848f00bdbf3c1c92724
             appimagetool_sha256: ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0
-            runtime_asset: 456065460
-            runtime_sha256: 1cc49bcf1e2ccd593c379adb17c9f85a36d619088296504de95b1d06215aebbf
+            runtime_sha256: 2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d
           - runner: ubuntu-24.04-arm
             arch: arm64
-            linuxdeploy_asset: 497463664
-            linuxdeploy_sha256: 9f04c4c2a8b69c392c4bbcc1a88bdd4d0a8ac03f587cf5242814cb7ae47b78e5
-            qt_plugin_asset: 421996594
-            qt_plugin_sha256: 5525e6c49c3c774c02b8864d2acc2ae4c5c0ccc3327f7dce626deaa36348e5c6
-            appimagetool_asset: 324406707
+            node_arch: arm64
+            qt_host: linux_arm64
+            qt_arch: linux_gcc_arm64
+            tool_arch: aarch64
+            linuxdeploy_sha256: 620095110d693282b8ebeb244a95b5e911cf8f65f76c88b4b47d16ae6346fcff
+            qt_plugin_sha256: bf1c24aff6d749b5cf423afad6f15abd4440f81dec1aab95706b25f6667cdcf1
             appimagetool_sha256: f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158
-            runtime_asset: 456064894
-            runtime_sha256: 7d5d772b7c32f0c84caf0a452a3072a5709027d7eac5856feb89a7a7a8881372
+            runtime_sha256: 00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v7
@@ -72,6 +74,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 22
+          architecture: ${{ matrix.node_arch }}
           cache: npm
 
       - name: Verify release version
@@ -83,12 +86,14 @@ jobs:
       - uses: jurplel/install-qt-action@v4
         with:
           version: '6.8.3'
+          host: ${{ matrix.qt_host }}
+          arch: ${{ matrix.qt_arch }}
           cache: true
 
       - name: Install Linux build tools
         run: |
           sudo apt-get update
-          sudo apt-get install -y ninja-build libgl1-mesa-dev libxkbcommon-x11-0 libxcb-cursor0 libfuse2 file desktop-file-utils
+          sudo apt-get install -y ninja-build libgl1-mesa-dev libxkbcommon-x11-0 libxcb-cursor0 file desktop-file-utils
 
       - name: Worker checks
         shell: bash
@@ -127,23 +132,23 @@ jobs:
       - name: Keep production worker dependencies
         run: npm prune --omit=dev
 
-      # Each tool is pinned by immutable release-asset id plus its SHA-256 so a
-      # replaced "continuous" asset cannot silently change what we package.
+      # Every tool comes from a versioned upstream release and is verified
+      # before execution. APPIMAGE_EXTRACT_AND_RUN avoids a FUSE dependency.
       - name: Install pinned packaging tools
         shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
+          APPIMAGE_EXTRACT_AND_RUN: '1'
         run: |
           set -euo pipefail
           mkdir -p tools
-          gh api -H 'Accept: application/octet-stream' \
-            "repos/linuxdeploy/linuxdeploy/releases/assets/${{ matrix.linuxdeploy_asset }}" > tools/linuxdeploy
-          gh api -H 'Accept: application/octet-stream' \
-            "repos/linuxdeploy/linuxdeploy-plugin-qt/releases/assets/${{ matrix.qt_plugin_asset }}" > tools/linuxdeploy-plugin-qt
-          gh api -H 'Accept: application/octet-stream' \
-            "repos/AppImage/appimagetool/releases/assets/${{ matrix.appimagetool_asset }}" > tools/appimagetool
-          gh api -H 'Accept: application/octet-stream' \
-            "repos/AppImage/type2-runtime/releases/assets/${{ matrix.runtime_asset }}" > tools/AppImage-runtime
+          curl --fail --location --retry 3 --output tools/linuxdeploy \
+            "https://github.com/linuxdeploy/linuxdeploy/releases/download/1-alpha-20251107-1/linuxdeploy-${{ matrix.tool_arch }}.AppImage"
+          curl --fail --location --retry 3 --output tools/linuxdeploy-plugin-qt \
+            "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/1-alpha-20250213-1/linuxdeploy-plugin-qt-${{ matrix.tool_arch }}.AppImage"
+          curl --fail --location --retry 3 --output tools/appimagetool \
+            "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-${{ matrix.tool_arch }}.AppImage"
+          curl --fail --location --retry 3 --output tools/AppImage-runtime \
+            "https://github.com/AppImage/type2-runtime/releases/download/20251108/runtime-${{ matrix.tool_arch }}"
           printf '%s  %s\n' "${{ matrix.linuxdeploy_sha256 }}" tools/linuxdeploy | sha256sum --check --strict
           printf '%s  %s\n' "${{ matrix.qt_plugin_sha256 }}" tools/linuxdeploy-plugin-qt | sha256sum --check --strict
           printf '%s  %s\n' "${{ matrix.appimagetool_sha256 }}" tools/appimagetool | sha256sum --check --strict
@@ -188,10 +193,12 @@ jobs:
         include:
           - runner: windows-2022
             arch: x64
+            node_arch: x64
             qt_arch: win64_msvc2022_64
             msvc_arch: x64
           - runner: windows-11-arm
             arch: arm64
+            node_arch: arm64
             qt_arch: win64_msvc2022_arm64
             msvc_arch: amd64_arm64
     runs-on: ${{ matrix.runner }}
@@ -203,6 +210,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 22
+          architecture: ${{ matrix.node_arch }}
           cache: npm
 
       - name: Verify release version
@@ -226,9 +234,6 @@ jobs:
         run: |
           npm ci
           npx playwright install chromium
-          if [ "${{ runner.os }}" = "Linux" ]; then
-            npx playwright install firefox webfox webkit
-          fi
           npm run typecheck:worker
           npm run build:worker
           npm run test:worker
@@ -312,8 +317,12 @@ jobs:
         include:
           - runner: macos-15-intel
             arch: x64
+            node_arch: x64
+            cmake_arch: x86_64
           - runner: macos-15
             arch: arm64
+            node_arch: arm64
+            cmake_arch: arm64
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v7
@@ -323,6 +332,7 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 22
+          architecture: ${{ matrix.node_arch }}
           cache: npm
 
       - name: Verify release version
@@ -381,6 +391,7 @@ jobs:
         run: |
           cmake -S . -B build/native -G Ninja -DCMAKE_BUILD_TYPE=Release \
             -DCYBERSNAPPER_BUILD_TESTS=ON \
+            -DCMAKE_OSX_ARCHITECTURES=${{ matrix.cmake_arch }} \
             -DCYBERSNAPPER_MACOS_ICON="$RUNNER_TEMP/CyberSnapper.icns"
           cmake --build build/native --parallel
           ctest --test-dir build/native --output-on-failure

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.24)
 
-project(CyberSnapper VERSION 2.3.0 LANGUAGES CXX)
+project(CyberSnapper VERSION 2.3.1 LANGUAGES CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)

README.md

@@ -27,7 +27,7 @@ The finished files are normal PNG, WebP, AVIF, or PDF files in a portable folder
 
 ## Download
 
-CyberSnapper 2.2.2 is the current stable release. Every package bundles the application, Qt runtime, Node runtime, capture worker, and Chromium. Firefox and WebKit can be installed on demand from Settings.
+CyberSnapper 2.3.1 is the current stable release. Every package bundles the application, Qt runtime, Node runtime, capture worker, and Chromium. Firefox and WebKit can be installed on demand from Settings.
 
 | Platform | Recommended | Portable archive |
 | --- | --- | --- |
@@ -44,7 +44,7 @@ Every release includes SHA-256 checksums and GitHub build-provenance attestation
 
 - Capture full scrolling pages, exact viewports, or one CSS-selected element.
 - Produce desktop, tablet, mobile, and custom-sized images together with explicit pixel density and mobile-browser controls.
-- Wait for pages to settle, block common overlays, and hide chosen elements so banners and animation do not spoil the shot.
+- Wait for pages to settle, remove cookie banners with curated or custom rules, and hide chosen elements so overlays and animation do not spoil the shot.
 - Create portfolio-ready copies with Clean, Aurora, Sunset, Midnight, Graphite, or custom-solid scenes; add browser, tablet, phone, or rounded-card frames; and target 16:9, 4:3, square, or content-fit canvases.
 - Save labeled target sets for all the projects and pages in a portfolio, then recapture them as one batch.
 - Export PNG, WebP, AVIF, and Chromium PDF with collision-safe names into ordinary folders.

RELEASE.md

@@ -55,13 +55,21 @@ The workflow creates AppImage and tar.gz packages for Linux x64 and arm64, setup
 - If the tagged source or a packaged application is defective, do not move the tag or silently replace the release. Document the issue and publish a corrected patch release from a new commit and tag.
 - Keep an incomplete release unannounced until recovery succeeds. If downloads may be unsafe or misleading, mark the release as a prerelease while preparing the corrective release.
 
+## v2.3.1
+
+- **Correct packages**: Restores the complete Linux, Windows, and macOS x64/arm64 release matrix with immutable, checksum-verified Linux packaging tools.
+- **Safer blocking**: Rejected filters can no longer reach the rules engine, consent handling covers frames, and delayed banner removal releases scroll locks correctly.
+- **Working custom rulesets**: Profile selections now survive the configuration dialog and newly created rulesets can be enabled immediately.
+- **Reliable subscriptions**: Redirects use their validated destination, oversized downloads abort early, and identical rules produce one stable content-addressed snapshot.
+- **Release integrity**: Fixes malformed workflow YAML, native source warnings, version metadata, browser-matrix enforcement, and inaccurate packaging documentation.
+
 ## v2.3.0
 
-- **Content blocking**: Cookie banner removal, consent handling, site exceptions, custom rulesets, and visual review.  
-- **Security**: Capture boundary, HTTPS-only downloads, atomic writes, and last-known-good snapshots.  
-- **Compatibility**: Browser matrix (Chromium/Firefox/WebKit) and schema v5.  
-- **Developer**: REST API v1 (`/v1/contentBlocking/*`), RPC v1 (`contentBlocking.*`), and worker protocol v2.  
-- **Documentation**: Updated `ARCHITECTURE.md`, `PROJECT_FORMAT.md`, and `THIRD-PARTY.md`.  
+- **Content blocking**: Cookie banner removal, consent handling, site exceptions, custom rulesets, and visual review.
+- **Security**: Capture boundary, HTTPS-only downloads, atomic writes, and last-known-good snapshots.
+- **Compatibility**: Browser matrix (Chromium/Firefox/WebKit) and schema v5.
+- **Developer**: REST API v1 (`/v1/contentBlocking/*`), RPC v1 (`contentBlocking.*`), and worker protocol v2.
+- **Documentation**: Updated `ARCHITECTURE.md`, `PROJECT_FORMAT.md`, and `THIRD-PARTY.md`.
 - **Packaging**: AppImage/tar.gz (Linux x64/arm64), NSIS/ZIP (Windows x64), DMG/ZIP (macOS x64/arm64).
 
 ## v2.2.2

docs/PACKAGING.md

@@ -17,7 +17,7 @@ each supported architecture:
 
 | Platform | Architectures | Recommended | Portable | Runners |
 | --- | --- | --- | --- | --- |
-| Linux | x64, arm64 | AppImage | tar.gz | `ubuntu-24.04`, `ubuntu-24.04-arm` |
+| Linux | x64, arm64 | AppImage | tar.gz | `ubuntu-22.04`, `ubuntu-24.04-arm` |
 | Windows | x64, arm64 | NSIS setup `.exe` | ZIP | `windows-2022`, `windows-11-arm` |
 | macOS | x64, arm64 | DMG | ZIP | `macos-15-intel`, `macos-15` |
 
@@ -82,9 +82,11 @@ package:
 1. `cmake --install` into an `AppDir/` tree under the build directory.
 2. The desktop file, metainfo, and icon are validated (these are installed by
    the CMake rules for Linux).
-3. Unused Qt SQL drivers (`mysql`, `mimer`, `odbc`, `psql`) are removed; only
-   SQLite is deployed. `libqsqlmimer.so` in particular depends on an absent
-   `libmimerapi.so` and would otherwise abort deployment.
+3. Qt plugins are copied into a private staging directory, where unused SQL
+   drivers (`mysql`, `mimer`, `odbc`, `psql`) are removed; only SQLite is
+   deployed. The installed Qt SDK is never modified. `libqsqlmimer.so` in
+   particular depends on an absent `libmimerapi.so` and would otherwise abort
+   deployment.
 4. `linuxdeploy` with `linuxdeploy-plugin-qt` bundles non-Qt and Qt
    dependencies into `AppDir/`. A stale Qt 6 hook is removed after deployment.
 5. `appimagetool` with a pinned type-2 runtime turns `AppDir/` into the
@@ -96,11 +98,15 @@ match the target architecture, and `ldd` must report no unresolved libraries
 before the AppImage is produced.
 
 The four external tools — `linuxdeploy`, `linuxdeploy-plugin-qt`,
-`appimagetool`, and the AppImage type-2 runtime — are **pinned by immutable
-GitHub release-asset ID plus SHA-256** and downloaded with `gh api`. Pinning by
-asset ID (not tag name) prevents a replaced "continuous" upstream asset from
-silently changing what gets packaged. The per-architecture IDs and checksums
-live in the workflow matrix.
+`appimagetool`, and the AppImage type-2 runtime — are downloaded from
+**versioned upstream releases and pinned by SHA-256**. The workflow never uses
+moving `continuous` assets or repository-hosted binary mirrors. Tool AppImages
+run with `APPIMAGE_EXTRACT_AND_RUN=1`, so the build does not depend on FUSE.
+The per-architecture checksums live in the workflow matrix.
+
+Linux x64 builds on Ubuntu 22.04 to retain a lower glibc floor. Qt's official
+Linux arm64 package requires Ubuntu 24.04, so the arm64 AppImage has that newer
+glibc compatibility floor.
 
 ## Windows: setup executable and portable ZIP
 

docs/releases/v2.3.0.md

@@ -2,48 +2,47 @@
 
 ## Content blocking
 
-- **Cookie banner removal**: Automatically hide and dismiss cookie consent banners using curated filter lists (EasyList Cookie, uBlock Origin Cookie) and custom rulesets.  
-- **Consent handling**: Choose between "reject non-essential cookies then dismiss" (default) or "dismiss using the site's own accept control" strategies.  
-- **Site exceptions**: Skip content blocking entirely on specific domains (e.g., `app.example.com`).  
-- **Custom rulesets**: Create and reuse rulesets with cosmetic filters (`##.promo-overlay`) and trusted click actions (`example.com#click(#save-button)`).  
-- **Visual review**: Every artifact in History now shows a provenance tooltip with blocked subresources, consent actions, and warnings.  
+- **Cookie banner removal**: Automatically hide and dismiss cookie consent banners using curated filter lists (EasyList Cookie, uBlock Origin Cookie) and custom rulesets.
+- **Consent handling**: Choose between "reject non-essential cookies then dismiss" (default) or "dismiss using the site's own accept control" strategies.
+- **Site exceptions**: Skip content blocking entirely on specific domains (e.g., `app.example.com`).
+- **Custom rulesets**: Create and reuse rulesets with cosmetic filters (`##.promo-overlay`) and bounded click/hide actions configured by domain and CSS selector.
+- **Visual review**: Every artifact in History now shows a provenance tooltip with blocked subresources, consent actions, and warnings.
 
 ## Security
 
-- **Capture boundary**: Community filter exceptions (e.g., `@@||127.0.0.1^`) can never bypass the network-security policy; user blocklist fragments always win.  
-- **HTTPS-only downloads**: Subscription lists and snapshots are fetched over HTTPS with certificate validation.  
-- **Atomic writes**: Temporary files are never left behind; last-known-good snapshots are used if a refresh fails.  
+- **Capture boundary**: Community filter exceptions (e.g., `@@||127.0.0.1^`) can never bypass the network-security policy; user blocklist fragments always win.
+- **HTTPS-only downloads**: Subscription lists and snapshots are fetched over HTTPS with certificate validation.
+- **Atomic writes**: Temporary files are never left behind; last-known-good snapshots are used if a refresh fails.
 
 ## Compatibility
 
-- **Browser matrix**: Release packages are tested against Chromium, Firefox, and WebKit on Linux, Windows, and macOS.  
-- **Schema v5**: Project databases are automatically upgraded; downgrades are not supported.  
+- **Browser matrix**: Release packages are tested against Chromium, Firefox, and WebKit on Linux, Windows, and macOS.
+- **Schema v5**: Project databases are automatically upgraded; downgrades are not supported.
 
 ## Developer
 
-- **REST API v1**: New `/v1/contentBlocking/catalog`, `/v1/contentBlocking/status`, and `/v1/contentBlocking/refresh` endpoints.  
-- **RPC v1**: `contentBlocking.catalog`, `contentBlocking.status`, and `contentBlocking.refresh` methods.  
-- **Worker protocol v2**: Content blocking events carry `blockedSubresources`, `consentActionsAttempted`, and `consentActionsSucceeded` metrics.  
+- **REST API v1**: New `/v1/contentBlocking/catalog`, `/v1/contentBlocking/status`, and `/v1/contentBlocking/refresh` endpoints.
+- **RPC v1**: `contentBlocking.catalog`, `contentBlocking.status`, and `contentBlocking.refresh` methods.
+- **Worker protocol v2**: Content blocking events carry `blockedSubresources`, `consentActionsAttempted`, and `consentActionsSucceeded` metrics.
 
 ## Documentation
 
-- `docs/ARCHITECTURE.md`: Updated for the capture boundary, visual review model, and scheduling.  
-- `docs/PROJECT_FORMAT.md`: Schema v5 reference.  
-- `docs/THIRD-PARTY.md`: Added EasyList and uBlock Origin licenses.  
+- `docs/ARCHITECTURE.md`: Updated for the capture boundary, visual review model, and scheduling.
+- `docs/PROJECT_FORMAT.md`: Schema v5 reference.
+- `docs/THIRD-PARTY.md`: Added EasyList and uBlock Origin licenses.
 
 ## Packaging
 
-- **Linux**: AppImage and tar.gz (x64, arm64).  
-- **Windows**: NSIS installer and ZIP (x64).  
-- **macOS**: DMG and ZIP (x64, arm64).  
+- **Linux**: AppImage and tar.gz (x64, arm64).
+- **Windows**: NSIS installer and ZIP (x64).
+- **macOS**: DMG and ZIP (x64, arm64).
 
 ## Upgrading
 
-1. Open any project; the database will be upgraded to schema v5 automatically.  
-2. Visit **Preferences → Content Blocking** to configure subscriptions and strategy.  
+1. Open any project; the database will be upgraded to schema v5 automatically.
+2. Visit **Preferences → Content Blocking** to configure subscriptions and strategy.
 3. Use **History → Open Containing Folder** to inspect provenance details.
 
 ## Known issues
 
-- Firefox and WebKit do not support `page.route()` for network-level blocking; cosmetic filters and consent actions work normally.  
-- macOS WebKit may show spurious "Unable to load page" errors in the Review tab; reload to retry.
+- macOS WebKit may show spurious "Unable to load page" errors in the Review tab; reload to retry.