diff --git a/README.md b/README.md index f4f05a0..e4e3eaa 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # Reader — a local-first reading library +[![Quality gates](https://github.com/NouraldinFarge/Reader/actions/workflows/quality.yml/badge.svg)](https://github.com/NouraldinFarge/Reader/actions/workflows/quality.yml) + Reader is a Windows prerelease for reading authorized EPUB, PDF, text, and audio files without an account, storefront, telemetry, or required network connection. > **Repository status:** The source repository is public by owner decision. `0.1.0-alpha.4` remains an unreleased prerelease with no supported public binary download; the installer is unsigned and has not completed the clean-Windows release matrix. @@ -137,7 +139,7 @@ The resulting local NSIS candidate is intentionally unsigned. There is no approv Development began as local work before this repository history was initialized. The initial Git commit records a sanitized import of that existing alpha work; it does not pretend to capture earlier development chronology. The owner-confirmed record is in [Project provenance](docs/PROVENANCE.md). - Read [Support](SUPPORT.md) before sharing diagnostic information. -- Follow the current private-reporting availability and redaction guidance in [Security](SECURITY.md) before sharing a suspected vulnerability. +- Use the enabled private vulnerability-reporting route and follow the redaction guidance in [Security](SECURITY.md) before sharing a suspected vulnerability. - Review [Contributing](CONTRIBUTING.md), [Roadmap](ROADMAP.md), [release process](docs/RELEASE_PROCESS.md), and [release notes](docs/RELEASE_NOTES.md). - Vendored and build dependencies retain their upstream licenses in [third-party notices](THIRD_PARTY_NOTICES.md) and the [component manifest](THIRD_PARTY_COMPONENTS.json). diff --git a/ROADMAP.md b/ROADMAP.md index dc54dd4..3088d9e 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -18,7 +18,7 @@ This roadmap separates verified `0.1.0-alpha.4` scope from ideas. It is not a de - Clean Windows 10/11 installation, first/offline launch, persistence, upgrade, uninstall, and residual-data verification. - Manual assistive-technology and 400% zoom review, plus final packaged PDF/audio/import checks. - Human review of recruiter screenshots, demo, README, facts, and claims. -- Verified private vulnerability-reporting/security-advisory route and explicit binary-release approval. +- Explicit approval for the exact signed binary and public release; the source repository's private vulnerability-reporting route is already enabled. ## Candidate product improvements diff --git a/SECURITY.md b/SECURITY.md index c5e8fbe..334a22f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ Reader `0.1.0-alpha.4` is a public-source prerelease. It has no supported public ## Reporting privately -Do not open a public issue containing suspected-vulnerability details. Use GitHub's **Report a vulnerability** control if it is available in the repository Security tab. If that control is unavailable, there is currently no verified private intake route: do not publish exploit details or sensitive files while requesting a private contact channel from the repository owner. +Do not open a public issue containing suspected-vulnerability details. Use **Report a vulnerability** in this repository's Security tab; GitHub private vulnerability reporting is enabled. Do not publish exploit details or sensitive files in an issue, discussion, or pull request. Never attach or paste: @@ -32,6 +32,8 @@ The complete design and concurrency model are in [Architecture](docs/ARCHITECTUR On August 17, 2026, production and full pnpm advisory scans reported no known advisories at the selected high threshold. `cargo audit` reported no RustSec vulnerability entries and 17 allowed cross-platform warnings, including GTK/GLib-family warnings that do not resolve into Reader's Windows target graph. This is dated evidence, not a promise that dependencies remain vulnerability-free. +GitHub dependency review separately surfaced `GHSA-wrw7-89jp-8q8g` against `glib 0.18.5` in the cross-platform Cargo lockfile. `cargo tree --target all -i glib` reaches it through GTK/WebKit/Tauri, while both the Windows host graph and `cargo tree --target x86_64-pc-windows-msvc -i glib` contain no `glib` package. The alert is therefore classified as not used by Reader's supported Windows prerelease target—not as nonexistent or fixed. Reassess and update the GTK/GLib/Tauri graph before any Linux support or distribution. + The prior private audit named `CVE-2026-16633` for the old PDF.js build. Searches of Mozilla's releases, npm package data, and the NVD did not produce an authoritative record for that identifier on the verification date, so Reader does not repeat the CVE claim as established fact. The old vendored `5.6.205` build was nevertheless replaced with official matching `6.2.108` library/worker files and tested with scripting/evaluation disabled. See [Dependency review](docs/DEPENDENCY_REVIEW.md). ## Known security and durability limits diff --git a/app/src/styles.css b/app/src/styles.css index 80374d5..978a00e 100644 --- a/app/src/styles.css +++ b/app/src/styles.css @@ -1917,7 +1917,6 @@ @keyframes dialog-in { from { - opacity: 0; transform: translateY(10px) scale(0.98); } } diff --git a/docs/PROJECT_FACTS.json b/docs/PROJECT_FACTS.json index 66a8f6d..e89a326 100644 --- a/docs/PROJECT_FACTS.json +++ b/docs/PROJECT_FACTS.json @@ -80,6 +80,20 @@ "signingStatus": "unsigned-certificate-and-signing-authorization-required", "projectLicense": "MIT" }, + "repositorySecurity": { + "privateVulnerabilityReporting": "enabled-and-verified-2026-08-17", + "secretScanning": "enabled", + "pushProtection": "enabled", + "dependabotSecurityUpdates": "enabled", + "dependabotAlertReview": { + "advisory": "GHSA-wrw7-89jp-8q8g", + "lockedPackage": "glib@0.18.5", + "allTargetGraph": "present-via-gtk-webkit-tauri", + "windowsTargetGraph": "absent-verified-with-cargo-tree", + "disposition": "not-used-on-supported-windows-target", + "reassessBefore": "linux-support-or-tauri-gtk-stack-change" + } + }, "knownLimitations": [ "IndexedDB durability and eviction are controlled by the Windows WebView2 profile; metadata export is one-way and not a restorable library backup.", "PDF content is canvas-only, without a selectable text layer, document search, annotations, or complete screen-reader access.", diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 15c7983..c016931 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -16,6 +16,7 @@ Reader `0.1.0-alpha.4` is a Windows-first, local-first reading-library prereleas - Prevented stale callbacks across deletion, library reset, reader close, renderer destruction, and rapid PDF/audio transitions from recreating records or overwriting a newer reader. - Added a database existence guard plus explicit IndexedDB transaction abort handling for synchronous quota-style failures. - Fixed browser-discovered contrast, accessible-name, sanitizer-root, and asynchronous reader-transition defects. +- Kept dialog entry motion while removing whole-dialog opacity animation, preventing transient sub-threshold text and destructive-control contrast during accessibility scans and real use. ## Security and parser changes @@ -43,7 +44,7 @@ Reader `0.1.0-alpha.4` is a Windows-first, local-first reading-library prereleas - Unsigned installer; no signing certificate use approved. - No clean Windows 10/11 install, offline launch, persistence, upgrade, uninstall, and residual-data matrix. -- The private vulnerability-reporting route remains unverified; any tag, GitHub Release, or public binary download still requires separate review and approval. +- GitHub private vulnerability reporting is enabled for the public source repository. Any tag, GitHub Release, or public binary download still requires separate review and approval. - Manual screen-reader, Windows high-contrast, 400% zoom, and packaged audio/PDF verification remain incomplete. No public binary release should be created from these notes until every blocker is closed and the facts ledger is regenerated. diff --git a/docs/RELEASE_PROCESS.md b/docs/RELEASE_PROCESS.md index 22c0b8d..fa80857 100644 --- a/docs/RELEASE_PROCESS.md +++ b/docs/RELEASE_PROCESS.md @@ -62,7 +62,7 @@ Before a supported public binary release: - sign the executable and installer with an authorized Authenticode certificate; - run the clean Windows 10/11 install, offline launch, persistence, upgrade, uninstall, and residual-data matrix; - complete the scoped screen-reader, high-contrast, 400% zoom, packaged PDF, and packaged audio checks; -- verify the GitHub private-vulnerability-reporting/security-advisory route; +- confirm the enabled GitHub private-vulnerability-reporting/security-advisory route remains available; - rerun artifact verification and privacy scanning against the signed candidate; - obtain explicit approval for visibility, tag, release, binary upload, and any recruiter/profile edits. diff --git a/scripts/prepare-release-candidate.mjs b/scripts/prepare-release-candidate.mjs index cb02ac3..fffd45d 100644 --- a/scripts/prepare-release-candidate.mjs +++ b/scripts/prepare-release-candidate.mjs @@ -157,11 +157,11 @@ const signatureStatus = [ 'No signing certificate or signing authorization was provided for this candidate.', '', ].join('\n'); -const report = `# Reader ${packageJson.version} private release-candidate report +const report = `# Reader ${packageJson.version} public-source binary release-candidate report Generated: ${createdAt} Source commit: \`${sourceCommit}\` -Publication decision: **NOT READY for public release** +Publication decision: **NOT READY for a supported public binary release** ## Passed local evidence @@ -181,7 +181,7 @@ Publication decision: **NOT READY for public release** - Clean Windows 10/11 install, offline launch, upgrade, uninstall, and residual-data matrix: ${facts.verification.cleanWindowsMatrix}. - Manual screen-reader, Windows high-contrast, 400% zoom, and packaged audio/PDF checks: incomplete. -This directory is a private staging candidate, not an approved public release or download channel. +This directory is a local binary candidate built from public source. It is not an approved release or supported download channel. `; await writeFile(resolve(directory, 'CHECKSUMS.sha256'), checksums, { flag: 'wx' }); @@ -192,5 +192,5 @@ await writeFile(resolve(directory, 'build-manifest.json'), `${JSON.stringify(man }); console.log( - `Private release candidate prepared: ${artifacts.length} immutable artifacts; source commit ${sourceCommit}; installer ${installerSignature.status}; executable subsystem ${pe.subsystem}.`, + `Public-source binary candidate prepared: ${artifacts.length} immutable artifacts; source commit ${sourceCommit}; installer ${installerSignature.status}; executable subsystem ${pe.subsystem}.`, );