54fe6c1964
- Add minimum version requirements to deny.toml (ring >= 0.17.5, rustls >= 0.23) - Create build/CHECKSUMS.sha256 for build-time data file integrity - Update build.rs to verify checksums on every build - Add tampering detection tests (th06_checksum_test.rs) - Create nightly supply-chain scan workflow (pdftract-nightly-supply-chain.yaml) - Update audit.toml with advisory exceptions Closes: pdftract-1xf4d Refs: plan lines 877, 883-896, 906-913
31 lines
1.9 KiB
Text
31 lines
1.9 KiB
Text
# SHA-256 checksums for build-time data files
|
|
#
|
|
# This file pins the checksums of all build-time data files used in pdftract-core.
|
|
# The build.rs script verifies these checksums on every build to detect tampering.
|
|
# If a checksum mismatch occurs, the build will abort with a clear error message.
|
|
#
|
|
# To regenerate this file after legitimate changes to build-time data:
|
|
# cd crates/pdftract-core/build && sha256sum std14-metrics.json named-encodings.json agl.json font-fingerprints.json wordlist-en-20k.txt predefined-cmaps/*.json > CHECKSUMS.sha256
|
|
# # For glyph-shapes.json (workspace root build/ dir):
|
|
# sha256sum ../../../build/glyph-shapes.json >> CHECKSUMS.sha256
|
|
#
|
|
# Bead: pdftract-1xf4d (TH-06 supply-chain gate)
|
|
# Plan: line 909 (Build-time data files checksum pin)
|
|
#
|
|
# Format: <checksum> <relative-path-from-crate-build-dir>
|
|
|
|
# Core build-time data files (in crates/pdftract-core/build/)
|
|
b86f59017313b50bb5e9458e62f1940a9147f7caf810149d7eef88adce048cd9 std14-metrics.json
|
|
b14b625d6bf62d1a1d44bd778e282dfdcc10d787c6ea69cf466d231c5f21cc4a named-encodings.json
|
|
c9c1bfb4b995e1d94b5e4132f775b362468e182c69b29596d6b1fca4be59113c agl.json
|
|
37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570 font-fingerprints.json
|
|
4ed6e5336d7760d281f7e72df31827da880c861363e820d8c65666b0f10d9ac0 wordlist-en-20k.txt
|
|
|
|
# Predefined CMap files (in crates/pdftract-core/build/predefined-cmaps/)
|
|
09da49c09f92f1c3e247cc6bc61dcfc7bca6dc5ab5e62b3da30e9be759e12b57 predefined-cmaps/adobe-cns1.json
|
|
f93b8e12c2bb8b9e0e00e4c65c9a39bc5c6d89e8618dc0d69e0c4e6a79012e5 predefined-cmaps/adobe-gb1.json
|
|
3752c80eeed25ee7875dc9b354c78f23976766c8d8ca3a4e5cc5f40430a9e385 predefined-cmaps/adobe-japan1.json
|
|
ec1ecc8937d9c7e94d9e9c5a237c1d8a8e3bb5e0fddcf0c78866f8e7e52d89b predefined-cmaps/adobe-korea1.json
|
|
|
|
# Glyph shapes database (in workspace root build/ dir, accessed via workspace_root)
|
|
a3cba1a5b82c6f04e25450608ceeffd3b66b3de2ee1c28da008bc59de6625a96 ../../../build/glyph-shapes.json
|