Skip to content

v0.1.0

Choose a tag to compare

View all tags
@maruson08 maruson08 released this 26 Aug 03:41
v0.1.0
352258e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

secure-metadata v0.1.0

First public release of secure-metadata, a privacy-first, local-only TypeScript library for inspecting, cleaning, and verifying metadata in JPEG, PNG, and WebP files.

Highlights

  • JPEG / PNG / WebP metadata inspection, cleaning, and verification
  • Shared bounded TIFF / EXIF decoder
  • Privacy-focused default cleaning policy
  • Strict bounds checking for untrusted binary input
  • Deterministic malformed-input handling
  • Zero runtime dependencies
  • Browser and Node-compatible core
  • Standalone browser ESM artifact
  • Reproducible release artifacts with SHA-256 verification

Validation

  • 19 frozen runtime exports
  • 27 test files / 235 tests passed
  • 250 deterministic fuzz iterations passed
  • Real Chromium browser smoke test passed
  • Two clean builds produced byte-identical artifacts
  • 0 npm vulnerabilities
  • 0 runtime dependencies

Release artifacts

secure-metadata-0.1.0.tgz
SHA-256:
d7e1c5069651fa4d879eab26e2d1a2c577cad586c7b56b2df7d5819ae53186ea

secure-metadata-0.1.0.browser.js
SHA-256:
8d0b8a1addf904760aa1f52378fb05eed6540520cb05fe2320d77011cba69c28

SHA256SUMS is included for artifact verification.

Source commit:

352258ec413a838dfe8b9146370505f125b5ae10

Important limitations

  • WebP EXIF is container-detection only
  • compressed PNG metadata payloads are not decompressed
  • MakerNote remains opaque
  • unknown metadata may intentionally be preserved
  • ICC/color profiles are preserved by default
  • verification covers supported observable metadata state only and does not guarantee complete file privacy

Compatibility

secure-metadata is pre-1.0 software.

The v0.1.x public API surface is defined and tested, but future pre-1.0 minor releases may contain documented breaking changes.

npm publication is not part of this release.

Assets 4
Loading