Skip to content

RepoDNA 1.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 07:15
· 37 commits to main since this release
v1.4.2
6d4df7f

A stability-focused release that improves Windows CLI startup, updates a
vulnerable archive dependency, strengthens validation of untrusted archives,
and adds checks for packaged Windows executables and installer artifacts.

Fixed

  • Launching the portable repodna CLI without arguments now prints the full
    command reference and exits successfully instead of returning usage error 2.
    Invalid options and subcommands continue to return usage error 2. This may
    improve package-manager executable validation; Microsoft's v1.4.1 CLI
    validation warning is not yet confirmed to have this cause.

Security

  • Upgrade the core and desktop lockfiles to zip 9.0.4 to address
    published archive-extraction security advisories affecting zip 8.6.0.
    ZIP entry-name decoding is now treated as fallible; malformed names are
    rejected instead of being passed to the extraction path sanitizer.

Packaging

  • Validate all four Windows release artifacts before writing any WinGet
    manifests; a missing or invalid later artifact no longer leaves partial YAML
    files that could be mistaken for submission-ready packages.

  • The portable ZIP preflight now rejects out-of-package entries and symbolic
    links and verifies archive payload integrity, in addition to existing
    traversal, duplicate-name and executable-path checks.

  • Harden WinGet manifest generation: hash large release installers in fixed-size
    chunks and reject portable ZIP archives with unsafe or duplicate entry paths,
    missing executable paths, or empty installer files.

  • Add a Windows portable ZIP smoke verifier: check the nested binary layout,
    PE machine architecture, and CLI startup, help, version and usage exit codes.
    ARM64 cross-compiled archives undergo static validation until a native
    Windows-on-Arm execution test is available.

Tests

  • New WinGet regression tests exercise missing executables, ZIP path traversal,
    and zero-byte MSI assets. Windows CI now packages and executes the CLI from a
    clean temporary ZIP extraction, and the release workflow rechecks both x64
    and ARM64 archives before they can be uploaded.
  • Regression coverage checks the no-argument launch, help output, and
    --version exit status. CI and the release pipeline smoke-test the
    no-argument startup on supported build runners before publishing artifacts.

Release validation

  • The release workflow now runs actual Windows ZIP smoke tests inside the CLI
    matrix, rather than leaving an inapplicable check in the WebAssembly job.
  • Windows x64 and ARM64 builds must each produce nonempty MSI and setup EXE
    artifacts before the desktop job succeeds.
  • GitHub release downloads and WinGet catalog publication remain separate:
    Microsoft's review of the v1.4.1 desktop and CLI package submissions was
    still pending when this release was prepared. Do not describe WinGet
    installation of v1.4.2 as available until it is independently indexed.

Downloads

  • repodna-1.4.2-<target>: the repodna command line, with the web interface of
    repodna serve built in. The Linux builds are static and run on any distribution.
  • repodna-1.4.2-wasm32-wasip1.zip: RepoDNA's analysis, reports, and cards as
    WebAssembly, the program the web version runs, for WASI runtimes:
    wasmtime run --dir .::/my-project repodna.wasm analyze /my-project (without Git
    history).
  • RepoDNA_1.4.2_amd64.deb, RepoDNA-1.4.2-1.x86_64.rpm,
    RepoDNA_1.4.2_universal.dmg, RepoDNA_1.4.2_x64_en-US.msi,
    RepoDNA_1.4.2_x64-setup.exe, and for Windows on Arm
    RepoDNA_1.4.2_arm64_en-US.msi and RepoDNA_1.4.2_arm64-setup.exe: the
    desktop app.
  • ghcr.io/sanskarin/repodna:1.4.2: a container image with the command line and
    Git, for CI jobs: docker run --rm -v "$PWD:/work" ghcr.io/sanskarin/repodna analyze .
  • ghcr.io/sanskarin/repodna-web:1.4.2: the web interface, served on port 8080, for
    your own network: docker run --rm -p 8080:8080 ghcr.io/sanskarin/repodna-web
  • npm packages on npmjs.com and GitHub Packages: npm install --global @sanskarin/repodna
    installs the command line, with one package per platform;
    npx @sanskarin/repodna-web runs the web interface on this machine;
    npx @sanskarin/repodna-wasm analyze . analyzes with the WebAssembly program, on any
    system Node.js runs on, and runs it in browsers too;
    @sanskarin/repodna-schema and @sanskarin/repodna-visualization are the TypeScript
    libraries.
  • repodna-1.4.2-winget-manifests.zip: WinGet community manifests for
    the Windows desktop app (Sanskar.RepoDNA) and CLI (Sanskar.RepoDNA.CLI).
    After Microsoft accepts the manifests, install and upgrade through winget.
  • SHA256SUMS.txt: checksums of every file.
  • Web version: https://sanskarin.github.io/RepoDNA/ — analyze a folder or an archive, or open analyses and the demo, in your browser: nothing to install, nothing uploaded.

The binaries are not code-signed, so macOS and Windows ask for confirmation the first time they start; see the installation guide.

More open-source projects by Sanskar, the creator of RepoDNA: https://sanskarin.github.io

Assets 18
Loading