ReproCrate v0.9.0 (CLI and Desktop release candidate quality preview)

ReproCrate v0.9.0 — release quality and security hardening (developer pre-release)

Candidate until the full guarded release workflow and GitHub Releases API verify publication. v0.9.0 is a pre-release preparing for a future stable milestone, not a certified v1.0.0.

Changes

• Literal Markdown metadata: report title, command metadata, failure summary and warnings no longer render untrusted inline Markdown links/images as active URLs. HTML delimiters remain encoded. Fenced stdout/stderr are separate and do not execute.
• Safer CLI report imports: imports reject non-regular files and symbolic links before attempting to read, including named pipes that may otherwise block indefinitely. Opening checks confirm a regular file, enforce the existing 4 MiB budget and on Unix compare the selected file identity with the opened handle.
• Core and CLI regressions: crafted malicious Markdown/HTML metadata tests, symlink/non-regular path tests, and existing privacy behaviors.
• Real CLI smoke tests: a portable Python standard-library harness tests the actual release-built CLI against temporary inert fixtures; verifies version, offline environment summary, log analysis, checksum matches, checksum tampering and no-overwrite behavior.
• Stronger release gating: published-archive SHA-256 is verified by the just-built CLI before uploading; a separate strict GitHub Releases manifest validator requires exactly six nonempty CLI/desktop archives and six size-bounded uploaded sidecars with expected platform names and a draft prerelease target.
• QA evidence: an explicit cross-platform release-candidate checklist separates CI-evidenced verification from unperformed clean-machine GUI, accessibility, signing, license and supply-chain checks.
• Synced Rust workspace, desktop/Tauri, npm package and corresponding lockfiles to v0.9.0, preserving the previous report schema and all offline CLI/desktop capabilities.

Limitations

No sandboxing of intentionally captured commands, no guarantee that masking detects every secret, no third-party tracker upload, no signed installers/notarization, and no clean-machine GUI QA certification. A successful SHA-256 match is integrity only, not authentication or malware scanning. GitHub Pages requires repository-level enablement and must be independently verified before claiming a live site.

The generated RC test matrix is documented in QA checklist. See security policy, distribution, and handoff.

Release requirements

Run complete Rust tests/Clippy/rustfmt and locked dependency inventory validation. Build and smoke-test actual CLI binaries plus compile/test real desktop executables on Ubuntu Linux x86-64, Windows x86-64 and macOS ARM64. Stage unsigned native archives and SHA-256 sidecars, verify package digests, require exactly 12 uploaded assets in the GitHub Releases API, and only then change the release from draft to public pre-release.