Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Gergő Törcsvári f6b0aaf122 findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it ... security-audit-v3 #15. download_file already had a verify branch; no caller used it and every *_SHA256 in versions.sh was a commented placeholder, so a tampered mirror tarball flowed straight into configure/make and the shipped WASM. - versions.sh: 13 pins (cross-checked against Homebrew/Buildroot/nixpkgs/ FreeBSD/vcpkg/boost.org/curl PGP; glm .zip is TOFU), boost/curl/libgit2 versions moved beside their pins. - all 13 download_file call sites pass "${NAME_SHA256}". - download_file refuses an empty or malformed pin (PCBJAM_ALLOW_UNPINNED=1 to bootstrap a new dep); file_sha256 prefers sha256sum, falls back to shasum. - scripts/deps/check-pins.sh: static 3-arg check + offline file:// enforcement test; runs in wasm-build.yml before the deps cache, on cache hits too. Expect one cold --build-deps run: the deps-cache key hashes versions.sh. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GcsgJZ77bhZatLAVU8R84H		2026-08-28 20:34:16 +02:00
..
ngspice-wasm	eeschema simulator: lazy ngspice_service worker — static sharedspice (XSPICE registry + CIDER), init_dll ifdef, e2e both engines	2026-07-19 15:59:21 +02:00
build-all-deps.sh	Enable exceptions and pthreads atomics for KiCad WASM build	2025-12-13 11:29:45 +01:00
build-boost.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-cairo.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-curl-headers.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-freetype.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-glm.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-harfbuzz.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-libgit2-headers.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-ngspice.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-opencascade.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-pixman.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-protobuf.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
build-zstd.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00
check-pins.sh	findings X-1: pin every dependency tarball fetch to a SHA256 and enforce it	2026-08-28 20:34:16 +02:00