From 1c1252ec70a77c46cdc034689e0733424e5a0692 Mon Sep 17 00:00:00 2001 From: Paneloom Local Baseline Date: Tue, 21 Jul 2026 13:20:22 +0800 Subject: [PATCH] Prepare v0.1.0-beta.2 security release --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- CHANGELOG.md | 10 ++++++++++ README.ja.md | 2 +- README.ko.md | 2 +- README.md | 2 +- README.zh-CN.md | 2 +- THIRD_PARTY_LICENSES.md | 2 +- VERSION | 2 +- frontend/package-lock.json | 4 ++-- frontend/package.json | 2 +- packaging/README.md | 4 +++- packaging/paneloom.nsi | 4 ++-- packaging/version_info.txt | 8 ++++---- release-source.json | 12 ++++++------ sbom/frontend.cdx.json | 14 +++++++------- sbom/python-build.cdx.json | 14 +++++++------- sbom/python-runtime.cdx.json | 14 +++++++------- scripts/build_windows_installer.ps1 | 10 +++++++++- 18 files changed, 65 insertions(+), 45 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 3dedb49..547cdb9 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -10,7 +10,7 @@ body: id: version attributes: label: Paneloom version or commit - placeholder: 0.1.0-beta.1 or a Git commit hash + placeholder: 0.1.0-beta.2 or a Git commit hash validations: required: true - type: input diff --git a/CHANGELOG.md b/CHANGELOG.md index 396e34b..215637b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,16 @@ All notable changes to Paneloom are recorded here. +## 0.1.0-beta.2 - 2026-07-21 + +- Constrained project creation, opening, migration, backup, restore, image, and reference paths to approved local roots. +- Added native desktop path authorization for user-selected locations and server-generated identifiers for new local resources. +- Prevented absolute-path and traversal inputs from escaping project storage boundaries. +- Hardened review-period file access, repository hygiene checks, GitHub Actions permissions, dependency review, and CodeQL scanning. +- Added path-security regression tests while preserving existing self-contained project and desktop workflows. + +This is an unsigned security maintenance Beta. It supersedes `0.1.0-beta.1` for public testing but remains a pre-release and still requires an independent clean-machine test before a signed stable release. + ## 0.1.0-beta.1 - 2026-07-18 - Added a self-contained, movable local project structure with backup and restore. diff --git a/README.ja.md b/README.ja.md index 5cb6af7..1958774 100644 --- a/README.ja.md +++ b/README.ja.md @@ -29,7 +29,7 @@ Paneloom は、Windows ローカル優先・一人用の AI 漫画／アニメ ## 現在の状態 -`0.1.0-beta.1` は Windows ローカルデスクトップ Beta です。プロジェクトの移動、バックアップと復元、production-like pywebview/WebView2 起動、ランダムなループバックポート、正常終了を開発用 Windows 環境で検証済みです。無料のモデル利用枠は付属せず、互換性のあるテキスト／画像モデル API をユーザーが設定します。 +`0.1.0-beta.2` は Windows ローカルデスクトップ向けのセキュリティ保守 Beta です。プロジェクトの移動、バックアップと復元、production-like pywebview/WebView2 起動、ランダムなループバックポート、正常終了を維持しながら、プロジェクトパス、復元処理、ローカルファイルアクセス境界を強化しました。無料のモデル利用枠は付属せず、互換性のあるテキスト／画像モデル API をユーザーが設定します。 現在のインストーラーは Authenticode 未署名で、独立したクリーンな Windows 10/11 環境での最終検証も未実施です。そのため、署名済み正式版として扱うことはできません。 diff --git a/README.ko.md b/README.ko.md index 37f363b..b72248c 100644 --- a/README.ko.md +++ b/README.ko.md @@ -29,7 +29,7 @@ Paneloom은 Windows 로컬 우선 방식으로 동작하는 1인 창작자용 AI ## 현재 상태 -`0.1.0-beta.1`은 Windows 로컬 데스크톱 Beta입니다. 프로젝트 이동, 백업과 복원, production-like pywebview/WebView2 실행, 임의 루프백 포트, 정상 종료를 개발용 Windows 환경에서 검증했습니다. 무료 모델 사용량은 포함되지 않으며 사용자가 호환되는 텍스트 및 이미지 모델 API를 직접 설정해야 합니다. +`0.1.0-beta.2`는 Windows 로컬 데스크톱용 보안 유지보수 Beta입니다. 프로젝트 이동, 백업과 복원, production-like pywebview/WebView2 실행, 임의 루프백 포트, 정상 종료를 유지하면서 프로젝트 경로, 복원 처리, 로컬 파일 접근 경계를 강화했습니다. 무료 모델 사용량은 포함되지 않으며 사용자가 호환되는 텍스트 및 이미지 모델 API를 직접 설정해야 합니다. 현재 설치 프로그램은 Authenticode 서명이 없고 독립적인 클린 Windows 10/11 환경에서 최종 검증하지 않았습니다. 따라서 서명된 정식 배포판으로 표현할 수 없습니다. diff --git a/README.md b/README.md index e7e45ce..e7a781a 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ Licensed under the MIT License. Local desktop beta. Self-contained project folders, legacy migration, backup/restore, offline local editing, and the pywebview/WebView2 runtime are validated. A traceable unsigned Windows Beta installer has been built and exercised on the development Windows 11 machine. The binary is not committed to this repository and has not been validated on an independent clean Windows machine. -The frozen business source is `v0.1.0-beta.1-functional-baseline`. The open-source release line adds only packaging and release-compliance material; `release-source.json` records both immutable source identities. WEBTOON/Tapas submission-package work belongs to a later feature branch and is not part of this release. +The current security-maintenance source is frozen at `v0.1.0-beta.2-functional-baseline`. The release line adds only versioned packaging and release-compliance material after that point; `release-source.json` records the immutable source identities. WEBTOON/Tapas submission-package work belongs to a separate later feature branch and is not part of this release. ## What It Does diff --git a/README.zh-CN.md b/README.zh-CN.md index 2c29afb..0ba53c9 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -29,7 +29,7 @@ Paneloom 是一款 Windows 本地优先、面向单人创作者的 AI 漫画与 ## 当前状态 -`0.1.0-beta.1` 是 Windows 本地桌面 Beta。项目可移动性、备份恢复、production-like pywebview/WebView2 启动、随机回环端口和干净退出已经完成本机验证。软件不附带免费模型额度，需要用户自行配置兼容的文本和图片模型 API。 +`0.1.0-beta.2` 是 Windows 本地桌面安全维护 Beta。它保留项目可移动性、备份恢复、production-like pywebview/WebView2 启动、随机回环端口和干净退出，并加强了项目路径、备份恢复和本地文件访问边界。软件不附带免费模型额度，需要用户自行配置兼容的文本和图片模型 API。 当前安装器尚未进行 Authenticode 签名，也尚未在独立干净的 Windows 10/11 机器完成最终验证，因此不应描述为正式签名发行版。 diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md index bfef9b5..b715d44 100644 --- a/THIRD_PARTY_LICENSES.md +++ b/THIRD_PARTY_LICENSES.md @@ -1,7 +1,7 @@ # Paneloom third-party license inventory This file is generated from the exact Python build environment and frontend lock file. -Source commit: `d34d148152f63846bc42fec083b20b3cd29da563` +Source commit: `bb191af22e55076fd6c09a04727d790ed7fa99ed` It is a distribution inventory, not legal advice. Package authors retain their rights. diff --git a/VERSION b/VERSION index 4ab2ff6..b1b57dd 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.0-beta.1 +0.1.0-beta.2 diff --git a/frontend/package-lock.json b/frontend/package-lock.json index d29a070..398aaca 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "paneloom-frontend", - "version": "0.1.0-beta.1", + "version": "0.1.0-beta.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "paneloom-frontend", - "version": "0.1.0-beta.1", + "version": "0.1.0-beta.2", "dependencies": { "lucide-react": "1.14.0", "react": "19.2.6", diff --git a/frontend/package.json b/frontend/package.json index e0a17f7..4bdd018 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,6 @@ { "name": "paneloom-frontend", - "version": "0.1.0-beta.1", + "version": "0.1.0-beta.2", "private": true, "type": "module", "scripts": { diff --git a/packaging/README.md b/packaging/README.md index a8ff139..75ff3ce 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -1,8 +1,10 @@ # Windows packaging The installer is built only from a clean Git worktree. The application source -must match the annotated `v0.1.0-beta.1-functional-baseline` tag; later changes +must match the annotated `v0.1.0-beta.2-functional-baseline` tag; later changes are limited to the packaging files listed by `scripts/build_windows_installer.ps1`. +The exact clean commit being packaged must also be tagged +`v0.1.0-beta.2-open-source` before the build starts. Build from PowerShell: diff --git a/packaging/paneloom.nsi b/packaging/paneloom.nsi index b347e81..9b14f8d 100644 --- a/packaging/paneloom.nsi +++ b/packaging/paneloom.nsi @@ -17,7 +17,7 @@ Unicode true !error "WEBVIEW_BOOTSTRAPPER must point to the signed Microsoft bootstrapper." !endif !ifndef APP_VERSION - !define APP_VERSION "0.1.0-beta.1" + !define APP_VERSION "0.1.0-beta.2" !endif !define APP_REGISTRY_KEY "Software\Paneloom" @@ -35,7 +35,7 @@ BrandingText "Paneloom" Icon "${SOURCE_ROOT}\desktop\resources\paneloom.ico" UninstallIcon "${SOURCE_ROOT}\desktop\resources\paneloom.ico" -VIProductVersion "0.1.0.1" +VIProductVersion "0.1.0.2" VIAddVersionKey /LANG=1033 "ProductName" "Paneloom" VIAddVersionKey /LANG=1033 "CompanyName" "Paneloom contributors" VIAddVersionKey /LANG=1033 "FileDescription" "Paneloom Windows installer" diff --git a/packaging/version_info.txt b/packaging/version_info.txt index 3c2956d..452a285 100644 --- a/packaging/version_info.txt +++ b/packaging/version_info.txt @@ -1,7 +1,7 @@ VSVersionInfo( ffi=FixedFileInfo( - filevers=(0, 1, 0, 1), - prodvers=(0, 1, 0, 1), + filevers=(0, 1, 0, 2), + prodvers=(0, 1, 0, 2), mask=0x3f, flags=0x0, OS=0x40004, @@ -16,12 +16,12 @@ VSVersionInfo( [ StringStruct(u'CompanyName', u'Paneloom contributors'), StringStruct(u'FileDescription', u'Paneloom local AI comic storyboard desktop tool'), - StringStruct(u'FileVersion', u'0.1.0-beta.1'), + StringStruct(u'FileVersion', u'0.1.0-beta.2'), StringStruct(u'InternalName', u'Paneloom'), StringStruct(u'LegalCopyright', u'Copyright (c) 2026 Paneloom contributors'), StringStruct(u'OriginalFilename', u'Paneloom.exe'), StringStruct(u'ProductName', u'Paneloom'), - StringStruct(u'ProductVersion', u'0.1.0-beta.1') + StringStruct(u'ProductVersion', u'0.1.0-beta.2') ] ) ]), diff --git a/release-source.json b/release-source.json index ffab159..75eac05 100644 --- a/release-source.json +++ b/release-source.json @@ -1,8 +1,8 @@ { - "version": "0.1.0-beta.1", - "frozen_business_tag": "v0.1.0-beta.1-functional-baseline", - "frozen_business_commit": "09fe927ffde5d1775adc0f7904da021932ecf143", - "packaging_source_commit": "d34d148152f63846bc42fec083b20b3cd29da563", - "packaging_source_tag": "v0.1.0-beta.1-packaging-source", - "open_source_tag": "v0.1.0-beta.1-open-source" + "version": "0.1.0-beta.2", + "frozen_business_tag": "v0.1.0-beta.2-functional-baseline", + "frozen_business_commit": "bb191af22e55076fd6c09a04727d790ed7fa99ed", + "packaging_source_commit": "bb191af22e55076fd6c09a04727d790ed7fa99ed", + "packaging_source_tag": "v0.1.0-beta.2-packaging-source", + "open_source_tag": "v0.1.0-beta.2-open-source" } diff --git a/sbom/frontend.cdx.json b/sbom/frontend.cdx.json index d5a90e0..2321eab 100644 --- a/sbom/frontend.cdx.json +++ b/sbom/frontend.cdx.json @@ -2,10 +2,10 @@ "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", - "serialNumber": "urn:uuid:18d7fd5b-55ba-40c2-87de-3e782c3d21e0", + "serialNumber": "urn:uuid:0b7782c1-a7d8-4b27-8e5e-36e8d3334dc1", "version": 1, "metadata": { - "timestamp": "2026-07-20T06:22:11.288Z", + "timestamp": "2026-07-21T05:09:49.086Z", "lifecycles": [ { "phase": "pre-build" @@ -19,12 +19,12 @@ } ], "component": { - "bom-ref": "paneloom-frontend@0.1.0-beta.1", - "type": "application", + "bom-ref": "paneloom-frontend@0.1.0-beta.2", + "type": "library", "name": "frontend", - "version": "0.1.0-beta.1", + "version": "0.1.0-beta.2", "scope": "required", - "purl": "pkg:npm/paneloom-frontend@0.1.0-beta.1", + "purl": "pkg:npm/paneloom-frontend@0.1.0-beta.2", "properties": [ { "name": "cdx:npm:package:path", @@ -6131,7 +6131,7 @@ ], "dependencies": [ { - "ref": "paneloom-frontend@0.1.0-beta.1", + "ref": "paneloom-frontend@0.1.0-beta.2", "dependsOn": [ "lucide-react@1.14.0", "react@19.2.6", diff --git a/sbom/python-build.cdx.json b/sbom/python-build.cdx.json index 5e3aa99..0395182 100644 --- a/sbom/python-build.cdx.json +++ b/sbom/python-build.cdx.json @@ -2,24 +2,24 @@ "$schema": "https://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", - "serialNumber": "urn:uuid:f7de19aa-d579-5b7b-9e91-7433cd036b53", + "serialNumber": "urn:uuid:33495c6e-ddbb-51ea-bb3a-c666b3b447be", "version": 1, "metadata": { - "timestamp": "2026-07-20T12:46:20+08:00", + "timestamp": "2026-07-21T12:11:36+08:00", "component": { "type": "application", - "bom-ref": "pkg:generic/paneloom@0.1.0-beta.1", + "bom-ref": "pkg:generic/paneloom@0.1.0-beta.2", "name": "Paneloom", - "version": "0.1.0-beta.1" + "version": "0.1.0-beta.2" }, "properties": [ { "name": "paneloom:source-commit", - "value": "d34d148152f63846bc42fec083b20b3cd29da563" + "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed" }, { "name": "paneloom:frozen-business-commit", - "value": "09fe927ffde5d1775adc0f7904da021932ecf143" + "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed" }, { "name": "paneloom:python-scope", @@ -1617,7 +1617,7 @@ ], "dependencies": [ { - "ref": "pkg:generic/paneloom@0.1.0-beta.1", + "ref": "pkg:generic/paneloom@0.1.0-beta.2", "dependsOn": [ "pkg:pypi/fastapi@0.139.2", "pkg:pypi/openpyxl@3.1.5", diff --git a/sbom/python-runtime.cdx.json b/sbom/python-runtime.cdx.json index 0720194..199daf0 100644 --- a/sbom/python-runtime.cdx.json +++ b/sbom/python-runtime.cdx.json @@ -2,24 +2,24 @@ "$schema": "https://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.5", - "serialNumber": "urn:uuid:d8368f9a-3ab8-5cde-a39d-d32a92f632a9", + "serialNumber": "urn:uuid:3761bb18-7345-54a6-a099-471ab56c6c4b", "version": 1, "metadata": { - "timestamp": "2026-07-20T12:46:20+08:00", + "timestamp": "2026-07-21T12:11:36+08:00", "component": { "type": "application", - "bom-ref": "pkg:generic/paneloom@0.1.0-beta.1", + "bom-ref": "pkg:generic/paneloom@0.1.0-beta.2", "name": "Paneloom", - "version": "0.1.0-beta.1" + "version": "0.1.0-beta.2" }, "properties": [ { "name": "paneloom:source-commit", - "value": "d34d148152f63846bc42fec083b20b3cd29da563" + "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed" }, { "name": "paneloom:frozen-business-commit", - "value": "09fe927ffde5d1775adc0f7904da021932ecf143" + "value": "bb191af22e55076fd6c09a04727d790ed7fa99ed" }, { "name": "paneloom:python-scope", @@ -863,7 +863,7 @@ ], "dependencies": [ { - "ref": "pkg:generic/paneloom@0.1.0-beta.1", + "ref": "pkg:generic/paneloom@0.1.0-beta.2", "dependsOn": [ "pkg:pypi/fastapi@0.139.2", "pkg:pypi/openpyxl@3.1.5", diff --git a/scripts/build_windows_installer.ps1 b/scripts/build_windows_installer.ps1 index 9e80de9..6877140 100644 --- a/scripts/build_windows_installer.ps1 +++ b/scripts/build_windows_installer.ps1 @@ -1,5 +1,5 @@ param( - [string]$BaselineTag = "v0.1.0-beta.1-functional-baseline" + [string]$BaselineTag = "v0.1.0-beta.2-functional-baseline" ) $ErrorActionPreference = "Stop" @@ -60,6 +60,10 @@ if (-not $packagingSourceTagCommit -or $packagingSourceTagCommit -ne $releaseSource.packaging_source_commit) { throw "The packaging source tag does not match release-source.json." } +$openSourceTagCommit = (git rev-list -n 1 $releaseSource.open_source_tag).Trim() +if (-not $openSourceTagCommit -or $openSourceTagCommit -ne $packagingCommit) { + throw "The open-source release tag must point to the exact clean commit being packaged." +} git merge-base --is-ancestor $releaseSource.packaging_source_commit $packagingCommit if ($LASTEXITCODE -ne 0) { throw "The recorded packaging source is not an ancestor of the current release commit." @@ -68,8 +72,10 @@ if ($LASTEXITCODE -ne 0) { $allowedChanges = @( ".gitignore", ".github/CODEOWNERS", + ".github/ISSUE_TEMPLATE/bug_report.yml", ".github/workflows/ci.yml", "CHANGELOG.md", + "VERSION", "README.md", "README.en.md", "README.ja.md", @@ -80,6 +86,8 @@ $allowedChanges = @( "docs/open_source_release_readiness_2026-07-20.md", "docs/screenshots/", "docs/windows_installer_validation_2026-07-20.md", + "frontend/package.json", + "frontend/package-lock.json", "packaging/", "release-source.json", "requirements-build.txt",