From 97c0afd32e5dffa958df6c079b7e34624adfcc48 Mon Sep 17 00:00:00 2001 From: maruson08 Date: Wed, 26 Aug 2026 12:47:34 +0900 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=84[Docs]=20Update=20post-v0.1.0=20rel?= =?UTF-8?q?ease=20status?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 2 +- README.md | 10 ++++------ SECURITY.md | 10 +++++----- docs/releasing.md | 12 ++++++------ 4 files changed, 16 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e617542..26e7fb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes will be documented here. The project intends to follow seman ## Unreleased -## 0.1.0 - Release candidate +## 0.1.0 - 2026-08-26 ### Added diff --git a/README.md b/README.md index 0439340..fe1e5af 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # secure-metadata -`secure-metadata` is a pre-release TypeScript library for deterministic, security-conscious inspection, cleaning, and verification of metadata in binary image formats. It is built for privacy-first, entirely local use with no analytics, telemetry, network access, runtime CDN, or pixel decoding. +`secure-metadata` is a pre-1.0 TypeScript library for deterministic, security-conscious inspection, cleaning, and verification of metadata in binary image formats. It is built for privacy-first, entirely local use with no analytics, telemetry, network access, runtime CDN, or pixel decoding. ## Development status @@ -22,11 +22,9 @@ JPEG supports bounded inspection, common TIFF/EXIF field decoding, cleaning, and ## Installation -After publication, install from npm: +The package is not currently published to npm. Source and release artifacts for `v0.1.0` are available from the [GitHub release](https://github.com/SecureToolsProject/Secure_Metadata/releases/tag/v0.1.0). - npm install secure-metadata - -Node.js 20 or newer is required. Browser consumers may import the secure-metadata/browser entry through a bundler, or deploy the versioned standalone browser artifact from the release candidate on the same origin. The library never loads code from a CDN. +Node.js 20 or newer is required. Browser consumers can verify the released version, license, and SHA-256 checksum, then vendor the standalone browser artifact on the same origin. The library never loads code from a CDN. ## Public API @@ -60,7 +58,7 @@ The library does not perform image decoding or encoding, visual redaction, pixel ## Secure Tools ecosystem -This is an independent open-source library in the broader Secure Tools ecosystem. Future integration will use a pinned browser artifact rather than coupling application code to this repository. +This is an independent open-source library in the broader Secure Tools ecosystem. Future integration will verify the release version, license, and SHA-256 checksum, then vendor the pinned browser artifact on the same origin rather than coupling application code to this repository. ## License diff --git a/SECURITY.md b/SECURITY.md index abd797c..17596d9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,12 +2,12 @@ ## Supported versions -| Version | Support | -| ------- | ---------------------------------- | -| 0.1.x | Supported after public publication | -| < 0.1 | Not supported | +| Version | Support | +| ------- | --------------------------------- | +| 0.1.x | Supported through GitHub releases | +| < 0.1 | Not supported | -The current repository may contain an unpublished release candidate. A candidate is not a supported npm release until publication completes. +`v0.1.0` is published as a GitHub release. The package is not published to npm. ## Reporting a vulnerability diff --git a/docs/releasing.md b/docs/releasing.md index c31391e..be79d59 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -1,8 +1,8 @@ # Release process -This document defines the `v0.1.0` release-candidate process. It does not authorize publishing, tagging, or creating a GitHub release during development. +This document defines release validation and publication. `v0.1.0` is published as an immutable GitHub release from commit `352258ec413a838dfe8b9146370505f125b5ae10`; it is not published to npm. -## Candidate validation +## Release validation Start from a clean commit on the intended release revision, with Node.js 24 and Chromium installed for Playwright. Run: @@ -24,16 +24,16 @@ The browser artifact is a same-origin deployment asset, not a CDN dependency. Pi ## Licensing -The published package has no runtime dependencies and the bundled JavaScript contains project source only. Dev tooling is audited by `npm run license:audit`; its accepted SPDX set is explicit in that script. No third-party NOTICE file is currently required. Re-run the audit and review bundled content whenever dependencies or build configuration change. +The packaged library has no runtime dependencies and the bundled JavaScript contains project source only. Dev tooling is audited by `npm run license:audit`; its accepted SPDX set is explicit in that script. No third-party NOTICE file is currently required. Re-run the audit and review bundled content whenever dependencies or build configuration change. ## Trusted Publishing -Before the first publication, an npm package owner must configure Trusted Publishing for this repository, the `publish.yml` workflow, and the `npm` GitHub environment. The workflow uses GitHub OIDC (`id-token: write`) and `npm publish --provenance`; it intentionally contains no long-lived npm token. +No npm publication has been performed. Before any future npm publication, an npm package owner must configure Trusted Publishing for this repository, the `publish.yml` workflow, and the `npm` GitHub environment. The workflow uses GitHub OIDC (`id-token: write`) and `npm publish --provenance`; it intentionally contains no long-lived npm token. -After merging an approved release commit: +For a future release after merging an approved release commit: 1. confirm all required checks pass on the exact commit; -2. create the signed or annotated tag `v0.1.0` on that commit; +2. create the signed or annotated version tag on that commit without moving an existing release tag; 3. push the tag and review the publish workflow and npm provenance attestation; 4. create GitHub release notes from `CHANGELOG.md` and attach the independently verified files from `release/` if desired; 5. verify installation from npm and the same-origin browser artifact in a fresh consumer.