Repository navigation
Point at the live listing, and correct the 1.0.0 claims - #8
Merged
Merged
Conversation
`pathToFileURL(process.argv[1])` throws when argv[1] is undefined, which it is under `node -e` and in some loaders. That turned a guard meant to skip the CLI on import into a crash at import time. Found by importing the module to compute a digest; package.mjs was unaffected only because a normal script run always has argv[1]. 1.0.0 is live on the Chrome Web Store, so the extension name is not an unreleased change — it shipped. The Unreleased section goes back to empty and 1.0.0 records the published name. The changelog also still called it a "tree digest", which is what the digest was called before the verification approach changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1.0.1 aside, three facts changed when the extension went live. README said "Not yet on the Chrome Web Store". It is: ilkclodiadkjmnclbkghbnbhnplnfhia. The install section leads with the store and keeps the unpacked route for people who would rather build it, with a pointer to the verification the store cannot give you. The deny-non-TLS statement in bucket-policy.json is removed rather than applied. It was generic S3 hardening applied without asking what it defends. The object is a public document whose whole content is already world-readable, the URL given to the store is https, and the only attacker it excludes is one who can already intercept the connection but wants nothing more than to reword a privacy policy. That is not worth a Deny that can fail closed later, and leaving it committed but unapplied would have made the repository describe a bucket that does not exist. legal/README.md records the reasoning so it does not get re-added by reflex. CWS_EXTENSION_ID is set as a repository variable and the repo homepage points at the listing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The extension is live on the Chrome Web Store as
ilkclodiadkjmnclbkghbnbhnplnfhia,so the documentation should stop describing 1.0.0 as unreleased.
[Unreleased]is empty again.legal/bucket-policy.jsondrops theDenyInsecureTransportstatement. It was genericS3 hardening applied to a document whose entire purpose is to be read by anyone over any
transport — there is nothing confidential to protect, and the rule only adds a way for the
privacy policy to 404 for someone.
legal/README.mdrecords that reasoning so it does notget "fixed" back in.
scripts/verify-install.mjsguardsprocess.argv[1]beforepathToFileURL, whichthrows on
undefinedundernode -eand some loaders — that crashedpackage.mjs'simport of it rather than skipping the CLI branch.