watermarks-remover

70 Commits 15 Branches 8 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Guillaume Meyer (The Opinionated Man)andGitHub	b4676e9e54	fix: finish Windows support (preexec_fn, symlink tests, Windows CI) (#23 ) * fix: make subprocess and symlink tests Windows-compatible - Gate preexec_fn (POSIX-only) so optional tools can run on Windows - Skip symlink tests when the platform denies the privilege - Add a Windows CI leg and a Windows CLI smoke run * fix: use UTF-8 stdio and fail Windows smoke on first error - Reconfigure stdin/stdout/stderr to UTF-8 so Windows redirected streams stop raising UnicodeEncodeError on invisible Unicode characters - Chain the Windows smoke commands so a failing script fails the step	2026-08-13 07:16:13 -07:00
Guillaume Meyer (The Opinionated Man)	fa81cbc23a	fix: harden writes, HTTP client, CI supply chain, and resource caps Security hardening from deep assessment: - Writes: atomic temp+rename via safe_write_bytes/text (no symlink following, no partial in-place loss); backup_path for --in-place; umask-default modes; symlink destinations refused. - rewrite_text: refuse redirects (no Authorization/key re-send to unvalidated hosts), default-deny loopback allowlist with explicit --allow-remote / WATERMARKS_REWRITE_ALLOW_REMOTE opt-in, http(s)-only schemes, --api-key argv flag removed (env-only). - CI: SHA-pin actions (checkout v7.0.1, setup-python v7.0.0, codeql), permissions: contents: read, pinned requirements-dev.txt, pip-audit step; new CodeQL workflow. - Scorer deps: bump Pillow 10.4.0 -> 12.3.0 (24 known CVEs); pip pinned in Dockerfile and setup_synthid.sh; Docker runs as unprivileged user. - Resource caps: MAX_INPUT_BYTES 1GiB -> 256MiB, 64MiB stdin cap, zip budget 512MiB -> 128MiB, RLIMIT_AS/FSIZE on child processes. - Tests: 18 new security regression tests (60 total, all passing).	2026-08-12 21:13:53 -07:00
guillaume	5f0997de88	chore: mirror tmon GitHub protection setup Add CODEOWNERS and a CI job named test so the Protect main ruleset can require code-owner review and a green status check.	2026-08-11 10:18:46 -07:00

Author

SHA1

Message

Date

Guillaume Meyer (The Opinionated Man)andGitHub

b4676e9e54

fix: finish Windows support (preexec_fn, symlink tests, Windows CI) (#23 )

* fix: make subprocess and symlink tests Windows-compatible

- Gate preexec_fn (POSIX-only) so optional tools can run on Windows
- Skip symlink tests when the platform denies the privilege
- Add a Windows CI leg and a Windows CLI smoke run

* fix: use UTF-8 stdio and fail Windows smoke on first error

- Reconfigure stdin/stdout/stderr to UTF-8 so Windows redirected streams
  stop raising UnicodeEncodeError on invisible Unicode characters
- Chain the Windows smoke commands so a failing script fails the step

2026-08-13 07:16:13 -07:00

Guillaume Meyer (The Opinionated Man)

fa81cbc23a

fix: harden writes, HTTP client, CI supply chain, and resource caps

Security hardening from deep assessment:

- Writes: atomic temp+rename via safe_write_bytes/text (no symlink
  following, no partial in-place loss); backup_path for --in-place;
  umask-default modes; symlink destinations refused.
- rewrite_text: refuse redirects (no Authorization/key re-send to
  unvalidated hosts), default-deny loopback allowlist with explicit
  --allow-remote / WATERMARKS_REWRITE_ALLOW_REMOTE opt-in, http(s)-only
  schemes, --api-key argv flag removed (env-only).
- CI: SHA-pin actions (checkout v7.0.1, setup-python v7.0.0, codeql),
  permissions: contents: read, pinned requirements-dev.txt, pip-audit
  step; new CodeQL workflow.
- Scorer deps: bump Pillow 10.4.0 -> 12.3.0 (24 known CVEs); pip pinned
  in Dockerfile and setup_synthid.sh; Docker runs as unprivileged user.
- Resource caps: MAX_INPUT_BYTES 1GiB -> 256MiB, 64MiB stdin cap,
  zip budget 512MiB -> 128MiB, RLIMIT_AS/FSIZE on child processes.
- Tests: 18 new security regression tests (60 total, all passing).

2026-08-12 21:13:53 -07:00

guillaume

5f0997de88

chore: mirror tmon GitHub protection setup

Add CODEOWNERS and a CI job named test so the Protect main ruleset
can require code-owner review and a green status check.

2026-08-11 10:18:46 -07:00