From 0aee010f9c091ccffe724320a2f25a4bbec8b108 Mon Sep 17 00:00:00 2001 From: Dorian Date: Mon, 27 Jul 2026 17:51:43 +0100 Subject: [PATCH 1/4] chore: prepare repository for public launch --- .github/pull_request_template.md | 18 +- .github/workflows/ci.yml | 31 +- .gitignore | 35 +- Android/app/debug.keystore | Bin 2666 -> 0 bytes CODE_OF_CONDUCT.md | 19 + CONTRIBUTING.md | 191 ++--- LICENSE | 21 + NOTICE | 73 ++ README.md | 227 ++---- SECURITY.md | 38 + apps/DEVELOPMENT.md | 12 +- core/.env.production | 33 - core/THIRD-PARTY-LICENSES.md | 656 ++++++++++++++++++ demo/content/README.md | 9 + docs/LICENSE-COMPLIANCE-AUDIT.md | 108 +++ docs/OPEN-SOURCE-READINESS-PLAN.md | 32 + docs/app-manifest-spec.md | 2 +- docs/developer-guide.md | 28 +- .../_archived/build-auto-installer-iso.sh | 2 +- neode-ui/THIRD-PARTY-LICENSES.md | 39 ++ neode-ui/public/assets/icon/ATTRIBUTION.md | 11 + .../assets/img/mesh-devices/ATTRIBUTION.md | 13 + scripts/audit-secrets.sh | 8 +- scripts/run-tests.sh | 58 +- scripts/setup-aiui-server.sh | 11 +- scripts/validate-app-manifest.sh | 304 +++++--- 26 files changed, 1470 insertions(+), 509 deletions(-) delete mode 100644 Android/app/debug.keystore create mode 100644 CODE_OF_CONDUCT.md create mode 100644 LICENSE create mode 100644 NOTICE create mode 100644 SECURITY.md delete mode 100644 core/.env.production create mode 100644 core/THIRD-PARTY-LICENSES.md create mode 100644 demo/content/README.md create mode 100644 docs/LICENSE-COMPLIANCE-AUDIT.md create mode 100644 neode-ui/THIRD-PARTY-LICENSES.md create mode 100644 neode-ui/public/assets/icon/ATTRIBUTION.md create mode 100644 neode-ui/public/assets/img/mesh-devices/ATTRIBUTION.md diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index beacd6d0..ef60d323 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,16 +1,16 @@ ## Summary - + -## Changes +## Verification -- + ## Checklist -- [ ] TypeScript type-check passes (`npm run type-check`) -- [ ] Frontend builds (`npm run build`) -- [ ] Tests pass (`npm test`) -- [ ] Rust clippy clean (if backend changes) -- [ ] No new compiler warnings -- [ ] Tested on live server +- [ ] Rust formatting/clippy/tests pass when backend code changed. +- [ ] Frontend type-check/build/tests pass when frontend code changed. +- [ ] App manifests validate when app packaging changed. +- [ ] Generated catalogs are updated when manifest-owned catalog fields changed. +- [ ] Docs are updated for user-facing or developer-facing behavior changes. +- [ ] No secrets, generated build outputs, local screenshots, or private host details are included. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 88697e19..d385323b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,11 +8,11 @@ on: env: RUST_VERSION: stable - NODE_VERSION: 18 + NODE_VERSION: 20 jobs: rust: - name: Rust (fmt + clippy + test) + name: Rust runs-on: ubuntu-latest defaults: run: @@ -28,17 +28,17 @@ jobs: toolchain: ${{ env.RUST_VERSION }} components: rustfmt, clippy - - name: Check formatting + - name: Format run: cargo fmt --all -- --check - name: Clippy run: cargo clippy --all-targets --all-features -- -D warnings - - name: Tests + - name: Test run: cargo test --all-features frontend: - name: Frontend (type-check + lint) + name: Frontend runs-on: ubuntu-latest defaults: run: @@ -52,14 +52,31 @@ jobs: uses: actions/setup-node@v4 with: node-version: ${{ env.NODE_VERSION }} - cache: 'npm' + cache: npm cache-dependency-path: neode-ui/package-lock.json - - name: Install dependencies + - name: Install run: npm ci - name: Type check run: npm run type-check + - name: Test + run: npm test + - name: Build run: npm run build + + manifests: + name: App Manifests + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Validate manifests + run: | + for manifest in apps/*/manifest.yml; do + ./scripts/validate-app-manifest.sh --repo-audit "$manifest" + done diff --git a/.gitignore b/.gitignore index 53492bb0..82c46e47 100644 --- a/.gitignore +++ b/.gitignore @@ -1,10 +1,9 @@ -# SSH keys (sandbox copies) +# SSH keys and sandbox copies .ssh/ # Rust build output target/ **/target/ -Cargo.lock # Node.js node_modules/ @@ -12,7 +11,6 @@ node_modules/ npm-debug.log* yarn-debug.log* yarn-error.log* -package-lock.json pnpm-debug.log* # Build outputs @@ -28,49 +26,46 @@ build/ *.swo *~ .DS_Store +._* +Thumbs.db # Environment and local overrides .env .env.local .env.*.local +.env.production +core/.env.production scripts/deploy-config.sh # Logs logs/ *.log -# OS -.DS_Store -Thumbs.db - # Testing coverage/ .nyc_output/ -# Temporary files -*.tmp -*.temp - -# Build artifacts +# Image / release artifacts *.iso *.img *.dmg *.app +*.apk +*.keystore +*.s9pk +*.tar.gz -# Release artifacts live in Gitea Release attachments, not Git history. +# Release artifacts live in release attachments, not Git history. releases/** !releases/ !releases/manifest.json -# macOS build output -build/macos/ - # Image recipe output image-recipe/output/ image-recipe/*.iso image-recipe/*.img -# Loop tool artifacts (created in every subdirectory) +# Loop tool artifacts */loop/ loop/loop/ loop/loop.log.bak @@ -78,19 +73,17 @@ loop/loop.log.bak # Separate repos nested in tree web/ -._* - -# Resilience harness reports (generated, contains session cookies) +# Resilience harness reports contain session cookies. scripts/resilience/reports/ # Codex / pnpm / python caches / editor backups .codex .codex-target-*/ .codex-tmp/ +.claude/ .pnpm-store/ **/__pycache__/ *.bak -.claude/scheduled_tasks.lock # Local evidence screenshots; intentional UI screenshots should live under an # app/docs asset path with a descriptive filename. diff --git a/Android/app/debug.keystore b/Android/app/debug.keystore deleted file mode 100644 index d99c47cff89f464f8caeb926d45dfec4bdbebf2f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2666 zcma)8XEdCP7M&S0WH3=?bi?Sbl6<3=h+cw-C!!=oji{qU$ppcS9t62cuEf=Av{52N zCx{jjy(eT4f-#7a>v`+FmAl@r_kNtU&)NIz^K-8Q5a?YXU>blx&rA!Kh&G5mM1bkQ zIRttzlmPz;5a34u0oMLs608PFfK{B+rRP;h%kUo;BRv?BLx5?VlUD$jUk(@oum+U= z9vJ~iC~CaGU*(mGu-$5fOt=uQhHwBpiUfg(F+;!@fRXmXzb``IFc5&Ih1*9PfbY>j z!4gnrotxjz`U)mX@+HO|OX_DkLkZ9igvi`ThQ6V(%d zCkx2MEQ!>8h_B0s+|bmjYllLP8jh4W*DibbS_UW| zi$u{lR2nbWdiUDT>Kd`~ybwlOtQnOD2}P0;vdN%ybH3uB9L|S z;fQ>c=cxE-XhtB5f%Hl|l8(L0?8gZfH1Zl`aqE&TeawmKlK$53A!50MB!aH2wE*ul zZT(Qqv|RL}aVS}Ap=glVG&rz^uCo2J)t7-XpC6Nc*<}NYQK8h#OPqOUuJ~4}FW<;x zxl63@+^Z2x223OBxusr4KTGveg6h>c1?9)f(fA_TTa*Wh>DZLULyh-(`of5&9O|S- zGyqBOVj?YgyjM69bK<9Xbd{2iQ3;w=Rx(S)8z}uQ3p4F}XK&sp2@i;eIu@LY-r_3a zFfKSPw|jFb1&_pV5%b{e2R38@+NB$wsu~z+)t4i0eH^9YcH(>o7PhXH$kWb~&0<37 zrgJytXD!R^JP)d5A9o>itGZn~*RFazL*L7uvzB-?WwqxJ9v#fP7J3#1lcf$vs8O^e zWb~|H8Ih-t+q_+MG>B@xuN?Lw5o!NI|VMT<3Vn%$NfeiM&u{yc@lA1@10)TZwmlUwajwu)+&Ck zQ44=xZhTyg)VCFOwe{G=!gki*Bvd()mAbrmt5(^Tb5u78x%+lTYs8S~xxB(p+9=uc zs0fb+uNEqb;{tG$2O~*^ToQLV>nWA?ZqpOGAD547SmJzxq^F|Y1)O&4NL5M3$?t93 zvu+5%>F6}>O0O4OGk2i>Vr;m$&~-XSqUy!SrJ4kAEHpoq3*z6vyicQA2$v1r)38Qd z%-pOL|tg z{<$nKzV2ev1`2U|&Y$~Ar5jcnQ7ac}$HF7Wwngy|vvk_FYeZ`;Si$OEV zlGkLXL>>ey(#+jH6zaBYJ8W#aFgoU{!s_)TL}uS}Z?nnlruTwD_cw*xW3^~#MoHr8 zbhuIMC#)GD{VOivC@hAL599#Cft*2pAa9V{IXZ*xfgC{rp!*4DG5`R`V3n}S00D~qwM0joLx2jNQ+yCG=o~oyR>1!&xC5|K9){0^pRjXn z5JygZkgz&U#QziAlrJ@!i@vrCjbWnsk{%m};RKo-Y6r*j?|@*LgLZ;Ns+$%Y8rsH2 z>qx+{A#EJa;uK5zj0Y*A?@4TLFJA)BR}DP>_Pd_=#G^0E&H2nlxZoXsjJB*Kn*kfQ zZOGg~p5WX{L2bjVD?-%dClUwC{^~7${gec<>t(0dcx$(hFV)>0`qOdAq=A8-ea%#f z8mG&1GvTL>vrR{tj;i7P4Q?t>k{T=anaEERld5t{o*tGRy`wORTq(==wB43ca`(hM ze)+hU2u4SMH0%di#AIDu=&BkoW^G8|rcr)w4AT*Ox8}w5 z($C=Fb({U_1VX0I9qd%Yiy0|oXR8|5mVq!6LXLy`_OWP_ook6I*9&*CTJ-!%)LsYu za{T4h;-eljcnHwKgbCOGkh(0UI?B_t*`MeVD89pv4=x_Ahd<3BN9)>sIs^u*S9g3P z7<`%ihw8resB?t{9Uf#&{zc@itdb+-xny~h`QzqJ1B^_*- z3~MKgn(dag=~r4C`|6Ap@@I{ig(>(ymrgh&JUxBnL%+65i9z+& zD|x-MnhOY($uq`|m#;x@?y(5Cm$!ecIvKV#K&34Xd=zgT^qVzxIDAnf34Yi|zH?-S z-qa*;_^=d2Ikdc+Liq)M;-ai~6w9)C;qn9SFC{BR%>lc9C!!vPf%w41&uPAt;u>v;Gr#7EIt?My5&p2l z=hT=xnJg`)*pf~Dd1f{75m-IqW@1yyH$5oizx=VDlAw>x<%%8w3UMJ?j_|*i+%*z<3*D`m{0dnxPREuQ2sN~@YSp!3rr9UGPG;kevMHOT@%65{ z9XqXs&VK%f7~d(~i#_BFwKkNNEwN%be>QC)qM5Zfp|brfspk=?D>sg@GW}b8YF=WM zrShzZub5is$Ux^#1=n^P>sgZMO`T>T55bG&X7LKEDp6qv$1_!f@b({r;e*DG7bj64 z;~p7!yuN|1jscxzjpb<$=K4z}V;ot~z;yr%Ab$N{5HJh`#c;UWb#O/archy.git` -3. Set up the dev environment (see `docs/developer-guide.md`) -4. Create a feature branch: `git checkout -b feature/your-feature` - -## Development Setup - -### Frontend (Vue.js) +### Frontend ```bash cd neode-ui npm install -npm start # Dev server on :8100 -npm run type-check # TypeScript validation -npm run build # Production build -npm test # Run tests +npm start +npm run type-check +npm test ``` -### Backend (Rust) - -Build on a Linux server (Debian 13), **not** macOS: +### Backend ```bash -cargo clippy --all-targets --all-features -cargo fmt --all +cd core +cargo fmt --all -- --check +cargo clippy --all-targets --all-features -- -D warnings cargo test --all-features ``` -### Deploy to dev server +Linux is required for host integration work involving Podman, systemd, +networking, or image builds. Frontend development works locally with the mock +backend. + +## App manifests + +App packages live under `apps//manifest.yml` and use the schema +documented in [docs/app-manifest-spec.md](docs/app-manifest-spec.md). Validate +before submitting: ```bash -./scripts/deploy-to-target.sh --live +./scripts/validate-app-manifest.sh apps//manifest.yml +python3 scripts/generate-app-catalog.py +python3 scripts/check-app-catalog-drift.py --release --strict ``` -## Code Style +App submissions must: -### Frontend (TypeScript + Vue) +- pin container image versions; +- avoid hardcoded secrets; +- use `security.no_new_privileges: true`; +- use `security.readonly_root: true` unless the manifest explains why writable + root is required; +- request only necessary Linux capabilities; +- store durable data under `/var/lib/archipelago//`; +- define truthful health checks and launch interfaces for user-facing UIs. -- `