Public GitHub commit contributors, using public profile names where available. This list does not imply ownership and may omit non-code or unattributed contributions.
Manage encrypted source vaults and distribute selected secrets to explicitly configured local targets. No browser-hosted management UI.
Development preview. This guide describes the development branch, not a production release. Cloud account registration is not evidence of a working connector. Read the status table before using a feature.
+
Start the desktop app
Use a build for your operating system and architecture. Windows opens tar-vault-sync.exe; macOS opens TAR Vault Sync.app; Linux runs tar-vault-sync in a graphical session.
Launching without arguments opens the native desktop window. The website you are reading is documentation only.
Open Sources to add a source, or Vault to create the default workspace vault.
Open Bindings to connect a source entry to a target. Start with synthetic data and an isolated workspace.
Keep the desktop window open for the current desktop scheduler.
Docker writes signal restart required; containers are not restarted automatically.
Background service controls in UI
Not implemented yet
Desktop scheduler is not an installed operating-system service.
Cross-platform packages
CI build/test matrix
Build success is not native interactive acceptance, code signing or release approval.
+
1. Add source connections
A source is where secret entries are stored. A binding chooses the source, entry and destination. Adding a source never grants new Azure permissions or reads an existing secret automatically.
File System
Open Sources → Add source connection → File System.
Enter a unique Connection ID, for example team-files. The built-in ID local is reserved.
Enter an absolute encrypted vault file path. Its parent directory must already exist. Relative paths, parent traversal and file symlinks are rejected.
Select Add connection, then Manage vault. Create a new vault or unlock an existing compatible vault.
Select Create binding on that source to preselect it in the binding editor.
Connection references are saved in local/sources.json, never with passphrases or secret values. Removing a connection leaves its encrypted file intact. Connections referenced by bindings cannot be removed. Concurrent catalogue changes are rejected instead of overwritten.
Azure Key Vault
Sign in to the intended Azure tenant using the official Azure CLI. Your administrator must already grant the required secrets/list and secrets/get access.
In Sources, choose Azure Key Vault and enter the existing vault name, not a URL.
Create a binding and enter the secret name. Only text secrets in public Azure are currently supported.
Use Sync now and inspect the binding outcome. An unchanged version does not fetch the value again.
Do not paste Azure access tokens into settings. The app obtains a short-lived token through the existing CLI session and retrieves values directly over HTTPS.
Example source references only; no cloud requests are made by this documentation fixture.
+
2. Manage an encrypted vault
Check Selected source before each operation. Use Sources → Manage vault to switch vaults.
Enter a passphrase and select Create vault for a new file, or Unlock vault for an existing file. The app clears the passphrase input after the operation.
Add an entry with an explicit secret type. Text, JSON, binary data, certificates and private keys use the encrypted local-vault format.
Editing an entry creates a new version. Bindings detect the new version on the next check.
Use Lock vault when finished. Vaults also lock after 15 minutes of inactivity; scheduled reads count as activity.
Backup and recovery
Use an encrypted backup path you control. Recovery requires the correct passphrase and a new destination; it does not overwrite an existing vault. Back up the passphrase separately in a trusted password manager. Losing the passphrase can make encrypted data unrecoverable.
Browser CSV import
Import is explicit-consent and one-way. Export the CSV yourself, unlock the selected vault, choose the file and a unique import prefix, then approve the plaintext warning. Each record becomes encrypted JSON; existing entries are not overwritten. Limits: 8 MiB and 1,000 records. The original plaintext CSV is not deleted automatically. Continuous Edge/Chrome password-manager sync is not available.
The fixture keeps the vault locked and secret fields empty.
+
3. Configure distribution bindings
Open Bindings → New binding or select Create binding on a source card.
Enter a unique Binding ID. Choose the source type and connection, then the entry ID or Azure secret name.
Select the matching Secret type; Azure currently fixes this to Text.
Choose a destination type and an absolute target path inside the workspace. Set the field key when the target is structured.
Set the check interval and missing-target policy, then save.
Select Sync now. Check Activity and the destination application; a successful write alone does not prove the consumer has reloaded its configuration.
Target
Configuration
Whole file
Replaces the authorized file with exact payload bytes.
.env / Properties
Select a variable/property key; unrelated fields are preserved where supported.
JSON / YAML
Use the supported field pointer, such as /service/token.
Docker Compose
Choose the service/environment mapping. A changed input produces a restart notice.
Docker env_file
Specify the env file, Compose file and service reference.
Git Credential Manager
Configure HTTPS host, optional repository path and username. Requires GCM; not plaintext Git credential storage.
Missing-target policies
Alert: report a missing target without recreating it.
Recreate: explicitly allow the target file to be created again.
Disable binding: stop that binding until you explicitly enable it.
Unsubmitted example binding. No actual secret or destination file is created.
+
4. Inspect results and recover
Applied means a changed version was written successfully. Unchanged skips payload retrieval. Disabled requires explicit enablement. Restart required means the consumer needs your attention; acknowledging the notice does not restart Docker. Failed requires checking source access, vault lock state, target scope or format.
Events contain redacted metadata, not secret values. A failed render leaves the previous target unchanged. Version state advances only after successful application. Never paste secrets into an issue or diagnostics report.
No live-account events are included.
+
5. Workspace and agent lifecycle
The current UI does not yet start, stop, restart or install a background operating-system service. The desktop owns its scheduler while the window is open. Closing the window stops that desktop scheduler. Do not rely on it for unattended delivery.
The separate CLI agent remains a development interface with test IPC authentication and a limited source configuration. It is not a secure production replacement for the requested service controls. Secure IPC, account-aware credential handling, restart/reconnect behavior and native lifecycle acceptance are required before this feature can be marked complete.
In Settings, inspect the workspace or open another workspace. Source vault paths may live outside the workspace; target files may not.
Settings display the implemented lifecycle, without implying installed-service support.
+
Security boundaries
Local vault payloads are encrypted using Argon2id-derived keys and XChaCha20-Poly1305 authenticated encryption.
Version metadata is checked before secret payload retrieval.
Plaintext is transient, except when written to a target you explicitly configure. Protect those destination files separately.
Configuration and state store references, versions and redacted outcomes—not secret values, passphrases or OAuth tokens.
Files are rendered through temporary sibling files and atomic replacement.
Cloud vault transport must authenticate encrypted data and reject conflicting revisions before it is considered complete.
This preview is not code-signed/notarized, audited or approved for production secrets. CI checksums detect changed archive bytes; they are not publisher signatures.
+
Troubleshooting
Source connection cannot be added
Use a unique safe ID and an absolute file path. Ensure the parent directory exists. Azure connection IDs must be valid vault names. A stale catalogue is deliberately rejected; reopen the app rather than overwriting someone else's change.
Sync fails after reopening
Vaults reopen locked. Unlock the exact source used by the binding. Azure requires a valid CLI session in the intended tenant.
Target is rejected
The target must be inside the configured workspace and match the chosen secret type. Check the parent folder and structured-field syntax.
Source cannot be removed
Remove or update its bindings first, and wait for an active manual sync to finish. Removing a connection does not delete the vault.
Drive login is missing
The OAuth registrations are prepared, but the desktop connectors are still pending. Do not use broader scopes or paste credentials into config files as a workaround.
+
+
diff --git a/docs/release-notes.md b/docs/release-notes.md
new file mode 100644
index 0000000..7349c40
--- /dev/null
+++ b/docs/release-notes.md
@@ -0,0 +1,46 @@
+# TAR Vault Sync desktop preview
+
+Native desktop builds for Windows, macOS, and Linux, each in AMD64/x64 and ARM64.
+This release candidate includes filesystem, Azure Key Vault, OneDrive, and Google Drive sources.
+It is not a claim that every roadmap connector or production-hardening task is complete.
+
+## Included
+
+- English desktop interface for vault access, bindings, activity, and workspace settings.
+- Encrypted local vault, locking, secret rotation, encrypted backup and recovery.
+- File, dotenv, JSON, YAML, properties, Docker input, and Git Credential Manager targets.
+- Scheduled and manual sync with redacted events and explicit restart notices.
+- Native OAuth/PKCE setup for OneDrive and Google Drive encrypted vaults in a selected folder.
+- OS-protected OAuth credentials, revision-pinned Google downloads, and conditional cloud writes.
+- Explicit-consent browser CSV import and Azure public-cloud text-secret sources.
+
+## Start
+
+Extract the archive. On Windows, open `tar-vault-sync.exe`; on macOS, open `TAR Vault Sync.app`;
+on Linux, run `./tar-vault-sync` from the extracted directory. No arguments opens the desktop app.
+`--help` lists command-line modes; `--version` prints the build version.
+
+The default workspace is `%LOCALAPPDATA%/tar-vault-sync` on Windows,
+`~/Library/Application Support/tar-vault-sync` on macOS, or
+`${XDG_DATA_HOME:-~/.local/share}/tar-vault-sync` on Linux.
+Set `TAR_VAULT_SYNC_DIR` to use an existing workspace. File targets must be inside that workspace.
+
+Linux packages target Ubuntu 24.04 or a compatible glibc system and require a graphical session,
+OpenGL/EGL, X11 or Wayland, and desktop libraries (`libx11-6`, `libxkbcommon0`, `libegl1`, `libgl1`).
+Git credential targets require Git Credential Manager to be installed and configured separately.
+
+## Verification and limits
+
+CI runs native tests, compiles the release binary, and executes `--version` on all six runner architectures.
+Each archive has a SHA-256 checksum in `SHA256SUMS`. Checksums detect corruption; they are not publisher signatures.
+These archives are not code-signed or notarized and are not installers.
+
+Windows real-account OneDrive and Google Drive tests passed: encrypted create/read/update,
+stale-write rejection, lock/reopen, and test-file cleanup. Live OAuth acceptance on macOS
+and Linux remains unverified; CI native tests are not a substitute for those account tests.
+Linux OAuth storage requires an unlocked Secret Service keyring. Google setup requires
+the configured desktop OAuth client's secret in the masked field; it is never bundled.
+Azure requires an existing Azure CLI sign-in; native embedded sign-in remains open.
+AWS/Google secret-manager sources and a Git-backed vault remain roadmap work.
+Signed distribution is not included.
+The independent CLI agent still uses development IPC authentication; the desktop app runs its scheduler while open.
diff --git a/docs/releases.html b/docs/releases.html
new file mode 100644
index 0000000..874d846
--- /dev/null
+++ b/docs/releases.html
@@ -0,0 +1,18 @@
+
+TAR Vault Sync · Releases
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
TAR VAULT SYNC
Releases
Published GitHub releases only. CI artifacts are not releases.
Latest stable release
No stable release has been published yet.
Release archive
Newest first; pre-releases are explicitly labelled.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 078eb70..1bf0731 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
TAR Vault Sync will be built in the following order. Each phase should deliver a usable vertical slice with focused tests and documentation. Connector and sync modules own their configuration UI; the core provides only the contracts and host surface for those screens.
-Phase 1 is complete for the fake-module test host described below. Phases 2–5 have development implementations; [phase 2–5 QA](qa-phase2-5.md) records verified behavior and remaining native release gates. Later phases remain planned. [Requirements](requirements.md) define the product and security constraints.
+Phase 1 is complete for the fake-module test host described below. Phases 2–9 and the limited Azure slice in phase 10 have development implementations; [phase 2–5 QA](qa-phase2-5.md) records earlier verified behavior and native release gates. Phases 11–13 remain deferred or planned. [Requirements](requirements.md) define the product and security constraints.
## 1. Core infrastructure
@@ -27,7 +27,7 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 2. Vault entry and local vault store
-**Status:** Encrypted store, CLI flow, and native desktop vault entry screen implemented; platform packaging and visual QA remain open.
+**Status:** Encrypted store, CLI flow, and native desktop vault entry screen implemented. The Sources page supports multiple file-system vault references, source-specific binding selection, independent unlock state and non-destructive connection removal. Native release acceptance remains open.
- Build the vault unlock/entry screen and local encrypted vault store.
- Define the store-connection UI contract used by local and future cloud stores.
@@ -66,6 +66,8 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 6. Microsoft password manager import and sync
+**Status:** Import-only scope selected; native CSV-to-encrypted-vault implementation is in development. Real Edge export/UI acceptance remains open. See [browser import](browser-import.md).
+
- Investigate supported Microsoft Edge/password-manager import and write interfaces and their platform restrictions.
- Implement user-approved import first. Add ongoing sync only if a supported API permits it safely.
- Define conflict resolution and deletion rules before enabling two-way changes.
@@ -74,6 +76,8 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 7. Chrome password manager import and sync
+**Status:** Shares the explicit-consent CSV import implementation; continuous sync is disabled. Real Chrome export/UI acceptance remains open. See [browser import](browser-import.md).
+
- Investigate supported Chrome/Google Password Manager import and write interfaces.
- Follow the same explicit-consent, conflict, and deletion rules as phase 6; do not modify browser profile databases directly.
@@ -81,6 +85,8 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 8. OneDrive store connector
+**Status:** Native OAuth/PKCE, OS credential storage, selected-folder encrypted vaults, and conditional writes implemented. Windows real-account create/read/rotate/lock/reopen and stale-write rejection passed on 2026-09-20. Two physical-device and macOS/Linux live-account acceptance remain open.
+
- Store encrypted vault data in the user's OneDrive with revision-aware reads and writes.
- Detect concurrent edits and present conflicts rather than silently overwriting a vault.
@@ -88,12 +94,16 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 9. Google Drive store connector
+**Status:** Native OAuth/PKCE with limited Drive Picker access, OS credential storage, revision-pinned downloads, and conditional writes implemented. Windows real-account create/read/rotate/lock/reopen and stale-write rejection passed on 2026-09-20; synthetic files were trashed and temporary credentials removed. Two physical-device and macOS/Linux live-account acceptance remain open. Existing project-wide consent branding was not modified.
+
- Apply the same encrypted-vault, revision, and conflict contracts to Google Drive.
**Done when:** a paired device can read and update the encrypted vault through Google Drive without exposing plaintext to Drive.
## 10. Azure Key Vault connector
+**Status:** Development implementation for Azure public-cloud text secrets, using existing Azure CLI authentication and the native desktop binding editor. Live Windows validation passed on 2026-09-20 for rotation, metadata-only unchanged checks, redaction, soft-delete cleanup, and failed-source target preservation. Embedded sign-in, CLI-agent support, interactive UI acceptance, and macOS/Linux cloud acceptance remain open. See [Azure connector](azure-key-vault.md).
+
- Add authentication, metadata-only version checks, and secret-value retrieval on change.
- Map Azure secret versions and errors into the common store contract.
@@ -101,6 +111,8 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 11. AWS Secrets Manager connector
+**Current scope:** Deferred by user request; not part of the four-source delivery.
+
- Add authentication, version/stage checks, and value retrieval through AWS Secrets Manager.
- Confirm the intended service name before implementation; this phase interprets "AWS password manager" as AWS Secrets Manager.
@@ -108,6 +120,8 @@ Phase 1 is complete for the fake-module test host described below. Phases 2–5
## 12. Google Secret Manager connector
+**Current scope:** Deferred by user request. Google Drive is a separate, in-scope encrypted-vault source.
+
- Add Google Cloud Secret Manager authentication, version metadata checks, and value retrieval.
- Confirm the intended service name before implementation; this phase interprets "Google vault" as Google Cloud Secret Manager.
diff --git a/docs/robots.txt b/docs/robots.txt
new file mode 100644
index 0000000..d55b897
--- /dev/null
+++ b/docs/robots.txt
@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://tarvault.tarsolution.com/sitemap.xml
diff --git a/docs/screenshots.md b/docs/screenshots.md
new file mode 100644
index 0000000..1032c0c
--- /dev/null
+++ b/docs/screenshots.md
@@ -0,0 +1,30 @@
+# Reproduce the documentation screenshots
+
+The six guide images are actual native egui screens rendered with an isolated,
+synthetic workspace. They contain no account credentials or secret values and
+are not evidence of cloud integration or Windows/macOS interactive acceptance.
+
+On Linux, install Xvfb, Mesa/OpenGL, `libxkbcommon-x11-0`, X11 runtime libraries
+and ImageMagick, then run:
+
+```sh
+TAR_VAULT_DOC_OUTPUT="$PWD/target/doc-captures" \
+ xvfb-run -a -s '-screen 0 1440x1800x24' \
+ cargo test --locked --lib desktop::tests::render_documentation_screens -- \
+ --ignored --exact
+for page in overview sources vault bindings activity settings; do
+ magick "target/doc-captures/$page.ppm" "docs/assets/$page.png"
+done
+python3 -m unittest discover -s tests -p 'test_*.py'
+```
+
+The capture test is ignored in normal unit runs because it needs a graphical
+backend. It renders the application directly; it never imports a browser
+profile, unlocks a real vault, or contacts a cloud provider. Review every PNG
+before committing. Do not publish screenshots from a real workspace.
+
+The static site is `docs/index.html`; no build framework is needed. Optional
+website analytics loads only after visitor consent. GitHub Pages publishes
+this directory. Its custom domain
+is `tarvault.tarsolution.com`. Publishing documentation does not publish an app
+release or satisfy any release acceptance gate.
diff --git a/docs/site.css b/docs/site.css
new file mode 100644
index 0000000..8cd7fde
--- /dev/null
+++ b/docs/site.css
@@ -0,0 +1,2 @@
+:root{color-scheme:light;--nav:#132030;--ink:#182739;--muted:#596b7f;--accent:#0f766e;--border:#e1e7ed;--canvas:#f5f7fa}*{box-sizing:border-box}html{scroll-behavior:smooth;scroll-padding-top:24px}body{margin:0;font:16px/1.7 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:var(--canvas);color:var(--ink)}aside{position:fixed;inset:0 auto 0 0;width:248px;background:var(--nav);padding:38px 24px;color:#a8bacb;overflow:auto}.brand{display:flex;align-items:center;gap:12px;color:white!important;text-decoration:none;font-size:27px;font-weight:750;line-height:1.2}.brand img{width:62px;height:62px;background:#f5f7fa;border-radius:12px;padding:5px}.brand small{display:block;font-size:10px;letter-spacing:2px;font-weight:600}.eyebrow{font-size:11px;font-weight:750;letter-spacing:2px;color:var(--accent)}aside .eyebrow{margin-top:45px;color:#8da4bb}nav a{display:block;padding:9px 10px;margin:3px 0;color:#c3d0dd;text-decoration:none;font-size:14px;border-radius:6px}nav a:hover,nav a:focus-visible{background:#24404c;color:white}.repo{display:block;margin-top:35px;color:#85d5c5;font-size:13px}main{max-width:1220px;margin-left:248px;padding:50px 64px}header{padding:30px 0 25px}h1{font-size:clamp(42px,6vw,72px);letter-spacing:-3px;line-height:1.05;margin:20px 0 26px}h2{font-size:30px;letter-spacing:-.8px;line-height:1.3;margin:0 0 20px}h3{font-size:20px;margin-top:32px}.lead{max-width:680px;font-size:20px;color:var(--muted)}.notice{background:#fff5df;border-left:4px solid #c28b1c;border-radius:0 9px 9px 0;padding:18px 22px;font-size:14px}section{padding:35px 0;border-bottom:1px solid var(--border)}p,li,dd{max-width:850px}li{padding:4px 0}a{color:var(--accent);text-underline-offset:3px}a:focus-visible,summary:focus-visible{outline:3px solid #df9b2a;outline-offset:3px}code{background:#eaf0f3;border:1px solid #dae3e9;border-radius:4px;padding:2px 5px;font-size:.86em;overflow-wrap:anywhere}figure{margin:30px 0}figure img{display:block;width:100%;height:auto;max-height:720px;object-fit:contain;object-position:top;background:#e9eef2;border:1px solid #cfd9e1;border-radius:10px;box-shadow:0 10px 28px #13203012}figcaption{font-size:12px;color:var(--muted);margin:10px 2px}.table-wrap{overflow-x:auto;background:white;border:1px solid var(--border);border-radius:9px}table{width:100%;border-collapse:collapse;min-width:550px;text-align:left;font-size:14px}th{background:#e8f2ef;color:#165a53;padding:15px}td{padding:15px;border-top:1px solid var(--border);vertical-align:top}details{background:white;padding:16px 22px;border:1px solid var(--border);border-radius:8px}summary{cursor:pointer;font-weight:650}dt{font-weight:700;margin-top:22px}dd{margin:5px 0 18px;color:var(--muted)}footer{padding:30px 0 5px;color:var(--muted);font-size:13px}@media(max-width:900px){aside{position:static;width:auto;padding:24px}aside .eyebrow{margin-top:20px}nav{display:flex;flex-wrap:wrap;gap:2px}nav a{padding:6px 10px}.repo{margin-top:12px}main{margin-left:0;padding:20px 24px}h1{letter-spacing:-2px}h2{font-size:26px}}@media(prefers-reduced-motion:reduce){html{scroll-behavior:auto}}@media print{aside{display:none}main{margin:0;padding:0}figure img{max-height:500px}section{break-inside:avoid}a{color:inherit}}
+:root aside{display:flex;flex-direction:column}.credits{margin-top:auto;padding-top:28px;font-size:12px;line-height:1.8}.credits a{display:block;color:#b9d7d6}.credits a:last-child{color:#85d5c5}.release-card{background:white;border:1px solid var(--border);border-radius:12px;padding:8px 24px 18px;margin:18px 0}.release-card h3{margin-top:16px}@media(max-width:900px){.credits{margin-top:18px}}
diff --git a/docs/sitemap.xml b/docs/sitemap.xml
new file mode 100644
index 0000000..c526bec
--- /dev/null
+++ b/docs/sitemap.xml
@@ -0,0 +1,6 @@
+
+
+ https://tarvault.tarsolution.com/
+ https://tarvault.tarsolution.com/releases.html
+ https://tarvault.tarsolution.com/credits.html
+
diff --git a/scripts/package-release.py b/scripts/package-release.py
new file mode 100644
index 0000000..01d68f0
--- /dev/null
+++ b/scripts/package-release.py
@@ -0,0 +1,77 @@
+"""Package a native build without credentials, workspaces, or build caches."""
+
+import argparse
+import hashlib
+from pathlib import Path
+import plistlib
+import shutil
+import stat
+import tarfile
+import tempfile
+import tomllib
+import zipfile
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument("--platform", choices=("windows", "macos", "linux"), required=True)
+ parser.add_argument("--arch", choices=("amd64", "arm64"), required=True)
+ parser.add_argument("--target", required=True)
+ args = parser.parse_args()
+ version = tomllib.loads(Path("Cargo.toml").read_text(encoding="utf-8"))["package"]["version"]
+ name = f"tar-vault-sync-{version}-{args.platform}-{args.arch}"
+ binary_name = "tar-vault-sync.exe" if args.platform == "windows" else "tar-vault-sync"
+ binary = Path("target") / args.target / "release" / binary_name
+ if not binary.is_file():
+ raise SystemExit("Release binary is missing")
+ output = Path("dist")
+ output.mkdir(exist_ok=True)
+ with tempfile.TemporaryDirectory() as temporary:
+ package = Path(temporary) / name
+ package.mkdir()
+ if args.platform == "macos":
+ contents = package / "TAR Vault Sync.app" / "Contents"
+ executable = contents / "MacOS" / binary_name
+ executable.parent.mkdir(parents=True)
+ with (contents / "Info.plist").open("wb") as stream:
+ plistlib.dump({
+ "CFBundleName": "TAR Vault Sync",
+ "CFBundleDisplayName": "TAR Vault Sync",
+ "CFBundleIdentifier": "com.tarsolution.tarvaultsync",
+ "CFBundleExecutable": binary_name,
+ "CFBundlePackageType": "APPL",
+ "CFBundleShortVersionString": version,
+ "CFBundleVersion": version,
+ "NSHighResolutionCapable": True,
+ }, stream)
+ else:
+ executable = package / binary_name
+ shutil.copy2(binary, executable)
+ executable.chmod(0o755)
+ shutil.copy2("docs/release-notes.md", package / "README.md")
+ if args.platform == "linux":
+ archive = output / f"{name}.tar.gz"
+ def archive_mode(member):
+ member.mode = 0o755 if member.isdir() or member.name == f"{name}/{binary_name}" else 0o644
+ return member
+ with tarfile.open(archive, "w:gz") as stream:
+ stream.add(package, arcname=name, filter=archive_mode)
+ else:
+ archive = output / f"{name}.zip"
+ with zipfile.ZipFile(archive, "w", compression=zipfile.ZIP_DEFLATED) as stream:
+ for path in sorted(package.rglob("*")):
+ if path.is_file():
+ info = zipfile.ZipInfo.from_file(path, path.relative_to(package.parent))
+ info.create_system = 3 # Unix modes, independent of the packaging host.
+ info.external_attr = (stat.S_IFREG | (0o755 if path == executable else 0o644)) << 16
+ info.compress_type = zipfile.ZIP_DEFLATED
+ with path.open("rb") as source, stream.open(info, "w") as destination:
+ shutil.copyfileobj(source, destination)
+ with archive.open("rb") as stream:
+ digest = hashlib.file_digest(stream, "sha256").hexdigest()
+ (output / f"{archive.name}.sha256").write_text(f"{digest} {archive.name}\n", encoding="ascii")
+ print(f"Packaged {archive.name} ({archive.stat().st_size} bytes)")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/scripts/update-docs-catalog.py b/scripts/update-docs-catalog.py
new file mode 100644
index 0000000..f4aa155
--- /dev/null
+++ b/scripts/update-docs-catalog.py
@@ -0,0 +1,105 @@
+"""Generate static release and contributor pages from public GitHub metadata."""
+
+from datetime import datetime, timezone
+from html import escape
+import json
+from pathlib import Path
+from urllib.request import Request, urlopen
+
+REPO = "tarsolution/tarvaultsync"
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def fetch(path):
+ request = Request("https://api.github.com/" + path,
+ headers={"Accept": "application/vnd.github+json",
+ "User-Agent": "TAR-Vault-Sync-docs"})
+ with urlopen(request, timeout=30) as response:
+ return json.load(response)
+
+
+def listing(endpoint):
+ result = []
+ page = 1
+ while True:
+ batch = fetch(f"repos/{REPO}/{endpoint}?per_page=100&page={page}")
+ result.extend(batch)
+ if len(batch) < 100:
+ return result
+ page += 1
+
+
+def link(url, label):
+ if not url.startswith("https://github.com/"):
+ raise ValueError("Expected a public GitHub URL")
+ return f'{escape(label)}'
+
+
+def page(title, content, date):
+ return f'''
+TAR Vault Sync · {title}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
TAR VAULT SYNC
{title}
{content}
+'''
+
+
+def release_card(release):
+ name = release.get("name") or release["tag_name"]
+ status = "Pre-release" if release.get("prerelease") else "Stable release"
+ return (f'
')
+
+
+def releases_content(releases):
+ published = sorted((r for r in releases if not r.get("draft") and r.get("published_at")),
+ key=lambda r: r["published_at"], reverse=True)
+ latest = next((r for r in published if not r.get("prerelease")), None)
+ content = '
Published GitHub releases only. CI artifacts are not releases.
Latest stable release
'
+ content += release_card(latest) if latest else '
No stable release has been published yet.
'
+ content += '
Release archive
Newest first; pre-releases are explicitly labelled.
'
+ archive = [r for r in published if r is not latest]
+ content += ''.join(map(release_card, archive)) if archive else '
No archived releases yet.
'
+ return content + f'
{link(f"https://github.com/{REPO}/releases", "View the live release catalogue on GitHub")}
'
+
+
+def main():
+ # Fetch everything before replacing either page. Network failures fail the build.
+ releases = listing("releases")
+ contributors = listing("contributors")
+ people, bots = [], []
+ for contributor in contributors:
+ login = contributor["login"]
+ profile = fetch("users/" + login)
+ name = profile.get("name") or login
+ item = '
Public GitHub commit contributors, using public profile names where available. This list does not imply ownership and may omit non-code or unattributed contributions.
