Know what ships. Before it ships.

A release ZIP can contain the right feature and still be the wrong handoff: a missing README, unexpected filenames, path collisions, or a file that changed unnoticed. CrateProof brings bounded package checks, a clear inventory, exportable evidence, and exact-path content comparison into one local single-user workbench.

This is a complete editable software download, not a subscription, cloud account, design-only mockup, or promised future app.

A practical release preflight loop

• Inspect ZIP members without extracting or executing them.
• Start with source-release, web-template, or generic policies; edit their JSON within enforced bounds.
• Review Ready, Review, or Blocked findings, searchable file inventory, and explicit unavailable hashes.
• Apply implemented path, collision, symlink, size, compression, CRC/read-failure, required-filename and filename-warning rules.
• Export JSON, formula-neutralized CSV, standalone HTML, and a sorted SHA-256 content manifest with omissions.
• Compare two saved runs by exact paths and successful file hashes: added, removed, changed, unchanged and unavailable. No rename inference or full text/binary diff.
• Use the browser workbench or the CLI's audit/compare commands, including meaningful audit exit codes for internal workflows.

Included in the download

• Full editable Python-standard-library engine, loopback HTTP service and CLI.
• Responsive vanilla HTML/CSS/JavaScript workbench; no external runtime packages or API key required.
• Three editable policy presets.
• Two clearly fictional sample ZIPs and real sample reports/comparison. The changed sample deliberately includes a blocked traversal member and must never be extracted.
• Setup/use, API, policy, security and result-model documentation.
• Runnable standard-library regression tests and a release verification note.
• Read-only sample exports and PDF preview.
• One-business commercial-use source licence; use reports for client work. See LICENSE.txt before purchase.

Requirements and operating boundaries

Python 3.10+ and a modern browser. Run locally with python3 run.py serve; a private launch URL is printed. Ubuntu/Python/Chromium workflows were tested; native Windows and macOS validation is not claimed.

Hard limits: 25 MiB input ZIP; 1,000 represented entries; 100 MiB declared/actual total uncompressed bytes; 10 MiB/member; 200:1 compression ratio. ZIP_STORED and ZIP_DEFLATED only. Over-1,000-entry archives are blocked: at most the first 1,000 entries are represented and the remainder is noted as uninspected, not passed.

The service binds to 127.0.0.1 and uses a launch-session token, Host/Origin checks and allowlisted static routes. Uploaded ZIPs are not retained; up to 100 local report records are retained unencrypted. Reports can expose private filenames and hashes. Do not expose the local server publicly or share its launch URL.

What this product does not claim

Ready means the implemented bounded rules passed. CrateProof is not malware/vulnerability/secret-content scanning, signing, trusted provenance/attestation, an SBOM generator, security certification, nested-archive inspection, a complete binary/text diff, or a guarantee of safe extraction. Whole-archive hashes do not authenticate an author. Filename warnings are heuristics, not content analysis.

No hosting, public/multi-tenant SaaS licence, ongoing support, response-time commitment or future-update entitlement is included. Source redistribution and sublicensing are not allowed. Generated reports may be shared commercially under the included licence.

See the evidence before buying

The free ZIP and PDF are read-only fictional sample reports, not a live hosted audit service or the paid application. Promotional images are composed around captures of the actual working interface. Download the sample to inspect the report structure and implemented scope.