# SHA-256 digests pinning the exact byte content of the six binary assets
# that .github/scripts/file-whitelist-check.sh allows at fixed paths.
#
# Why a hash instead of parsing PNG/MP3 structure: this checker used to
# validate PNG chunk framing and MP3 frame framing in bash/Python and reject
# anything that didn't parse as a "clean" file of that type. That caught
# trailing-data polyglots, but a container-format allowlist restricts framing
# and chunk/tag *types*, not chunk/tag *length or content* — a well-formed,
# already-allowlisted chunk type (e.g. PNG IDAT, which every real PNG needs)
# can still carry an arbitrary payload, and an ID3v2 tag's declared size is
# trusted rather than validated, so a payload can be smuggled inside either
# without ever producing a byte the parser calls invalid. Fully closing that
# would mean reimplementing a PNG/MP3 decoder. These are six exact, known,
# rarely-changing files, so pinning their content by hash is both simpler and
# strictly stronger: any byte change at all is rejected, not just changes the
# parser happens to notice.
#
# Format: standard `sha256sum` output (verifiable with `sha256sum -c` from
# the repo root). Lines starting with '#' and blank lines are ignored.
#
# To regenerate after an INTENTIONAL change to one of these assets (e.g.
# re-exporting an icon, replacing a sound), regenerate all six digests in the
# SAME PR as the byte change, so the diff is reviewed together:
#
#   sha256sum \
#     "docs/images/Local Search.png" \
#     "docs/images/local_search_embedding_model_type.png" \
#     "docs/images/local_search_paths.png" \
#     "src/local_deep_research/web/static/favicon.png" \
#     "src/local_deep_research/web/static/sounds/error.mp3" \
#     "src/local_deep_research/web/static/sounds/success.mp3" \
#     > .github/security/binary-asset-hashes.txt
#
# then restore this header comment (sha256sum only writes the hash lines).

f51f8ab8d3c99e56ef860e55c42bb69c71405493d0b62d9301263698b36856a5  docs/images/Local Search.png
9360435732e9b0d10c8f9257fbba9b7444336058b1b4ae65dbc3725a71d35d23  docs/images/local_search_embedding_model_type.png
24cfcb48c8c7ebe33969f70a1831b223d7b34fa6ddb42ff7632d323385585a21  docs/images/local_search_paths.png
c66941129d69656011f5d42c3e0e53a2cc16c1f1b7a468275ae9f9a2430e4e3e  src/local_deep_research/web/static/favicon.png
38cdcafa90f190f0c2729b6a6fb7386c8c241d341aedc2d112ce3175800e0cfb  src/local_deep_research/web/static/sounds/error.mp3
f04251c56111f9db7abc6e97e860cadc335bf33a0d6bfd5e0f3bac60955c58b2  src/local_deep_research/web/static/sounds/success.mp3
