| Comment: | transport: refuse Basic over plain http to another host; drop it on a cross-host redirect
A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk | version-0.3.30 |
| Files: | files | file ages | folders |
| SHA3-256: |
b637cbd37c8ca19e9cb83d1a2181646f |
| User & Date: | dmestas on 2026-09-24 16:44:56.641 |
| Other Links: | manifest | tags |
|
2026-09-25
| ||
| 21:14 |
release workflow: keep its artifacts three days, not thirty
Every artifact it uploads is transit, published to the uv store and a GitHub release the day it is built. Thirty days kept ~40 MB per release against the 500 MB storage quota, and a full quota failed the soak's log upload. check-in: 29f07577ae user: dmestas tags: trunk | |
|
2026-09-24
| ||
| 16:44 |
transport: refuse Basic over plain http to another host; drop it on a cross-host redirect
A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30 | |
| 01:02 |
soak: record a finding and keep sweeping; CI: cap the runners' zig cache
A failing fuzz target is abandoned and the sweep moves on, so one recurring crash no longer hides the targets after it; the exit lists every finding. Each workflow clears its zig-local cache whole at job start once it passes 8 GB, since Zig never prunes it. check-in: 8ebc3e4dd8 user: dmestas tags: trunk | |