| Comment: | Release 0.3.23
The transport answers an HTTP Basic challenge; a gated first round is no longer fatal. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk | version-0.3.23 |
| Files: | files | file ages | folders |
| SHA3-256: |
2a3106fcaf4e4985fade393d48d36139 |
| User & Date: | dmestas on 2026-09-18 11:37:25.678 |
| Other Links: | manifest | tags |
|
2026-09-18
| ||
| 12:31 |
fuzz: reach the igot accept arm again, and sweep at the floor in ci
The adversarial token generator capped fields at 24 bytes, and the igot parser has required a 40- or 64-byte name since the shun work, so the parser's accept arm was unreachable and the harness's own reachability floor said so at 256 rounds. CI swept 100 rounds, below the floor, and never saw it; the first bounded soak did. One field in four is now hash-shaped, and ci sweeps every target at the floor's round count. check-in: af292c3091 user: dmestas tags: trunk | |
| 11:37 |
Release 0.3.23
The transport answers an HTTP Basic challenge; a gated first round is no longer fatal. check-in: 2a3106fcaf user: dmestas tags: trunk, version-0.3.23 | |
| 11:31 |
transport: answer an HTTP Basic challenge
A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk | |