6 Commits

Include renames

Author	SHA1	Message	Date
clawbot	af5f98b867	Test that origins a browser does not send abort startup (closes #61) ... Adds the review's examples to invalidSizeAndOriginCases: a scheme's default port, a port with a leading zero, hosts a browser reads as an IPv4 address or refuses, an IPv6 address not in its shortest form, plus a scheme other than http or https and a host name in upper case. Model: opus-5-5	2026-09-29 00:19:18 +00:00
clawbot	256fc71511	Test origin host and port checks and a 1 GiB size maximum (closes #61) ... Failing cases: access_control_allow_origin with two hosts, an empty port, no host, port 0, port 99999 or a non-ASCII host name, and upstream_max_response_size above 1 GiB, up to the largest 64-bit integer, where the image processor's limit wraps negative. Each must abort startup naming the key and the value. The bad origins are now one list so the table fits the linter's function length limit; the size test uses 1 GiB to show the maximum itself is accepted, and IPv4 and IPv6 origins are shown to be accepted. Model: opus-5-5	2026-09-29 00:19:07 +00:00
clawbot	7a969bb225	Test that an origin with a * inside aborts startup (closes #61) ... Failing cases for access_control_allow_origin set to https://*, https://*.example.com and https://*example.com. The CORS middleware reads a * inside an origin as a pattern, so these would let other sites read responses; each must abort startup naming the key and the value. Model: opus-5-5	2026-09-29 00:19:07 +00:00
clawbot	5fcbad8515	Test four README settings pixa does not have yet (closes #61) ... Failing tests for access_control_allow_origin, upstream_fetch_timeout, upstream_max_response_size and downstream_timeout: their defaults, valid values from the file and the environment, invalid values aborting startup naming the key or variable and the value, the CORS middleware answering with the configured origin, and the server's write timeout coming from downstream_timeout. They do not compile until the settings exist. Model: opus-5-5	2026-09-29 00:18:54 +00:00
clawbot	1798cba96c	Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) ... The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it. Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match. What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit. Disclosure: TODO.md is not updated by this change. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 21:59:24 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00