Allowlist no host in the example config (closes #249) #264

Merged

clawbot merged 2 commits from issue-249-empty-example-allowlist into next

2026-10-15 06:26:25 +02:00

Author	SHA1	Message	Date
sneak	11946cb653	Allowlist no host in the example config (closes #249 ) check / check (push) Canceled after 0s Details configs/config.example.yml allowlisted github.com and user-images.githubusercontent.com, where anyone can put an image, so a deployment set up as Getting Started says served those images to anyone without a signature. The example now leaves allowlist_hosts out, with one commented entry under example.com. Getting Started and "Running under upaas" in README.md say that every image on an allowlisted host is served without a signature, so an allowlisted host must be one the operator controls. Model: opus-5-5	2026-10-15 02:43:40 +00:00
sneak	ca6287ef1d	Test that the example config allowlists no host check / check (push) Canceled after 0s Details Loads configs/config.example.yml with a real signing key, as Getting Started has it copied and edited, and fails while the example allowlists any host: every image on an allowlisted host is served to anyone without a signature. Fails until #249 is fixed. Model: opus-5-5	2026-10-15 02:41:51 +00:00

Author

SHA1

Message

Date

sneak

11946cb653

Allowlist no host in the example config (closes #249 )

check / check (push) Canceled after 0s

Details

configs/config.example.yml allowlisted github.com and
user-images.githubusercontent.com, where anyone can put an image, so a
deployment set up as Getting Started says served those images to anyone
without a signature. The example now leaves allowlist_hosts out, with
one commented entry under example.com. Getting Started and "Running
under upaas" in README.md say that every image on an allowlisted host
is served without a signature, so an allowlisted host must be one the
operator controls.

Model: opus-5-5

2026-10-15 02:43:40 +00:00

sneak

ca6287ef1d

Test that the example config allowlists no host

check / check (push) Canceled after 0s

Details

Loads configs/config.example.yml with a real signing key, as Getting
Started has it copied and edited, and fails while the example allowlists
any host: every image on an allowlisted host is served to anyone without
a signature. Fails until
#249 is fixed.

Model: opus-5-5

2026-10-15 02:41:51 +00:00