clawbot
d96899eca6
check / check (push) Canceled after 0s
The fetcher accepts image/svg+xml and internal/magic detects SVG. orig of an SVG at the orig size is the SVG unchanged, cached as a variant; at another size it is ErrSVGNotOriginalSize (400). Any other format renders it with libvips' thumbnail at the least size covering the output, at most 8192 on a side, so it stays sharp. An SVG's own size is not limited; one with a side over 8192 times the other is ErrSVGTooThin (415). The cache reads up to 1024 first bytes to find a file's format. Tests that pinned the SVG refusal now expect SVG to be read. Render time and memory are unbounded: P1 in TODO.md until the owner decides on #68. Model: opus-5-5
37 lines
1.2 KiB
Markdown
37 lines
1.2 KiB
Markdown
# Workflow
|
|
|
|
- branch per issue from `next`
|
|
- do the work in Next Step
|
|
- delete Next Step from `TODO.md`
|
|
- `TODO.md` merges with git's union merge (`.gitattributes`), which never
|
|
reports a conflict: read the merged entries after every merge or rebase
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- open a PR based on `next`
|
|
- an independent reviewer who did not write the change gates it
|
|
- the manager squash-merges the PR into `next` once review passes
|
|
- `next` stays green and mergeable to `main` at any time; only the owner merges
|
|
`next` into `main`, via the single milestone PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0. The `1.0.0` milestone is in progress.
|
|
|
|
# Next Step
|
|
|
|
P1: security: bound the time and memory of rendering an SVG source. Both grow
|
|
with what the SVG draws, such as filter effects. govips cannot stop or limit a
|
|
render. The bound is the owner's decision on
|
|
https://git.eeqj.de/sneak/pixa/issues/68.
|
|
|
|
# Future Steps
|
|
|
|
- P2: security
|
|
- per-origin rate limiting
|
|
- P2: HTTP response handling
|
|
- Last-Modified headers
|
|
- P2: operational
|
|
- measure the 1k to 5k req/s target with `script/loadtest` on a machine not
|
|
shared with other work
|