4 Commits

Include renames

Author	SHA1	Message	Date
sneak	18469e236f	script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30) ... script/gitea-requests runs gitea 1.27.3 behind the image at its defaults, sends through it the requests that reading gitea's source found the Core Rule Set refuses, with a short sample of ordinary use, and prints each request with the rule ids that matched it. make gitea-requests runs it; make check does not. Every case still holds, and each fix would let through what SPEC.md says stays refused, so the notes specific to gitea now name them with how each refusal plays out: file names in query parameters that read as Java, script, PowerShell or SQL, such paths, and an image push that reuses a layer of an image named like a command. Model: opus-5-5	2026-10-14 17:51:22 +00:00
clawbot	0dc26041dc	make tidy, and make check failing on an untidy go.mod or go.sum (closes #99) ... script/tidy runs `go mod tidy` in a new tidy stage of the Dockerfile, on the test phase's Go image, and writes go.mod and go.sum back into the working tree with `docker build --output`. The test phase now runs `go mod tidy -diff` before the tests and fails naming `make tidy`; it comes first because a missing go.sum line otherwise fails the tests with Go's own message. Judgement call: script/tidy's build has no tag, unlike the other builds in script/: it makes no image. Model: opus-5-5	2026-10-07 10:30:46 +02:00
clawbot	d4f90dba37	The image apps build FROM, with its health check (closes #45) ... The Dockerfile's last stage is now the image of "Deployment" in SPEC.md: Ubuntu 26.04 with ca-certificates, nix-bin and runit from a dated snapshot whose InRelease files are checked by hash, nixpkgs from its release file checked by SHA-256, runsvinit built at a fixed commit, and smallwebwaf as a runit service. smallwebwaf answers /_smallwebwaf/healthz, and `smallwebwaf healthcheck`, which takes no further argument, is the image's HEALTHCHECK. script/example-app builds an app on the image and checks it end to end. The Nix profile comes last on the PATH: first, busybox from nixpkgs replaced runit's own runsvdir and sv. SPEC.md is corrected to match what was built. Model: opus-5-5	2026-10-04 10:05:30 +02:00
clawbot	d76715b0df	Pass-through proxy with timeouts, size limits and a request log (closes #13) ... Milestone 1, the repo's first code. smallwebwaf passes each request to the app and the answer back unchanged, streaming bodies and WebSocket upgrades, within four timeouts (client and app, request and response) and two size limits, and writes one JSON line per request to stdout. Every setting has an SWWAF_ name and a default, and an invalid value stops the start. The repo gets the standard layout: script/ entrypoints, make targets that call them, a Dockerfile that runs the checks, and the Gitea workflow. Disclosure: SPEC.md changed. Go's server reads the request line and headers before smallwebwaf sees the request, so slow headers are closed without an answer, and neither slow nor oversized headers get a log line. Disclosure: standard library only. Model: opus-5-5	2026-10-03 17:24:34 +02:00