Validate only rejected blob_size_limit below chunk_size. But the chunker can emit chunks up to chunk_size times the FastCDC size spread (four times), and the packer places a single chunk of any size into an otherwise empty blob. A limit between one and four times chunk_size therefore let a blob reach four times the configured maximum, and since most such blobs hold a single chunk it exposed individual chunk lengths to anyone who can list the destination.
Validate now rejects blob_size_limit below chunk_size times the spread. It reuses the chunker's single constant, which is now exported as chunker.ChunkSizeSpread, rather than introducing a second literal 4. The rule is stated in the error text, the Validate doc comment, the README config table, config.example.yml, and the generated config template in internal/cli/config.go.
The new config test drives the boundary directly: at chunk_size, between chunk_size and the bound, and one byte below are all rejected; exactly at the bound and above pass. Existing assertions are unchanged. make check is green.
Model: opus-4-8
Closes https://git.eeqj.de/sneak/vaultik/issues/167
`Validate` only rejected `blob_size_limit` below `chunk_size`. But the chunker can emit chunks up to `chunk_size` times the FastCDC size spread (four times), and the packer places a single chunk of any size into an otherwise empty blob. A limit between one and four times `chunk_size` therefore let a blob reach four times the configured maximum, and since most such blobs hold a single chunk it exposed individual chunk lengths to anyone who can list the destination.
`Validate` now rejects `blob_size_limit` below `chunk_size` times the spread. It reuses the chunker's single constant, which is now exported as `chunker.ChunkSizeSpread`, rather than introducing a second literal 4. The rule is stated in the error text, the `Validate` doc comment, the README config table, `config.example.yml`, and the generated config template in `internal/cli/config.go`.
The new config test drives the boundary directly: at `chunk_size`, between `chunk_size` and the bound, and one byte below are all rejected; exactly at the bound and above pass. Existing assertions are unchanged. `make check` is green.
Model: opus-4-8
Validate only rejected blob_size_limit below chunk_size, but the chunker
can emit chunks up to chunk_size times the FastCDC size spread (four
times), and the packer puts a single chunk of any size into an otherwise
empty blob. A limit between one and four times chunk_size therefore let a
blob reach four times the configured maximum, with most blobs holding a
single chunk and so exposing individual chunk lengths to anyone who can
list the destination.
Validate now rejects blob_size_limit below chunk_size times the spread,
reusing the chunker's one constant (now exported as ChunkSizeSpread)
instead of a second literal. The rule is stated in the error text, the
Validate comment, the README config table, config.example.yml, and the
generated config template.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #167
Validateonly rejectedblob_size_limitbelowchunk_size. But the chunker can emit chunks up tochunk_sizetimes the FastCDC size spread (four times), and the packer places a single chunk of any size into an otherwise empty blob. A limit between one and four timeschunk_sizetherefore let a blob reach four times the configured maximum, and since most such blobs hold a single chunk it exposed individual chunk lengths to anyone who can list the destination.Validatenow rejectsblob_size_limitbelowchunk_sizetimes the spread. It reuses the chunker's single constant, which is now exported aschunker.ChunkSizeSpread, rather than introducing a second literal 4. The rule is stated in the error text, theValidatedoc comment, the README config table,config.example.yml, and the generated config template ininternal/cli/config.go.The new config test drives the boundary directly: at
chunk_size, betweenchunk_sizeand the bound, and one byte below are all rejected; exactly at the bound and above pass. Existing assertions are unchanged.make checkis green.Model: opus-4-8
PASS
Model: opus-4-8