6 Commits

Author	SHA1	Message	Date
akanealw	eec8c28fb3	changed perms	2026-04-22 18:19:14 +00:00
GitHub Actions	032d475fba	chore: remediate 61 Go linting issues and tighten pre-commit config ... Complete lint remediation addressing errcheck, gosec, and staticcheck violations across backend test files. Tighten pre-commit configuration to prevent future blind spots. Key Changes: - Fix 61 Go linting issues (errcheck, gosec G115/G301/G304/G306, bodyclose) - Add proper error handling for json.Unmarshal, os.Setenv, db.Close(), w.Write() - Fix gosec G115 integer overflow with strconv.FormatUint - Add #nosec annotations with justifications for test fixtures - Fix SecurityService goroutine leaks (add Close() calls) - Fix CrowdSec tar.gz non-deterministic ordering with sorted keys Pre-commit Hardening: - Remove test file exclusion from golangci-lint hook - Add gosec to .golangci-fast.yml with critical checks (G101, G110, G305) - Replace broad .golangci.yml exclusions with targeted path-specific rules - Test files now linted on every commit Test Fixes: - Fix emergency route count assertions (1→2 for dual-port setup) - Fix DNS provider service tests with proper mock setup - Fix certificate service tests with deterministic behavior Backend: 27 packages pass, 83.5% coverage Frontend: 0 lint warnings, 0 TypeScript errors Pre-commit: All 14 hooks pass (~37s)	2026-02-02 06:17:48 +00:00
GitHub Actions	f64e3feef8	chore: clean .gitignore cache	2026-01-26 19:22:05 +00:00
GitHub Actions	e5f0fec5db	chore: clean .gitignore cache	2026-01-26 19:21:33 +00:00
GitHub Actions	2f44da2c34	feat(security): add plugin signature allowlisting and security hardening ... Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive security controls for external plugin loading. Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting Support permissive (unset), strict ({}), and allowlist modes Add directory permission verification (reject world-writable) Configure container with non-root user and read-only plugin mount option Add 22+ security tests for permissions, signatures, and allowlist logic Create plugin-security.md operator documentation Security controls: Signature verification with sha256: prefix requirement World-writable directory rejection Non-root container execution (charon user UID 1000) Read-only mount support for production deployments Documented TOCTOU mitigation with atomic deployment workflow	2026-01-14 19:59:41 +00:00
GitHub Actions	b86aa3921b	feat(dns): add custom DNS provider plugin system ... - Add plugin interface with lifecycle hooks (Init/Cleanup) - Implement thread-safe provider registry - Add plugin loader with SHA-256 signature verification - Migrate 10 built-in providers to registry pattern - Add multi-credential support to plugin interface - Create plugin management UI with enable/disable controls - Add dynamic credential fields based on provider metadata - Include PowerDNS example plugin - Add comprehensive user & developer documentation - Fix frontend test hang (33min → 1.5min, 22x faster) Platform: Linux/macOS only (Go plugin limitation) Security: Signature verification, directory permission checks Backend coverage: 85.1% Frontend coverage: 85.31% Closes: DNS Challenge Future Features - Phase 5	2026-01-07 02:54:01 +00:00