4 Commits

Author	SHA1	Message	Date
GitHub Actions	032d475fba	chore: remediate 61 Go linting issues and tighten pre-commit config ... Complete lint remediation addressing errcheck, gosec, and staticcheck violations across backend test files. Tighten pre-commit configuration to prevent future blind spots. Key Changes: - Fix 61 Go linting issues (errcheck, gosec G115/G301/G304/G306, bodyclose) - Add proper error handling for json.Unmarshal, os.Setenv, db.Close(), w.Write() - Fix gosec G115 integer overflow with strconv.FormatUint - Add #nosec annotations with justifications for test fixtures - Fix SecurityService goroutine leaks (add Close() calls) - Fix CrowdSec tar.gz non-deterministic ordering with sorted keys Pre-commit Hardening: - Remove test file exclusion from golangci-lint hook - Add gosec to .golangci-fast.yml with critical checks (G101, G110, G305) - Replace broad .golangci.yml exclusions with targeted path-specific rules - Test files now linted on every commit Test Fixes: - Fix emergency route count assertions (1→2 for dual-port setup) - Fix DNS provider service tests with proper mock setup - Fix certificate service tests with deterministic behavior Backend: 27 packages pass, 83.5% coverage Frontend: 0 lint warnings, 0 TypeScript errors Pre-commit: All 14 hooks pass (~37s)	2026-02-02 06:17:48 +00:00
GitHub Actions	f64e3feef8	chore: clean .gitignore cache	2026-01-26 19:22:05 +00:00
GitHub Actions	e5f0fec5db	chore: clean .gitignore cache	2026-01-26 19:21:33 +00:00
GitHub Actions	2f44da2c34	feat(security): add plugin signature allowlisting and security hardening ... Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive security controls for external plugin loading. Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting Support permissive (unset), strict ({}), and allowlist modes Add directory permission verification (reject world-writable) Configure container with non-root user and read-only plugin mount option Add 22+ security tests for permissions, signatures, and allowlist logic Create plugin-security.md operator documentation Security controls: Signature verification with sha256: prefix requirement World-writable directory rejection Non-root container execution (charon user UID 1000) Read-only mount support for production deployments Documented TOCTOU mitigation with atomic deployment workflow	2026-01-14 19:59:41 +00:00