Conversation
fix(upstream): deprecate unverified TLS connections
…narrowing # Conflicts: # CHANGELOG.md
…image-write-inspection
fix(configs): stop three presets opting into read exfiltration
google.golang.org/grpc v1.82.1 is vulnerable to heap exhaustion from HTTP/2 DATA frame fragmentation, fixed upstream in 1.83.1. The pin is an indirect requirement reached through sigstore-go's Rekor client on the opt-in image_trust path, never the core proxy path. Grype matches on module version rather than reachability, so the finding failed both the "Security: Grype & Govulncheck" job and "CI: Verify"'s Docker Build on every branch that ran them, including main at v2.0.0. That is what was reddening Renovate PR #398, not anything the PR changed. govulncheck reports zero reachable vulnerabilities either side of the bump. go build, go vet and go test ./... are green on v1.83.2.
Four independent breaks, all in workflows that only run on a schedule, so
none of them gates a PR and all of them had been red for weeks.
- ci(quality): run Gremlins from the module root. The module moved to the
repo root and this workflow kept working-directory: app plus
./internal/<pkg> package paths. gremlins unleash resolves the module
from the cwd rather than walking up for go.mod, so all six shards failed
in ~1s with "not in a Go module". Reproduced locally: ./internal/filter
does not resolve from the root, ./app/internal/filter does.
- ci(quality): let the badge job take its own skip-and-warn path. The step
inherits -e from GitHub's default bash -e {0}, and set -uo pipefail does
not clear it, so an unparseable report aborted the step before the
warn-and-continue branch below could run. || true on both assignments
also fixes a latent pipefail + head -1 SIGPIPE case that returns 141
from a pipeline which had already parsed the value.
- ci(quality): anchor the Engine API scrape to the version heading. The
bare v1.NN match picks up SVG path coordinates (v1.875, v1.125) from the
page's inline icons, which is why the 2026-09-01 run demanded a bump to
Engine API 1.875. Verified against the live page: the anchored pattern
yields 1.55, matching the existing pin. A three-digit minor now fails
loudly instead of becoming an alert.
- ci(security): pin the ZAP baseline job to ubuntu-24.04, the last
ubuntu-latest of 38 jobs.
The pinned ceiling in app/testdata/docker-api/max-supported-version.txt is
correct at 1.55 and is deliberately not touched.
zizmor started reporting two self-repository findings on release-cut.yml and release-from-tag.yml, which blocks every push from the repo. Neither workflow changed; the audit is new. Two separate problems fell out of chasing it. - ci(quality): pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, and in a linked worktree that resolves to the main checkout. A push from .claude/worktrees/<name> was auditing the branch's workflows against the main checkout's .github/zizmor.yml, so editing the config on a branch had no effect on that branch's own pre-push run. This repo keeps four worktrees, so that is the normal case, not an edge one. - ci(quality): ignore self-repository for the two release workflows. zizmor wants `uses: $/.github/actions/verify-ci-success` over the workspace-relative form, and it is right: GitHub shipped $/ on 2026-07-30, it resolves to the running commit, and both call sites are already checked out at that ref, so the swap is a behavioural no-op. But actionlint 1.7.12, the current release and the one behind the pinned raven-actions/actionlint gate, rejects it with "invalid format because ref is missing". Verified both directions locally: applying the fix makes zizmor clean and actionlint fail, reverting it flips them back. Reding a required check to satisfy a low-severity style preference is the wrong trade, so it waits for actionlint support. The condition to revisit is written next to the ignore. zizmor is a local pre-push hook only; no CI job runs it.
Prerequisite carried from the CI-quality-fixes branch so this branch can push at all. zizmor 1.30.0's new self-repository audit reports two low findings on release-cut.yml and release-from-tag.yml, exits 12, and refuses every push from the repo. Neither workflow changed. - Pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, which in a linked worktree is the main checkout, so a push from .claude/worktrees/<name> audits the branch's workflows against a different branch's config. - Ignore self-repository for the two release workflows. zizmor's suggested `uses: $/...` is officially correct and behaviourally identical here, but actionlint 1.7.12 rejects it as "invalid format because ref is missing" and actionlint is a required check. The revisit condition is recorded next to the ignore. Duplicated deliberately: this same commit is on fix/red-scheduled-quality-workflows, which carries the CHANGELOG entry for it. Whichever lands first, the other rebases to nothing.
- fix(ci): match the exact `v1.NN API changes` heading, not any `v1.NN API` / `API v1.NN` pair, so meta tags such as `<meta content="API v1.125">` can't outsort the real version - fix(ci): `|| true` on the extraction pipeline so a no-hit scrape reaches the step's own ::error diagnostic instead of aborting under `set -e` before it, the same bug class fixed in the badge job on this branch - fix(ci): reject minors >= 100 rather than > 999; two-digit minors are the only plausible shape and a three-digit one is markup - chore(ci): scope the zizmor self-repository ignore to the two `uses:` lines (release-cut.yml:61, release-from-tag.yml:155) so any other workspace-relative reference in either file still fires
The monthly Gremlins matrix hardcoded filter, proxy, config, httpjson, logging and cmd, so the 97.8% badge described a sixth of app/internal. The matrix now comes from scripts/ci/mutation-matrix.sh at run time: every package with both source and tests, minus the testcert/testhelp fixtures, 34 legs today. The badge job reads its expected-report count from the same discover step, so the count and the matrix cannot drift, and the sync test runs the script instead of counting YAML entries. Matrix and package values move into env so the run scripts carry no inline expressions. The badge job summary gains a per-package killed/lived/efficacy table. Pushing a mutation/* branch runs this file from that branch, which workflow_dispatch cannot do until the file is on main; badge commits stay gated to the default branch. max-parallel matches the nightly fuzz ceiling so a leg is never lost to runner concurrency, and the concurrency group includes the ref so a branch run cannot cancel the monthly one. - ci(quality): derive the Gremlins matrix from a discover job - test(ci): check discover wiring and run the matrix script - docs(changelog): record the widened matrix and the expected score drop
Prerequisite carried from the CI-quality-fixes branch so this branch can push at all. zizmor 1.30.0's new self-repository audit reports two low findings on release-cut.yml and release-from-tag.yml, exits 12, and refuses every push from the repo. Neither workflow changed. - Pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, which in a linked worktree is the main checkout, so a push from .claude/worktrees/<name> audits the branch's workflows against a different branch's config. - Ignore self-repository for the two release workflows. zizmor's suggested `uses: $/...` is officially correct and behaviourally identical here, but actionlint 1.7.12 rejects it as "invalid format because ref is missing" and actionlint is a required check. The revisit condition is recorded next to the ignore. Duplicated deliberately: this same commit is on fix/red-scheduled-quality-workflows, which carries the CHANGELOG entry for it. Whichever lands first, the other rebases to nothing. (cherry picked from commit 7f330ec)
Run 33650478849 expanded zero Gremlins legs: the script's JSON carried a top-level count beside include, and strategy.matrix reads any key other than include/exclude as a dimension, so the job failed to expand and the badge step saw 0 of 34 reports. The script now emits only include, the discover step derives count from its length, and the sync test asserts the matrix JSON has exactly one key.
… migration pages G6: registry allowlist doc no longer claims push is checked, only pull. G11: presets.mdx documents Homarr's undocumented removeAll gap and opt-in snippet. G18: migration.mdx notes ALLOW_* works independent of POST, unlike real Tecnativa. G20: configuration.mdx gets a Multiple Listeners section for listeners/allowed_profiles/mount_on. G21: configuration.mdx corrects socket_mode to cover both 0600 and 0660. G22: admin.mdx corrects the disabled-admin response from 404 to default-deny 403. G23: configuration.mdx lists all ten granular ALLOW_* compat vars, not five. G24: configuration.mdx documents the five serve override flags next to Precedence. G25: configuration.mdx's audit-log sample gets the four trace-correlation fields. G26: migration.mdx's CetusGuard table gets the backend-TLS row and repeated -frontend-addr note. G27: migration.mdx's CetusGuard section notes the TLS 1.2->1.3 cutover requirement. G38: CLAUDE.md scopes the stdlib-only claim to execution, not package linkage. G41: migration.mdx fixes the config path and names the granular endpoint-config gates. G42: presets.mdx corrects the drydock preset's Denies/Allows lines. G43: drydock-with-compose.yaml and presets.mdx document the post_start exec denial. G45: drydock.yaml's distribution-grant comment is reattributed away from drydock.
fix(ownership): deny unresolved resource targets
fix(responsefilter): unify response JSON encoding
fix(filter): guard container process-list reads
… a JSON array flushFiltered forwarded any 2xx body it could not open as a JSON array verbatim, so a JSON object, string, null, or an HTML error page reached the client with none of its contents ever checked against the name/image pattern axes. The one shape the pattern filter cannot walk is the one it was never able to prove safe, which is the wrong direction to fail in. It now returns an error the way flushSystemDataUsage already does for an undecodable /system/df body, and filterResponseThroughWriter turns that into the same generic 502 under visibility_policy_lookup_failed, regardless of rollout mode. The response filter is also gated to GET, matching the GET /system/df interception. A HEAD carries no body, so intercepting one would hand the new decode guard an empty buffer and answer 502 for a request that has nothing to filter.
…odies Both response filters that rewrite a body set Content-Length and stopped there, so the daemon's ETag, Content-Encoding, Content-Range, Digest, Last-Modified and Trailer announcement went out describing the upstream body the filter had just replaced. A caching client keyed on that validator can serve the unfiltered list back on a later request, and the ETag by itself is a fingerprint of the resources the policy hid. Both now call ClearUpstreamRepresentationHeaders before setting the length, the same call the 502 paths beside them already make: visibility's commitFilteredBody, which both flushFiltered and flushSystemDataUsage commit through, and ownership's flushOwned for GET /system/df.
… inspect
redact_mount_paths already covered ResolvConfPath, HostnamePath, HostsPath and
Podman's Rootfs/StaticDir/OCIConfigPath/ConmonPidFile/PidFile, but left two
host-path families on the same response. LogPath is
/var/lib/docker/containers/{id}/{id}-json.log on dockerd and
/var/lib/containers/storage/overlay-containers/{id}/userdata/ctr.log on
Podman, and GraphDriver.Data is the whole storage layout: LowerDir, MergedDir,
UpperDir and WorkDir on overlay2, Dataset and Mountpoint on zfs, RootDir on
vfs. One inspect handed a caller the graph root, the storage driver and
whether the daemon runs rootful, after the operator had already decided that
caller may not see Mounts[].Source.
Every value under GraphDriver.Data is masked rather than a known-path
allowlist, so a driver that publishes a new key is covered the day it ships.
The key set survives so a client's decoder still sees the shape it expects,
and GraphDriver.Name stays: it names the driver, not a path. A GraphDriver or
Data of an unexpected type is refused like every other shape mismatch here.
Both fields reach the libpod container inspect through the same handler, so
Podman's native shape is covered too.
The reported bypass does not reproduce on this branch. glob.ToRegexString already emits "(?s:.*)" for "**" and "(/(?s:.*))?" for "/**", so a mid-path "**" deny like /containers/**/exec matches a path carrying the newline net/http decodes out of %0A, and the broader allow below it is not borrowed. Nothing about the matchers changed here; these are the regressions that were missing. TestMidPathDoubleStarDenyMatchesDecodedControlBytes drives the regex fallback with decoded newline, CR, CRLF, NUL and U+2028 in the path. Dropping the "s" flag from either group fails four of its cases. TestPathMatcherKindsAgreeWithRegexFallback is the differential the fast paths never had: over 400 normalized paths built from a hostile segment alphabet (decoded control bytes, a surviving %2F, multi-byte and invalid UTF-8, the glob metacharacters as literal content), every literal, match-all, trailing-deep and segment-glob matcher has to return exactly what the regex the same pattern compiles to returns. Each pattern is also checked for matching neither nothing nor everything, so agreement cannot be vacuous. The corpus is normalized through NormalizePath because that is the only thing a compiled rule is handed. The libpod image-SCP route view is the one caller that keeps a trailing slash, and the two sides genuinely disagree there; the test says so and does not pretend to settle it.
The comment said buildAdminValidator mirrors the offline `sockguard validate` pipeline, named validateAndCompileRules, and promised an operator's CI gate and the running proxy reach the same verdict for the same YAML. It calls validateAndCompileRulesStructural, which skips every filesystem dereference, so a candidate naming TLS material that is missing, unreadable, or not PEM passes the endpoint and fails the CLI. The body comment right below it always said so; the doc comment contradicted it.
Three Security entries (the non-array list body refusal, the representation headers on a rewritten body, and LogPath / GraphDriver.Data under redact_mount_paths), one Tests entry for the matcher differential, and one Documentation entry for the admin validator comment. Filed under Security rather than Fixed because every neighbour in that section is the same kind of change: a read-side disclosure or a fail-open closed.
…tion fix(libpod)!: isolate unsafe stats and image batch reads
…-changelog-website # Conflicts: # CHANGELOG.md # README.md
docs(site): align the docs pages with dev/v2.0
…bsite docs: align README, CHANGELOG and website with dev/v2.0
fix(visibility): fail closed on non-array list bodies and finish read-side redaction
docs(release): prepare v2.1.0 GA surfaces
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
September 4, 2026 00:33
Contributor
Author
|
@coderabbitai review |
|
Deployment failed for project sockguard-website with the following error: Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit |
|
Important Review skippedToo many files! This PR contains 356 files, which is 256 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (356)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Contributor
Author
|
Superseded: v2.1.0 cuts from dev/v2.1 (release-cut refuses a 2.1 prerelease from dev/v2.0), so the promotion PR comes from that branch instead. Same tree. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the v2.1.0 release line to main. Everything on dev/v2.0 since v2.0.0 landed through reviewed PRs: the libpod write-inspection and owner-isolation fail-closed chain (#384, #386, #389, #390, #395, #394), the docs alignment pass (#422, #423), the read-side hardening from the adversarial review (#424), and the release metadata (#425).
v2.1.0-rc.1is cut from the same tree so the tri-tool conformance gate can run against a published image before this merges. Proxy behaviour is identical between rc.1 and the GA tag; the GA delta is release metadata only.Merge as a merge commit, not a squash, so the reconcile ancestry holds.