fix: security hardening for v1.0.2#18
Merged
Romain-Grosos merged 10 commits intomainfrom Mar 12, 2026
Merged
Conversation
Mnemonic encryption now combines /etc/machine-id with a root-only /etc/buncker/key-material file (mode 0600) generated at setup. This prevents non-root processes from reconstructing the AES key, upgrading the threat model from disk-theft-only to disk-theft + local process isolation.
Each analyze response now includes a UUID analysis_id. The generate-manifest endpoint requires this ID and returns 409 ANALYSIS_REPLACED if a concurrent analyze overwrote the result.
The ".." in parts check was redundant after Path.resolve() which already normalizes symlinks and relative components. The is_file() check after resolve() is sufficient for the admin-only localhost endpoint.
…o 40 GiB Set BaseHTTPRequestHandler.timeout = 60 to drop idle connections after 60 seconds of inactivity, mitigating slowloris-style thread exhaustion with the 16-worker bounded pool. Streaming uploads sending at least one chunk per minute are unaffected. Raise _MAX_IMPORT_SIZE from 4 GiB to 40 GiB to accommodate large ML image bundles transferred via USB or LAN.
…out/large transfer - Add client-offline container (2nd LAN client) to docker-compose.yml - Update Phase 1 and Phase 2 for analysis_id requirement - Phase 4 tests: - Concurrent analyze: client 1 gets 409 ANALYSIS_REPLACED after client 2 overwrites - Socket timeout: idle connection dropped after 60s (slowloris mitigation) - Large transfer: 34 GiB Content-Length accepted (within 40 GiB limit) - 45 GiB Content-Length rejected with BODY_TOO_LARGE - Real 100 MiB sparse file PUT upload accepted - Update e2e tests for analysis_id in generate-manifest calls
… lifecycle - Real docker pull from client container via buncker OCI registry - docker run to verify pulled image is functional - Daemon crash recovery: kill -9, restart, verify blob persistence - GC lifecycle: report candidates, impact analysis, execute deletion - Post-GC docker pull failure validates blob removal - docker system prune before post-GC pull to prevent layer cache flakiness
generate-manifest now requires analysis_id - extract it from analyze output and pass via --analysis-id for both nginx and alpine transfer cycles.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/etc/buncker/key-materialcombined with/etc/machine-idfor AES key derivationanalysis_id(UUID) on analyze/generate-manifest to prevent concurrent race conditions (409 ANALYSIS_REPLACED)".." in partspath traversal check removed (Path.resolve()+is_file()is sufficient)Commits (8)
feat(crypto): add root-only key-material to mnemonic encryptionfeat(server): add analysis_id to prevent analyze/generate race conditionrefactor(server): remove redundant path traversal checkfix(server): add 60s per-read socket timeout and raise import limit to 40 GiBtest(server): update handler tests for required analysis_id parameterdocs(security): update changelog and security docs for 1.0.2 hardeningtest(integration): add 4th container and Phase 4 for concurrency/timeout/large transfertest(integration): add Phase 5 for docker pull, crash recovery and GC lifecycleTest plan
docker compose up)