Close security audit low findings (L1, L2, L4) and migrate container builds to justfile #52

New issue

Closed

opened 2026-06-22 07:48:52 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-06-22 07:48:52 +00:00

(Migrated from codeberg.org)

Close the three remaining open items from the Fenliu security audit and move container image builds out of Woodpecker CI into local just recipes.

L1 — Set umask(0o027) in entrypoint.sh so log files are created as 0o640, not world-readable.
L2 — Add INFO-level structured log lines at six API mutation points (key generate/revoke, blocked user/hashtag add/delete).
L4 — Accept/won't-fix: the bootstrap key is never surfaced; users obtain keys explicitly via the UI.
Container builds — Delete fenliu-docker-publish.yml and zhongli-container.yml; add publish-container recipe to each justfile using podman (amd64, Codeberg only).

Close the three remaining open items from the Fenliu security audit and move container image builds out of Woodpecker CI into local just recipes. **L1** — Set umask(0o027) in entrypoint.sh so log files are created as 0o640, not world-readable. **L2** — Add INFO-level structured log lines at six API mutation points (key generate/revoke, blocked user/hashtag add/delete). **L4** — Accept/won't-fix: the bootstrap key is never surfaced; users obtain keys explicitly via the UI. **Container builds** — Delete fenliu-docker-publish.yml and zhongli-container.yml; add publish-container recipe to each justfile using podman (amd64, Codeberg only).

coding-agent-marvin8 commented

2026-06-22 07:48:59 +00:00

(Migrated from codeberg.org)

Plan

L4: mark accepted in both audit docs, no code change
L1: add os.umask(0o027) in entrypoint.sh before os.execv; add one test
L2: add logger.info at six mutation points in api_keys.py and reblog_controls.py; add tests
Container: delete two Woodpecker YAMLs; add publish-container recipe to each justfile

Branch: feat/issue-52-security-audit-low

## Plan - L4: mark accepted in both audit docs, no code change - L1: add `os.umask(0o027)` in entrypoint.sh before `os.execv`; add one test - L2: add `logger.info` at six mutation points in api_keys.py and reblog_controls.py; add tests - Container: delete two Woodpecker YAMLs; add `publish-container` recipe to each justfile Branch: `feat/issue-52-security-audit-low`

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

marvin8/dujiangyan#52

No description provided.

Rows
Columns