Repository navigation
1.3 stable: harden bazaar trust chain and local access - #21
Open
uncoalesced wants to merge 5 commits into
Open
uncoalesced wants to merge 5 commits into
uncoalesced wants to merge 5 commits into
Conversation
Rust verifier and registry.sh now reject the remote index when the signature, public key or openssl is missing, instead of trusting it. Unverified remote data is no longer cached. Adds negative tests.
Validate tool keys and env_required names before indirect expansion, pin registered npx package args to the verified version, require sha256 for npm and archive entries (fail closed), and reject archives with unsafe member paths.
bridged: egress allowlist is server-side only; http(s) only, no redirects, no non-public addresses, response size cap. bridged-ws: connecting process must belong to a logged-in user (socket table lookup), helper sockets must be owned by the uid in their name, /shell no longer matches the desktop socket, replies read to newline. shell-helper: refuse peers it cannot identify. agentd-plan: add reject_plan, approve/execute only from the right state, plans run once. CI: rustfmt and shellcheck findings that were already failing on main.
…absent The shell job runs on a bare runner; the daemon job already builds and tests turingosd in the ISO's Debian container.
The shell probed the screen size with an untimed xdpyinfo. Under Hyprland DISPLAY is XWayland, which never started in a VMware VM, so xdpyinfo waited on its socket forever and the UI never appeared. - gfx::screen_size asks hyprctl under Wayland and falls back to xdpyinfo; every probe has a 3s timeout. kiosk and gfx::screen_pixels share it. - Brave runs on Wayland ozone when WAYLAND_DISPLAY is set, X11 otherwise. - On Wayland Brave ignores --class (app id brave-127.0.0.1__-Default), so the Hyprland shell rule and turingos-omni's Super+Space match that too. - tests/kiosk_display.sh covers hanging probes, ozone choice, the rule and Super+Space with stubbed hyprctl/xdpyinfo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from a full gap audit.
New tests: tests/bazaar_fallback.sh (missing sig, missing key), trust/tests/test_local_auth.py.
Sibling repo change (publish signed v1 index): uncoalesced/turingos-bazaar branch dev-1.3-stable.