lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-10-12 00:45:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
243 Commits 2 Branches 174 Tags
v0.1.239
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
lukaszraczylo 5a2c25d0e6 ci(release): do not fail the release on benchmark noise 
BenchmarkFilesystemPut measures disk writes on a shared runner and varied by
a factor of two between runs. Between the two compared commits only go.mod
and go.sum changed. The benchmark action still comments on an alert and
writes the summary, but it no longer fails the workflow.
 2026-10-04 12:00:51 +01:00
lukaszraczylo 70d6c8988a chore(deps): update tailwindcss to v4 
Switch to the @tailwindcss/vite plugin and the @import entry. Load the existing config with @config and keep class-based dark mode through a custom variant. Remove the postcss config and its autoprefixer dependency, which v4 no longer needs.
 2026-10-04 10:15:44 +01:00
lukaszraczylo 20470bfd3e chore(deps): update typescript to v6 
TypeScript 6 deprecates baseUrl and checks side-effect imports. Drop baseUrl, which paths does not need, and load the vite/client types so the CSS import resolves. Remove trailing commas from tsconfig.json so the JSON hook accepts it.
 2026-10-04 10:15:10 +01:00
lukaszraczylo dbbe254bfc chore(deps): update vue-router to v5 
The lockfile now resolves vue-router 5.3.1 on top of vite 8. Install, tests and build pass.
 2026-10-04 10:14:04 +01:00
lukaszraczylo f72b481720 chore(deps): migrate fiber from v2 to v3 
The automated update changed only go.mod, so the build failed on the old v2 imports. This commit moves the code to the v3 API.

The commit replaces BodyParser with Bind().Body, Static with the static middleware, and ListenTLS with ListenConfig. It also updates the tests for TestConfig.

Fixes #179
 2026-10-04 00:50:37 +01:00
lukaszraczylo 7d75dac29c ci(deps): update dependencies with Renovate [skip ci] 2026-10-03 18:44:33 +01:00
lukaszraczyloandGitHub 8fae680cbe Update go.mod and go.sum (#151) 2026-10-03 04:29:22 +01:00
lukaszraczyloGitHubcopilot-swe-agent[bot] <[email protected]>
 		b172788741 fix(frontend): override vulnerable transitive dependencies (#150) 
Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.

pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
 2026-10-03 00:56:29 +01:00
lukaszraczylo 48c12a4869 fix(deps): override vulnerable frontend packages 
Dependabot could not raise esbuild, minimatch and postcss-selector-parser, because their parents pin older ranges. The workspace now overrides them to the patched versions. The frontend builds and its tests pass.
 2026-10-03 00:30:11 +01:00
lukaszraczylo 1ebb4cfd95 fix(smb): use the cloudsoda go-smb2 fork 
hirochachacha/go-smb2 has no fix for GO-2026-5051, an out-of-bounds read in ReadDir that govulncheck reports as called from walkPath. The cloudsoda fork carries the fix. Dialer.DialConn replaces Dial.
 2026-10-02 13:24:13 +01:00
lukaszraczylo 8112b4859f fix(auth): restore ValidationCache.Stop 
Stop was deleted while its field and doc comment stayed. The cleanup goroutine could not be stopped, and staticcheck flagged stopOnce as unused.
 2026-10-02 13:23:58 +01:00
lukaszraczylo 854245c4f3 ci: push benchmark data to gh-pages 
The action wrote results to a local gh-pages branch and never pushed them. The next step then failed because docs/bench does not exist on main. The action now pushes gh-pages itself, and the manual push step is gone.
 2026-10-02 12:43:30 +01:00
lukaszraczylo d96e724755 build(frontend): allow esbuild and vue-demi build scripts 
pnpm 11 stops a frozen install when a dependency build script is not approved.
 2026-10-02 12:04:18 +01:00
lukaszraczylo d0b3d82508 ci: build with Go 1.27 and grant PR checks access 
go.mod needs Go 1.26 but the workflows pinned Go 1.25. The pull request workflow also lacked the permissions that the shared workflow requires, so it never started.
 2026-10-02 12:04:17 +01:00
lukaszraczyloandGitHub 6d4ce976c7 Update go.mod and go.sum (#147) 2026-10-01 04:24:41 +01:00
lukaszraczyloandGitHub d760757c46 Update go.mod and go.sum (#146) 2026-09-30 04:23:17 +01:00
lukaszraczyloandGitHub 67d87ed66b Update go.mod and go.sum (#145) 2026-09-29 04:20:53 +01:00
lukaszraczyloandGitHub 22fc1b454b Update go.mod and go.sum (#144) 2026-09-28 04:23:33 +01:00
lukaszraczyloandGitHub 2c483445a1 Update go.mod and go.sum (#143) 2026-09-26 04:19:22 +01:00
lukaszraczyloandGitHub f5beaea3e0 Update go.mod and go.sum (#142) 2026-09-25 04:19:21 +01:00
lukaszraczyloandGitHub 4d61ed1557 Update go.mod and go.sum (#141) 2026-09-24 04:18:16 +01:00
lukaszraczyloandGitHub f1bcfa02f5 Update go.mod and go.sum (#140) 2026-09-22 04:19:59 +01:00
lukaszraczyloandGitHub 16e09c0515 Update go.mod and go.sum (#139) 2026-09-19 04:17:35 +01:00
lukaszraczyloandGitHub 0ff7719d8a Update go.mod and go.sum (#138) 2026-09-16 04:20:31 +01:00
lukaszraczyloandGitHub 1d7ee6c27b Update go.mod and go.sum (#137) 2026-09-15 04:18:48 +01:00
lukaszraczyloandGitHub e00233943b Update go.mod and go.sum (#136) 2026-09-12 04:19:03 +01:00
lukaszraczyloandGitHub 6c2448bb03 Update go.mod and go.sum (#135) 2026-09-11 04:19:38 +01:00
lukaszraczyloandGitHub a511c380ba Update go.mod and go.sum (#134) 2026-09-10 04:20:11 +01:00
lukaszraczyloandGitHub fa66501e5c Update go.mod and go.sum (#133) 2026-09-09 04:21:00 +01:00
lukaszraczyloandGitHub 35ea5b8a5b Update go.mod and go.sum (#132) 2026-09-08 04:18:09 +01:00
lukaszraczyloandGitHub e5d7242dc1 Update go.mod and go.sum (#131) 2026-09-06 04:19:50 +01:00
lukaszraczyloandGitHub 3c994687ff Update go.mod and go.sum (#130) 2026-09-05 04:19:01 +01:00
lukaszraczylo 171386f7a7 fix: remediate severity-ordered review findings across cache, scanners, and proxies 
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
        goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
      cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource

All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
 2026-09-04 14:24:13 +01:00
lukaszraczyloandGitHub eb4517a45d Update go.mod and go.sum (#127) 2026-09-03 05:32:05 +01:00
lukaszraczyloandGitHub fa1b8cf6c4 Update go.mod and go.sum (#126) 2026-09-02 04:20:02 +01:00
lukaszraczyloandGitHub a5ac6f41e2 Update go.mod and go.sum (#125) 2026-09-01 04:20:37 +01:00
lukaszraczyloandGitHub 7de67d6a7a Update go.mod and go.sum (#124) 2026-08-29 04:17:50 +01:00
lukaszraczyloandGitHub db5dfef2d5 Update go.mod and go.sum (#123) 2026-08-28 06:49:21 +01:00
lukaszraczyloandGitHub b6a0a0800f Update go.mod and go.sum (#122) 2026-08-27 05:55:12 +01:00
lukaszraczyloandGitHub 36b99d528e Update go.mod and go.sum (#121) 2026-08-26 04:25:36 +01:00
lukaszraczyloandGitHub 601455cb9b Update go.mod and go.sum (#120) 2026-08-22 04:20:58 +01:00
lukaszraczyloandGitHub e0a489e471 Update go.mod and go.sum (#119) 2026-08-21 04:25:00 +01:00
lukaszraczyloandGitHub aa4b79ab0c Update go.mod and go.sum (#118) 2026-08-18 04:21:39 +01:00
lukaszraczyloandGitHub 8db5aa099b Update go.mod and go.sum (#117) 2026-08-15 04:18:04 +01:00
lukaszraczyloandGitHub 47f63e3b06 Update go.mod and go.sum (#116) 2026-08-13 04:51:47 +01:00
lukaszraczyloandGitHub 43f23900e0 Update go.mod and go.sum (#115) 2026-08-12 04:48:48 +01:00
lukaszraczyloandGitHub 3a113557cd Update go.mod and go.sum (#114) 2026-08-11 04:36:08 +01:00
lukaszraczyloandGitHub 22163595fd Update go.mod and go.sum (#113) 2026-08-08 04:35:19 +01:00
lukaszraczyloandGitHub 4dc7e2fcfb Update go.mod and go.sum (#112) 2026-08-07 05:01:46 +01:00
lukaszraczyloandGitHub 557ebc8410 Update go.mod and go.sum (#111) 2026-08-06 05:05:19 +01:00
lukaszraczyloandGitHub 2c82cd8a7a Update go.mod and go.sum (#110) 2026-08-04 06:51:26 +01:00
lukaszraczyloandGitHub 47cc2900a6 Update go.mod and go.sum (#109) 2026-08-01 06:58:29 +01:00
lukaszraczyloandGitHub c6e7c0d4c8 Update go.mod and go.sum (#108) 2026-07-30 06:45:43 +01:00
lukaszraczyloandGitHub c6ad90f742 Update go.mod and go.sum (#107) 2026-07-29 06:56:36 +01:00
lukaszraczyloandGitHub dfc7d0c917 Update go.mod and go.sum (#106) 2026-07-28 06:51:45 +01:00
lukaszraczyloandGitHub 4442cb3062 Update go.mod and go.sum (#105) 2026-07-27 07:33:24 +01:00
lukaszraczyloandGitHub 3ce6d274d5 Update go.mod and go.sum (#104) 2026-07-25 06:48:25 +01:00
lukaszraczyloandGitHub ce7cb769b3 Update go.mod and go.sum (#103) 2026-07-24 06:54:19 +01:00
lukaszraczyloandGitHub f3a210fd8d Update go.mod and go.sum (#102) 2026-07-23 06:59:04 +01:00
lukaszraczyloandGitHub c7f05c426f Update go.mod and go.sum (#101) 2026-07-22 06:55:12 +01:00
lukaszraczyloandGitHub bd3e8f024c Update go.mod and go.sum (#100) 2026-07-21 06:54:11 +01:00
lukaszraczyloandGitHub c390074f1c Update go.mod and go.sum (#99) 2026-07-17 06:46:38 +01:00
lukaszraczyloandGitHub 43d39bb07a Update go.mod and go.sum (#98) 2026-07-14 06:35:56 +01:00
lukaszraczyloandGitHub a95cd85155 Update go.mod and go.sum (#97) 2026-07-13 07:23:08 +01:00
lukaszraczyloandGitHub d48079e859 Update go.mod and go.sum (#96) 2026-07-11 05:05:30 +01:00
lukaszraczylo 12a629c652 fixup! feat: comprehensive audit + Tier 3 wiring (security/correctness/features) 2026-07-10 09:38:46 +01:00
lukaszraczylo e39d6a0f0d feat: comprehensive audit + Tier 3 wiring (security/correctness/features) 
Multi-agent audit + fix pass covering bugs, security, dead config wiring,
and missing features. All quality gates green: build/vet/test -race/govulncheck/
golangci-lint. Frontend tests 47/47.

SECURITY & CORRECTNESS

- Scanner pipeline fail-closed: cache.go scan timeout now 503 (was goto servePkg);
  scanner.go all-scanners-fail saves ScanStatusError; CheckVulnerabilities blocks
  on missing/error result instead of allowing.
- Scanner argv corrections: govulncheck source-mode + go.mod discovery;
  npm-audit generates lockfile via npm install --package-lock-only --ignore-scripts;
  pip-audit per-extension dispatch (wheel direct / sdist extract+pyproject).
- GHSA version-range filtering implemented (was always-include); url.QueryEscape
  on package name.
- pypi SSRF closed via host allowlist on original_url; url.QueryEscape on
  rewriteURL output.
- Path traversal: cache temp file uses os.CreateTemp; smb keyToPath sanitized;
  filesystem keyToPath returns error + filepath.Abs prefix-verify.
- Goroutine leaks plugged: cache.cleanupWorker stop channel; auth.ValidationCache
  Stop() with sync.Once; ws.unregister buffered with non-blocking send.
- WebSocket double-close panic fixed via sync.Once Client.closeSend().
- Race conditions: gormstore.registryCache sync.RWMutex (was concurrent map
  panic); auth.LastUsedAt no longer mutated under RLock; analytics strict
  lock-ordering invariant (statsMu before downloadsMu).
- Auth validator fails CLOSED on transport/unknown-status errors (was returning
  true,err 'allow cache fallback').
- Credential cache hash full SHA256 (was 8-byte truncate; eliminates 2^32
  collision risk).
- filesystem.fs.used incremented after successful rename (no quota inflation
  race).
- gormstore aggregation events deleted in same tx as insert (no double-counting).
- gormstore.SavePackage uses Updates(map) so zero-value security flags
  (RequiresAuth=false) can be cleared.
- partition_manager validates partition name regex before DROP TABLE.
- vcs/git: version regex validation rejects --option-injection; checkout uses
  --detach -- separator; removed TrimPrefix(repo,'v') that corrupted vault/
  vitess/vim-go.
- WebSocket CheckOrigin allowlist (was return true; CSWSH closed); same-origin
  default + ServerConfig.AllowedOrigins.
- fiber CVE GO-2026-4543 patched (v2.52.10 -> v2.52.12).

FUNCTIONAL FEATURES

- API key DB persistence: APIKeyModel + migration 202604280002, full CRUD,
  async LastUsedAt updates with WaitGroup-tracked goroutines drained on Close.
- Admin bootstrap via GOHOARDER_BOOTSTRAP_ADMIN_KEY env var; idempotent
  (skipped when non-revoked admin already exists).
- Auth middleware factory in pkg/app: RequireAuth, RequireRole, RequirePermission,
  OptionalAuth. Mounted on proxy + read APIs when Auth.Enabled=true.
  DELETE /api/packages/* requires admin role. /health public for k8s probes.
- NFS storage backend: pkg/storage/nfs wraps filesystem with /proc/mounts
  detection (Linux), post-write fsync, read-after-write health probe.
- WebSocket real-time pipeline: pkg/events Broadcaster interface; cache + scanner
  managers emit EventPackageCached / EventPackageDownloaded / EventScanComplete;
  app.go runs 30s EventStatsUpdate ticker. Frontend has full WS client (reconnect
  with exponential backoff 1s->30s, 25s heartbeat, subscriber pattern), Pinia
  realtime store, Dashboard live indicator + activity feed + reactive stats
  override.
- TLS termination: fiber.ListenTLS when Server.TLS.Enabled.
- Pre-warming: Prewarming.Enabled flag wired (was hardcoded false); Interval,
  MaxConcurrent, TopPackages plumbed.
- NetworkConfig wired (timeouts, retry, rate-limit, circuit-breaker).
- AuthConfig.BcryptCost wired.
- Security.Scanners.Static.MaxPackageSize plumbed to cache.io.LimitReader.
- Handlers.{Go,NPM,PyPI}.Enabled gates route mounting.
- Graceful shutdown: authManager.Close drains async writes.

LINT/HYGIENE

- 80 golangci-lint issues resolved: errcheck (Close/Write/RemoveAll wrapped),
  gofmt, gosec G104/G306, govet shadow renames + fieldalignment reorders,
  staticcheck ST1000 pkg comments + QF1003 tagged switches + QF1008 embedded
  field selectors + QF1001 De Morgan's law.

BEHAVIOR CHANGES

- Scanner now fail-closed: deployments without scanner binaries
  (trivy/govulncheck/npm-audit/pip-audit/grype) BLOCK packages instead of
  serving unscanned. Add binaries or plan a future allow-on-scan-error flag.
- WS origin defaults to same-origin; cross-origin dashboards must set
  server.allowed_origins.
- Validator no longer fails open; private packages won't serve from cache when
  validation can't be performed.
- download_events retention dropped from 24h to ~5min (deleted in agg tx).
  Migration 202604280001 purges pre-upgrade events.
- DELETE /api/packages/* requires admin role when auth enabled.

NEW PACKAGES

- pkg/events  - Broadcaster interface
- pkg/storage/nfs  - NFS-aware filesystem wrapper

DEFERRED (out of scope this pass)

- Static scanner implementation (config defines AllowedLicenses/MaxPackageSize/
  BlockSuspicious but pkg/scanner/static/ does not exist).
- AuthConfig.AuditLog wiring (no audit log infra yet).
- CacheConfig.TTLOverrides passthrough (would touch cache.Config beyond
  integrator scope).
 2026-07-10 09:37:55 +01:00
lukaszraczylo 3c8b3eb46c fixup! fix: exclude Go module metadata files from package count stats 2026-07-10 09:35:45 +01:00
lukaszraczylo c8bc8eca8f fix: exclude Go module metadata files from package count stats 
The dashboard was showing 335 packages while the packages page showed 141
because GetStats was counting .mod and .info files as separate packages.

Changes:
- Filter out .mod and .info files in GetStats query
- Now only counts actual packages (.zip files)
- Dashboard and packages page counts will match

This fixes the discrepancy where:
- Dashboard (/api/stats): was 335, now will be ~141
- Packages page (/api/packages): already 141 (deduplicated)

Resolves: "Dashboard showing 335 packages but /packages showing 141"
 2026-07-10 09:35:45 +01:00
lukaszraczylo d5979a8b88 fix: skip scanning Go module metadata files (.mod, .info) 
Go module metadata files (.mod and .info) are not actual packages
and should not be scanned for vulnerabilities. Only .zip files
contain the actual module code.

Changes:
- Added .mod and .info suffix checks to isMetadataEntry filter
- These files are now excluded from database storage
- Scanner won't attempt to scan them during rescan cycles

This fixes OSV scanner 404 errors for metadata files like:
- github.com/mattn/go-isatty/@v/v0.0.20.mod
- github.com/clipperhouse/stringish/@v/v0.1.1.info

Resolves: OSV API errors "The current request is not defined by this API"
for Go module metadata files
 2026-07-10 09:35:45 +01:00
lukaszraczyloandGitHub c38d6bec0d Update go.mod and go.sum (#95) 2026-07-09 05:23:50 +01:00
lukaszraczyloandGitHub 1616a7d42d Update go.mod and go.sum (#94) 2026-07-07 05:25:04 +01:00
lukaszraczyloandGitHub ec21194229 Update go.mod and go.sum (#93) 2026-07-05 05:27:13 +01:00
lukaszraczyloandGitHub 8967d313e0 Update go.mod and go.sum (#92) 2026-07-02 05:30:08 +01:00
lukaszraczyloandGitHub 75eda36638 Update go.mod and go.sum (#91) 2026-07-01 05:38:54 +01:00
lukaszraczyloandGitHub 2a3666ae7c Update go.mod and go.sum (#90) 2026-06-30 05:31:08 +01:00
lukaszraczyloandGitHub ab45e2f511 Update go.mod and go.sum (#89) 2026-06-28 05:37:58 +01:00
lukaszraczyloandGitHub 6b8f8443fb Update go.mod and go.sum (#88) 2026-06-27 05:27:45 +01:00
lukaszraczyloandGitHub e451ec5f1f Update go.mod and go.sum (#87) 2026-06-26 05:32:55 +01:00
lukaszraczyloandGitHub 3898756bf6 Update go.mod and go.sum (#86) 2026-06-24 05:31:06 +01:00
lukaszraczyloandGitHub 3c22e53c2e Update go.mod and go.sum (#85) 2026-06-23 05:30:05 +01:00
lukaszraczyloandGitHub 12a75bf77d Update go.mod and go.sum (#84) 2026-06-22 05:38:46 +01:00
lukaszraczyloandGitHub 1211320939 Update go.mod and go.sum (#83) 2026-06-19 05:39:39 +01:00
lukaszraczyloandGitHub 86f7d974e7 Update go.mod and go.sum (#82) 2026-06-18 05:36:29 +01:00
lukaszraczyloandGitHub f0eaf695ab Update go.mod and go.sum (#81) 2026-06-17 05:37:06 +01:00
lukaszraczyloandGitHub cfceb063ee Update go.mod and go.sum (#80) 2026-06-11 05:36:25 +01:00
lukaszraczyloandGitHub 76b38c5c10 Update go.mod and go.sum (#79) 2026-06-09 05:30:46 +01:00
lukaszraczyloandGitHub ae85e74094 Update go.mod and go.sum (#78) 2026-06-06 05:29:56 +01:00
lukaszraczyloandGitHub e08cab3311 Update go.mod and go.sum (#77) 2026-06-05 05:36:18 +01:00
lukaszraczyloandGitHub c9a124e708 Update go.mod and go.sum (#76) 2026-06-04 05:37:15 +01:00
lukaszraczyloandGitHub 640c54201f Update go.mod and go.sum (#75) 2026-06-03 05:37:50 +01:00
lukaszraczyloandGitHub ba632c4c14 Update go.mod and go.sum (#74) 2026-05-30 05:26:59 +01:00
lukaszraczyloandGitHub bd07e45c05 Update go.mod and go.sum (#73) 2026-05-29 05:34:39 +01:00
lukaszraczyloandGitHub 69ef5a478a Update go.mod and go.sum (#72) 2026-05-28 05:33:24 +01:00
lukaszraczyloandGitHub 2b425d4012 Update go.mod and go.sum (#71) 2026-05-27 05:35:38 +01:00
lukaszraczyloandGitHub 875fd9025a Update go.mod and go.sum (#70) 2026-05-23 05:21:35 +01:00
lukaszraczyloandGitHub 1fc61b1ec3 Update go.mod and go.sum (#69) 2026-05-22 05:30:56 +01:00
lukaszraczyloandGitHub c38209d8d1 Update go.mod and go.sum (#68) 2026-05-09 05:14:14 +01:00
lukaszraczyloandGitHub 4ffb17757c Update go.mod and go.sum (#67) 2026-05-07 05:21:07 +01:00
lukaszraczyloandGitHub 5dcf1cf6b0 Update go.mod and go.sum (#66) 2026-05-05 05:08:46 +01:00