Files

Username f640ec85b5 docs: sync ROADMAP and add compression design note

- Update test count: 301 → 337
- Fix CLI commands: pki revoke doesn't exist, use pki download
- Add compression URL marker requirement to TODO ideas

2025-12-25 19:30:09 +01:00

TODO

Unstructured intake buffer for ideas, issues, and observations. Items here are raw and unrefined. Actionable items should be promoted to TASKLIST.md.

Ideas

Paste compression for large text content
- Must mark compression in URL fragment (e.g., #z:<key> or #<key>:z)
- Receiver needs to know content is compressed before decryption
ETag support for conditional requests
Neovim/Vim plugin for editor integration
Webhook notifications for paste events
Certificate renewal reminder in CLI
Admin endpoint for CA key rotation
Clipboard integration (pbcopy/xclip)

Shell completions already implemented (fpaste completion --shell bash/zsh/fish)
Mypy type errors fixed: now enforced in CI (was informational)
CI enhanced: security-tests job, SBOM generation (CycloneDX), memory leak checks
Comprehensive pentest plan completed (PENTEST_PLAN.md) - all remediations implemented
PKI uses AES-256-GCM for CA private key encryption (PBKDF2 key derivation)
SHA1 fingerprints are X.509 standard, not security-relevant (usedforsecurity=False)
Revoked certificates are soft-deleted (status tracked, not removed)
CI pipeline: lint runs parallel with security, tests wait for lint
Ruff replaces flake8/isort/pyupgrade with single fast tool
Bandit configured for medium+ severity only (-ll flag)
PKI audit events now logged: CERT_ISSUED, CERT_REVOKED, AUTH_FAILURE
Request duration metrics recorded via Prometheus histogram
Memory leak tests use tracemalloc to detect leaks (CI job)
Rate limit headers (X-RateLimit-*) on both 201 and 429 responses
systemd service unit with security hardening in examples/

Consider adding python-magic for better MIME detection (currently magic bytes only)
cryptography package required for PKI features (optional otherwise)

Review weekly. Promote actionable items to TASKLIST.md. Archive or delete stale items.