179 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Username	66d7948073	containerfile: consolidate security pins in requirements.txt	2026-01-20 08:20:55 +01:00
Username	677cdff58d	containerfile: upgrade base image pip and jaraco.context	2026-01-20 08:19:41 +01:00
Username	aba81f908e	containerfile: force upgrade pip and jaraco.context post-install	2026-01-20 08:16:49 +01:00
Username	e4b313041e	containerfile: pin pip>=25.3 to fix CVE-2025-8869	2026-01-20 08:12:22 +01:00
Username	9c4c907f75	fpaste: add configurable endpoint prefix ... - Add endpoint config key (FLASKPASTE_ENDPOINT env var) - Add build_url() helper for URL construction - Change default server to https://paste.mymx.me - Support endpoint prefix in config file	2026-01-19 23:58:42 +01:00
Username	0f5742ccc2	containerfile: switch slim image to alpine base ... Debian distroless had 5 critical CVEs (unfixed in Debian 12). Alpine has active security patches and smaller footprint.	2026-01-19 23:58:34 +01:00
Username	54190487c8	kubernetes: use slim distroless image	2026-01-19 23:04:06 +01:00
Username	10c94f29dd	ci: fix vuln count to exclude header line	2026-01-19 22:58:58 +01:00
Username	89b019d7df	ci: fix vuln count parsing in harbor scan	2026-01-19 22:54:42 +01:00
Username	9302939890	ci: fix harbor-ctl scan/vulns command syntax	2026-01-19 22:49:18 +01:00
Username	c81988fc1a	ci: add delay before harbor scan for image indexing	2026-01-19 22:47:02 +01:00
Username	46875fba0c	ci: fresh run	2026-01-19 22:36:09 +01:00
Username	1d90de95ac	ci: retrigger after runner fix	2026-01-19 22:24:45 +01:00
Username	adb3d39d71	ci: retrigger build	2026-01-19 21:56:21 +01:00
Username	5c97d76021	ci: add hypothesis fuzz testing job	2026-01-19 19:54:33 +01:00
Username	a206c9939c	ci: build and push slim image variant	2026-01-19 19:52:57 +01:00
Username	fc7d3df308	add distroless slim container image	2026-01-19 19:52:56 +01:00
Username	756d83e066	api: remove prefix from index response	2026-01-19 19:40:04 +01:00
Username	402df5f535	quadlet: remove /paste prefix for root deployment	2026-01-19 19:38:50 +01:00
Username	af1f53137f	config: serve at paste.mymx.me root instead of /paste prefix ... Migrate from harbor.mymx.me/paste to dedicated paste.mymx.me host.	2026-01-18 20:27:12 +01:00
Username	48094c0bee	ci: add Harbor vulnerability scan after image push	2026-01-18 17:23:19 +01:00
Username	e0310339ee	docs: update for k3s deployment and harbor.mymx.me	2026-01-18 17:07:49 +01:00
Username	435661ae38	kubernetes: update harbor url and health probe paths ... - use harbor.mymx.me instead of old internal IP - fix liveness/readiness probes to use /health endpoint	2026-01-18 16:54:59 +01:00
Username	ee0e1211a6	containerfile: remove vendored jaraco.context dist-info ... setuptools vendors jaraco.context 5.3.0 internally; Trivy detects this even with 6.1.0 installed separately. Remove the vendored dist-info to silence the false positive.	2026-01-18 16:29:41 +01:00
Username	278ad73778	containerfile: fix jaraco.context CVE and consolidate ... - explicitly install jaraco.context>=6.1.0 in runtime stage to override vendored copy in setuptools (GHSA-58pv-8j8x-9vj2) - remove redundant installs from builder (requirements.txt already pins setuptools>=80.0 and jaraco.context>=6.1.0) - consolidate runtime pip install into single command - remove redundant comments	2026-01-18 12:09:53 +01:00
Username	cc1bba9a57	container: upgrade system setuptools to fix jaraco.context CVE	2026-01-18 11:12:17 +01:00
Username	6c0e2ab07f	container: use apt instead of apt-get	2026-01-18 10:46:47 +01:00
Username	ba0e591dda	container: clean apt caches and upgrade setuptools for CVE fix	2026-01-18 10:44:24 +01:00
Username	eb60193348	ci: use Containerfile for image build	2026-01-18 10:30:26 +01:00
Username	80edae3e63	ci: run build-push on host instead of container	2026-01-18 10:26:13 +01:00
Username	195752fe75	ci: fix test file references and hardcoded paths ... - Remove non-existent test_mime_detection.py from unit tests - Use relative paths in security tests for container compatibility	2026-01-18 10:23:31 +01:00
Username	3be2fd6cf6	tests: fix mypy type errors in security tests	2026-01-18 10:18:09 +01:00
Username	97bf955820	tests: fix ruff lint errors in security tests	2026-01-18 10:04:27 +01:00
Username	661dab4a81	ci: add container image build and push to harbor	2026-01-18 09:57:32 +01:00
Username	9eee14e918	docs: update harbor integration status and remove hardcoded credentials	2026-01-18 09:57:27 +01:00
Username	0fc45587cd	deps: pin transitive dependencies for security fixes ... - urllib3>=2.6.3 (CVE-2025-43859) - jaraco.context>=6.1.0 (GHSA-58pv-8j8x-9vj2) - setuptools>=80.0 (vendored jaraco.context) reduces High vulnerabilities from 6 to 3	2026-01-18 09:16:08 +01:00
Username	a736bce346	docs: add kubernetes deployment guide	2026-01-17 16:27:56 +01:00
Username	7812af2e47	docs: add harbor registry guide	2026-01-17 16:27:51 +01:00
Username	9b1cddd7f1	kubernetes: use NodePort for external access ... - change service type from ClusterIP to NodePort (30500) - enables HAProxy routing from mymx to k8s cluster	2026-01-17 16:27:44 +01:00
Username	f6a69b0b55	add Kubernetes deployment manifest	2026-01-17 13:59:01 +01:00
Username	b9f0283a3b	add Podman Quadlet deployment ... - flaskpaste.container for rootless systemd integration - UserNS mapping for bind mount permissions - README updated with deployment instructions	2026-01-17 13:58:52 +01:00
Username	379178e409	exempt /health from rate limiting ... Health check endpoint was being rate-limited (60/hour), causing container health checks (every 30s = 120/hour) to fail with 429. Uses flask-limiter's request_filter to bypass rate limiting for the health endpoint, supporting URL_PREFIX configuration.	2026-01-08 20:12:03 +01:00
Username	6da80aec76	docs: update for simplified MIME detection (v1.5.1)	2025-12-26 19:52:40 +01:00
Username	a7f1c09634	bump version to 1.5.1	2025-12-26 19:15:20 +01:00
Username	28e31f0b37	remove obsolete MIME detection tests	2025-12-26 19:06:35 +01:00
Username	bc751d1b8c	validate MIN_ENTROPY config bounds [0, 8]	2025-12-26 18:47:06 +01:00
Username	3cda73c8b0	simplify MIME detection to text/binary only ... Remove magic byte detection in favor of simple UTF-8 validation: - text/plain for valid UTF-8 content - application/octet-stream for binary data Security maintained via headers (X-Content-Type-Options: nosniff, CSP). Magic signatures preserved as comments for future reference. Disabled test files: - test_mime_detection.py.disabled (magic-dependent tests) - test_polyglot.py.disabled (polyglot format tests) For full MIME detection, consider using the `filetype` library.	2025-12-26 18:44:24 +01:00
Username	fb45005766	add polyglot generator and MIME confusion tests ... - polyglot_generator.py: creates files valid in multiple formats - 41 new tests verify MIME detection handles polyglots correctly - Document rate limiting behavior under attack - Clarify DMG/ISO/DOCX detection limitations	2025-12-26 18:25:46 +01:00
Username	98694ba1cc	docs: add comprehensive threat model ... STRIDE analysis covering: - System architecture and trust boundaries - Attack surface analysis (10 entry points) - Threat actors (anonymous, authenticated, operator, sophisticated) - 20+ threats with mitigations across STRIDE categories - Security controls matrix - MIME polyglot attack mitigations - Cryptographic controls - Residual risks and known limitations - Incident response guidance	2025-12-26 17:10:41 +01:00
Username	dc2da67fb3	add Hypothesis property-based MIME detection tests ... - test_magic_prefix_detection: verify all signatures with random suffix - test_random_binary_never_crashes: random data never crashes - test_partial_magic_no_false_match: truncated magic handled safely - test_magic_not_at_start_ignored: only detect magic at offset 0	2025-12-26 17:09:02 +01:00