Repository navigation
fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 - #201
Merged
Merged
Conversation
…bfossil v0.11.0 go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly. - agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials. The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
edgesync-docs | ec47691 | Commit Preview URL Branch Preview URL |
Oct 11 2026, 01:44 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
agent.Config.NobodyCapsand the leaf flag-nobody-caps/LEAF_NOBODY_CAPS, so leaves that accept peer pushes without credentials can grant them explicitly. The hub's existingNobodyCaps(defaultgio) is unchanged.gio.Deployment note
Existing repositories keep their stored capabilities. A leaf whose repository was created by an earlier go-libfossil still has the old
cghijknorswydefault. Set-nobody-capsto what that leaf actually needs, e.g.gjorzfor read-only orgioto accept peer pushes, to tighten it.New leaves refuse unauthenticated pushes by default. A newly created leaf repository refuses pushes from peers syncing without credentials unless
-nobody-caps giois set.Test plan
go vet, andgo test ./...in the root,leafandbridgemodules, including the iroh and sim tests with the sidecar on PATH.make build,make vet.