From a4597cd005d74593946378b4e21ec7d42840b216 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 1 Oct 2026 10:18:17 +0200 Subject: [PATCH] =?UTF-8?q?mealie:=20lockout=201=20hour=20instead=20of=202?= =?UTF-8?q?4=20(R-747,=2009=20decision=2057=20=E2=80=94=20decided=20by=20C?= =?UTF-8?q?C=20unattended,=20operator=20may=20reverse)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mealie locks the ACCOUNT after 5 wrong logins and its login names (admin, changeme@example.com) are public, so a stranger could lock the household out for a day. Measured on 9202 with SECURITY_USER_LOCKOUT_TIME=1: the right password answered 423 for 120 min (the hourly job lifts it after the hour), then 200; a wrong one still 401. Evidence: felhom.eu/documentation/audits/rulings-2026-10-01/C/. CHANGELOG also records today's re-test run and fixes. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 16 ++++++++++++++++ templates/mealie/docker-compose.yml | 5 +++++ 2 files changed, 21 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7eb6de..81674ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,19 @@ +## The first full monthly re-test (decision 55); the digest resolver, the outline fixture, the re-test's start (2026-10-01) + +- **The monthly re-test now covers every app with a proven ladder** (`09` §3 decisions 54, 55; R-743). First full run: + **nextcloud** `34.0.4-apache` `3b59dfb` and linuxserver **sonarr** `4.0.20` `1a37032` re-tested at the registry's new + digests on both venues (bench 9401 swap 0 with the 10-minute watch; 9202 through the guarded Update) and written as + re-test entries. ~17 min per app. Evidence `felhom.eu/documentation/audits/retest-2026-10/`. +- **`retest-floating.py` could not start on a fresh bench** `9e53205` (R-749): it asked for `/opt/upg/upgrade-test.py` + before the step that copies it there. It now asks for docker + python3, and for the file after the sync. +- **`image_digest.resolve` honours a `@digest`** `804884a` (R-746): it asks the registry for that manifest; a digest + the registry no longer serves is refused (it answered the tag's current digest). `scripts/test_image_digest.py`. +- **mealie: a stranger's wrong passwords lock the household out for 1-2 hours, not a day** (R-747; `09` §3 decision 57, + decided by CC unattended — operator may reverse): `SECURITY_USER_LOCKOUT_TIME=1`. mealie locks the ACCOUNT after 5 + wrong logins and its login names are public. Measured on 9202: 5 wrong → 423 for the right password too; open again + after 120 min (the hourly job); a wrong password still refused after. Other apps with the same shape: R-752. +- **outline's fixture reads Outline 1.10's `__Host-csrfToken`** `9fc7052` (R-744): proven on 9202 at 1.10.1. + ## Same-tag security fixes as tested steps (decision 52); wger's app login; wanderer on the bench (2026-09-30, late) - **Re-tests (`09` §3 decision 52, R-740)** `6a3ead9`: a ladder entry whose `from` equals its `to`, carrying `digest_from` diff --git a/templates/mealie/docker-compose.yml b/templates/mealie/docker-compose.yml index 27169fa..1303943 100644 --- a/templates/mealie/docker-compose.yml +++ b/templates/mealie/docker-compose.yml @@ -20,6 +20,11 @@ services: restart: unless-stopped environment: - ALLOW_SIGNUP=false + # R-747 (decided by CC unattended 2026-10-01, `09` §3 decision 57 — operator may reverse): mealie locks the ACCOUNT + # after 5 wrong logins for SECURITY_USER_LOCKOUT_TIME hours (default 24), and its login names (admin, + # changeme@example.com) are public — a stranger could lock the household out for a day. 1 hour (the unit's + # minimum) keeps the guard; mealie's hourly job lifts it, so a lock lasts 1-2 h (measured on 9202: 120 min). + - SECURITY_USER_LOCKOUT_TIME=1 - PUID=1000 - PGID=1000 - TZ=Europe/Budapest