admin f24233c829 fix(R-1187 b): refuse a link whose parent path passes through a link; born keys listed; psql --set ...

Second automated security review finding, red-proved. The go-parity and docker -v gates that refused the push are green.

2026-10-26 20:30:34 +01:00

..

app_row_dedup_gate.py

decoy sweep: eight holes in this repo's gates, all measured, all fixed (R-421)

2026-09-01 12:39:17 +02:00

build-samba-image.sh

Debian 13 runtime with restic 0.18.1 pinned outside the OS; restic assumptions re-proven; felhom-samba 1.2.0 (R-1105, R-972)

2026-10-16 20:33:57 +02:00

check-infra-pins.py

v0.291.0: decision 78 (R-726) — a returning household's first night sets the orphaned copy aside; R-838 — traefik v3.7.13, cloudflared 2026.9.3, filebrowser 1.5.6-stable, a release now moves a running file browser, check-infra-pins.py

2026-10-04 10:56:19 +02:00

controller_gates.py

security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

2026-10-19 21:11:31 +02:00

debug_route_gate.py

decoy sweep: eight holes in this repo's gates, all measured, all fixed (R-421)

2026-09-01 12:39:17 +02:00

docker_run_volume_path_gate.py

R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased

2026-10-22 17:47:19 +02:00

emoji_gate.py

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

gofmt_gate.py

gofmt gate: NOT CHECKED (out loud) on the Go-less CI runner, INCONCLUSIVE elsewhere; decoys for both (CI run 1371 was red)

2026-10-05 20:15:54 +02:00

golden_notice.py

v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

2026-10-17 09:36:34 +02:00

hashpass.go

restructured files, and updated for build outside

2026-02-13 19:10:35 +01:00

i18n_bundle.py

v0.247.0: i18n spike — the dashboard can speak English, Hungarian byte-identical

2026-09-17 14:50:57 +02:00

i18n_extract.py

v0.249.0: i18n slice 1 release B — backup pages in English, Hungarian byte-identical (R-556)

2026-09-17 18:01:09 +02:00

i18n_go_base.json

v0.252.0 — the sentences the program builds follow the language (R-557 slice 2 release A)

2026-09-18 10:15:56 +02:00

i18n_go_keys.json

fix(R-1187 b): refuse a link whose parent path passes through a link; born keys listed; psql --set

2026-10-26 20:30:34 +01:00

i18n_go_parity.py

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

i18n_missing_gate.py

R-516: the formal forms the gate did not count are in the te-form; the gate's stems widened

2026-10-06 02:37:34 +02:00

minagent_header_gate.py

gates: the newest release header must state its MinAgent; backfill v0.233.0-v0.236.0 (R-470, R-472)

2026-09-13 17:09:33 +02:00

mojibake_gate.py

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

native_confirm_gate.py

v0.308.0 (R-554, held-back-able): recovery-info.txt points at the dashboard's Restore page and the recovery code; the first-boot setup wizard is deleted

2026-10-12 15:38:28 +02:00

offbox_rename_gate.py

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

retrieval_promise_gate.py

v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

2026-10-17 09:36:34 +02:00

secret_in_markup_gate.py

v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00

shared_scripts.py

v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

2026-10-17 09:36:34 +02:00

template_id_gate.py

v0.315.0: one app page with four tabs; the guide the catalog can carry; no Raspberry Pi badge

2026-10-15 18:37:50 +02:00

test_build_push_once.sh

v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

2026-10-17 23:11:56 +02:00

test_controller_gates.py

The decoy suite is a gate of the full run (R-1116); no code change

2026-10-17 11:01:40 +02:00

test_debug_route_gate.py

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

test_gate_decoys.py

security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

2026-10-19 21:11:31 +02:00

test_golden_notice.py

R-404: the golden NOTICE, in the repo where the debt is created - NOT A RELEASE

2026-09-01 12:01:26 +02:00

test_minagent_header_gate.py

gates: the newest release header must state its MinAgent; backfill v0.233.0-v0.236.0 (R-470, R-472)

2026-09-13 17:09:33 +02:00

test_samba_build_push_once.sh

Debian 13 runtime with restic 0.18.1 pinned outside the OS; restic assumptions re-proven; felhom-samba 1.2.0 (R-1105, R-972)

2026-10-16 20:33:57 +02:00

test_shared_scripts.py

v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

2026-10-17 09:36:34 +02:00