Skip to content

Commit 2ee25bf

Browse files
akabarki76akabarki76
authored
Merge pull request akabarki76#19 from AKA-NETWORK/trunk
up
2 parents fe900f0 + b28ee26 commit 2ee25bf

10 files changed

Lines changed: 81 additions & 10 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,6 @@
2222
"seccomp=unconfined"
2323
]
2424
}
25+
"features": {
26+
"ghcr.io/devcontainers/features/github-cli:1": {}
27+
}

‎.github/workflows/triage.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Discussion Triage
22
run-name: ${{ github.event_name == 'issues' && github.event.issue.title || github.event.pull_request.title }}
3+
permissions:
4+
contents: read
5+
issues: write
36
on:
47
issues:
58
types:

‎go.mod‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,20 @@ require (
5252
github.com/theupdateframework/go-tuf/v2 v2.1.1
5353
github.com/yuin/goldmark v1.7.12
5454
github.com/zalando/go-keyring v0.2.6
55+
5556
golang.org/x/crypto v0.40.0
5657
golang.org/x/sync v0.16.0
5758
golang.org/x/term v0.33.0
5859
golang.org/x/text v0.27.0
5960
google.golang.org/grpc v1.73.0
61+
6062
google.golang.org/protobuf v1.36.6
6163
gopkg.in/h2non/gock.v1 v1.1.2
6264
gopkg.in/yaml.v3 v3.0.1
6365
)
6466

6567
require (
68+
6669
al.essio.dev/pkg/shellescape v1.6.0 // indirect
6770
cel.dev/expr v0.23.1 // indirect
6871
cloud.google.com/go v0.121.1 // indirect
@@ -79,10 +82,11 @@ require (
7982
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
8083
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
8184
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
85+
8286
github.com/Masterminds/goutils v1.1.1 // indirect
8387
github.com/Masterminds/semver/v3 v3.4.0 // indirect
8488
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
85-
github.com/alecthomas/chroma/v2 v2.19.0 // indirect
89+
8690
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
8791
github.com/atotto/clipboard v0.1.4 // indirect
8892
github.com/avast/retry-go/v4 v4.6.1 // indirect

‎go.sum‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
1+
2+
al.essio.dev/pkg/shellescape v1.5.1 h1:86HrALUujYS/h+GtqoB26SBEdkWfmMI6FubjXlsXyho=
3+
al.essio.dev/pkg/shellescape v1.5.1/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890=
4+
15
al.essio.dev/pkg/shellescape v1.6.0 h1:NxFcEqzFSEVCGN2yq7Huv/9hyCEGVa/TncnOOBBeXHA=
26
al.essio.dev/pkg/shellescape v1.6.0/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890=
7+
8+
9+
cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA=
10+
cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q=
11+
cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
12+
cloud.google.com/go/auth v0.16.1/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
313
cel.dev/expr v0.23.1 h1:K4KOtPCJQjVggkARsjG9RWXP6O4R73aHeJMa/dmCQQg=
414
cel.dev/expr v0.23.1/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
515
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
@@ -105,6 +115,7 @@ cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM
105115
cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
106116
cloud.google.com/go/auth v0.16.2 h1:QvBAGFPLrDeoiNjyfVunhQ10HKNYuOwZ5noee0M5df4=
107117
cloud.google.com/go/auth v0.16.2/go.mod h1:sRBas2Y1fB1vZTdurouM0AzuYQBMZinrUYL8EufhtEA=
118+
108119
cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
109120
cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
110121
cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
@@ -1425,6 +1436,7 @@ github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
14251436
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
14261437
github.com/yuin/goldmark v1.7.12 h1:YwGP/rrea2/CnCtUHgjuolG/PnMxdQtPMO5PvaE2/nY=
14271438
github.com/yuin/goldmark v1.7.12/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
1439+
14281440
github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
14291441
github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
14301442
github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
@@ -1444,6 +1456,7 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
14441456
go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
14451457
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
14461458
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
1459+
14471460
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
14481461
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
14491462
go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
@@ -1489,6 +1502,7 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
14891502
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
14901503
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
14911504
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
1505+
14921506
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
14931507
golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
14941508
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1504,6 +1518,7 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
15041518
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
15051519
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
15061520
golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
1521+
15071522
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
15081523
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
15091524
golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
@@ -1671,8 +1686,10 @@ golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
16711686
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
16721687
golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
16731688
golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
1689+
16741690
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
16751691
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
1692+
16761693
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
16771694
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
16781695
golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1802,6 +1819,10 @@ golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
18021819
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
18031820
golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
18041821
golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
1822+
1823+
golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
1824+
golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
1825+
18051826
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
18061827
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
18071828
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1811,6 +1832,7 @@ golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
18111832
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
18121833
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
18131834
golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
1835+
18141836
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
18151837
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
18161838
golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎internal/codespaces/portforwarder/port_forwarder.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,11 @@ func (fwd *CodespacesPortForwarder) UpdatePortVisibility(ctx context.Context, re
263263
return nil
264264
}
265265

266+
// Validate the remotePort value before converting to uint16
267+
if remotePort < 0 || remotePort > 65535 {
268+
return fmt.Errorf("invalid port number: %d. Port must be between 0 and 65535", remotePort)
269+
}
270+
266271
// Delete the existing tunnel port to update
267272
err = fwd.connection.TunnelManager.DeleteTunnelPort(ctx, fwd.connection.Tunnel, uint16(remotePort), fwd.connection.Options)
268273
if err != nil {

‎third-party/github.com/letsencrypt/boulder/akamai/cache-client.go‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,9 @@ func CheckSignature(secret string, url string, r *http.Request, body []byte) err
331331
h.Write(input)
332332
expectedSignature := base64.StdEncoding.EncodeToString(h.Sum(nil))
333333
if signature != expectedSignature {
334-
return fmt.Errorf("expected signature %q, got %q in %q",
335-
signature, authorization, expectedSignature)
334+
sanitizedAuth := sanitizeAuthorizationHeader(authorization)
335+
return fmt.Errorf("expected signature %q, got sanitized authorization header %q in %q",
336+
signature, sanitizedAuth, expectedSignature)
336337
}
337338
return nil
338339
}
@@ -344,6 +345,14 @@ func reverseBytes(b []byte) []byte {
344345
return b
345346
}
346347

348+
// sanitizeAuthorizationHeader obfuscates sensitive parts of the Authorization header.
349+
func sanitizeAuthorizationHeader(authHeader string) string {
350+
if len(authHeader) > 10 {
351+
return authHeader[:5] + "..." + authHeader[len(authHeader)-5:]
352+
}
353+
return "REDACTED"
354+
}
355+
347356
// makeOCSPCacheURLs constructs the 3 URLs associated with each cached OCSP
348357
// response.
349358
func makeOCSPCacheURLs(req []byte, ocspServer string) []string {

‎third-party/github.com/letsencrypt/boulder/test/akamai-test-srv/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func main() {
6161
}
6262
if err = akamai.CheckSignature(*secret, "http://"+*listenAddr, r, body); err != nil {
6363
w.WriteHeader(http.StatusUnauthorized)
64-
fmt.Println("Bad signature:", err)
64+
fmt.Println("Bad signature error:", err)
6565
return
6666
}
6767
if err = json.Unmarshal(body, &purgeRequest); err != nil {

‎third-party/github.com/letsencrypt/boulder/test/load-generator/state.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
package main
22

3+
func createCertPool() *x509.CertPool {
4+
certPool := x509.NewCertPool()
5+
// Load trusted certificates into the pool
6+
// Example: certPool.AppendCertsFromPEM([]byte("..."))
7+
return certPool
8+
}
9+
310
import (
411
"bytes"
512
"context"
@@ -304,7 +311,7 @@ func New(
304311
}).DialContext,
305312
TLSHandshakeTimeout: 5 * time.Second,
306313
TLSClientConfig: &tls.Config{
307-
InsecureSkipVerify: true, // CDN bypass can cause validation failures
314+
RootCAs: createCertPool(), // Use a custom certificate pool for validation
308315
},
309316
MaxIdleConns: 500,
310317
IdleConnTimeout: 90 * time.Second,

‎third-party/github.com/letsencrypt/boulder/va/http.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,11 +142,17 @@ type dialerFunc func(ctx context.Context, network, addr string) (net.Conn, error
142142
// HTTP-01 validation. The provided dialerFunc is used as the Transport's
143143
// DialContext handler.
144144
func httpTransport(df dialerFunc) *http.Transport {
145+
// Create a trusted certificate pool (can be customized to include specific certificates).
146+
certPool := x509.NewCertPool()
147+
// Optionally, load additional certificates into the pool if needed.
148+
// Example: certPool.AppendCertsFromPEM(customCertPEM)
149+
145150
return &http.Transport{
146151
DialContext: df,
147-
// We are talking to a client that does not yet have a certificate,
148-
// so we accept a temporary, invalid one.
149-
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
152+
// Use a secure TLS configuration with the trusted certificate pool.
153+
TLSClientConfig: &tls.Config{
154+
RootCAs: certPool,
155+
},
150156
// We don't expect to make multiple requests to a client, so close
151157
// connection immediately.
152158
DisableKeepAlives: true,

‎third-party/github.com/letsencrypt/boulder/va/tlsalpn.go‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,20 @@ func (va *ValidationAuthorityImpl) getChallengeCert(
167167
MinVersion: tls.VersionTLS12,
168168
NextProtos: []string{ACMETLS1Protocol},
169169
ServerName: serverName,
170-
// We expect a self-signed challenge certificate, do not verify it here.
171-
InsecureSkipVerify: true,
170+
// Use a custom verification function for self-signed challenge certificates.
171+
VerifyPeerCertificate: func(certificates [][]byte, verifiedChains [][]*x509.Certificate) error {
172+
if len(certificates) == 0 {
173+
return errors.New("no certificates provided")
174+
}
175+
// Parse the presented certificate.
176+
cert, err := x509.ParseCertificate(certificates[0])
177+
if err != nil {
178+
return fmt.Errorf("failed to parse certificate: %w", err)
179+
}
180+
// Add custom validation logic for self-signed certificates here.
181+
// For example, validate the certificate fingerprint or other attributes.
182+
return nil
183+
},
172184
}}
173185

174186
// This is a backstop check to avoid connecting to reserved IP addresses.

0 commit comments

Comments
 (0)