Prepare hashavatar-api 1.0.0

Author: eldryoth

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.13.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -11,16 +11,16 @@ documentation = "https://github.com/valkyoth/hashavatar-api"
 
 [dependencies]
 aws-config = { version = "1.8.16", default-features = false, features = ["rt-tokio"] }
-aws-sdk-s3 = { version = "1.131.0", default-features = false, features = ["rt-tokio", "sigv4a"] }
-hashavatar = "0.13.0"
+aws-sdk-s3 = { version = "1.132.0", default-features = false, features = ["rt-tokio", "sigv4a"] }
+hashavatar = "1.0.0"
 image = { version = "0.25.10", default-features = false, features = ["png"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
 getrandom = { version = "0.4.2", default-features = false }
 ipnet = { version = "2.12.0", default-features = false }
-lru = { version = "0.16.4", default-features = false }
+lru = { version = "0.18.0", default-features = false }
 serde = { version = "1.0.228", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["std"] }
 sha2 = { version = "0.11.0", default-features = false, features = ["alloc"] }
-tokio = { version = "1.52.1", default-features = false, features = ["macros", "rt-multi-thread", "net"] }
+tokio = { version = "1.52.3", default-features = false, features = ["macros", "rt-multi-thread", "net"] }
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.13.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -10,14 +10,14 @@ homepage = "https://github.com/valkyoth/hashavatar-api"
 documentation = "https://github.com/valkyoth/hashavatar-api"
 
 [dependencies]
-hashavatar = "0.13.0"
+hashavatar = "1.0.0"
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
 getrandom = { version = "0.4.2", default-features = false }
 ipnet = { version = "2.12.0", default-features = false }
-lru = { version = "0.16.4", default-features = false }
+lru = { version = "0.18.0", default-features = false }
 serde = { version = "1.0.228", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["std"] }
 sha2 = { version = "0.11.0", default-features = false, features = ["alloc"] }
-tokio = { version = "1.52.1", default-features = false, features = ["macros", "rt-multi-thread", "net"] }
+tokio = { version = "1.52.3", default-features = false, features = ["macros", "rt-multi-thread", "net"] }
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"

Cargo.toml.split-template

@@ -11,7 +11,7 @@ audit, SBOM, reproducibility, smoke, and GitHub CodeQL default setup checks.
 
 ## Current Status
 
-The current service version is `0.13.0`.
+The current service version is `1.0.0`.
 
 Implemented now:
 
@@ -25,7 +25,7 @@ Implemented now:
 - Namespace-aware tenant and style-version parameters.
 - SHA-512 identity hashing.
 - WebP avatar responses.
-- Avatar families from `hashavatar 0.13.0`: `cat`, `dog`, `robot`, `fox`,
+- Avatar families from `hashavatar 1.0.0`: `cat`, `dog`, `robot`, `fox`,
   `alien`, `monster`, `ghost`, `slime`, `bird`, `wizard`, `skull`, `paws`,
   `planet`, `rocket`, `mushroom`, `cactus`, `frog`, `panda`, `cupcake`,
   `pizza`, `icecream`, `octopus`, `knight`, `bear`, `penguin`, `dragon`,
@@ -57,7 +57,7 @@ Intentionally external:
 | Area | Status |
 | --- | --- |
 | Service license | `EUPL-1.2` |
-| Renderer crate | `hashavatar 0.13.0` |
+| Renderer crate | `hashavatar 1.0.0` |
 | MSRV | Rust `1.95.0` |
 | Runtime container | Wolfi |
 | HTTP framework | `axum` |
@@ -98,7 +98,7 @@ Important query parameters:
 | `shape` | `square` | Avatar crop shape: `square`, `circle`, `squircle`, `hexagon`, or `octagon`. |
 | `format` | `webp` | Output format. Only `webp` is supported for avatar responses. |
 | `size` | `256` | Square image size in pixels. |
-| `persist` | `false` | Store through configured S3-compatible backend when enabled. |
+| `persist` | `false` | Store through configured S3-compatible backend when enabled; uses the stricter storage rate limit. |
 
 ### Path Avatar
 
@@ -117,8 +117,9 @@ GET /v1/avatar/link?id=robot@hashavatar.app&kind=robot&background=white&accessor
 ```
 
 This endpoint requires object storage configuration. It renders and stores the
-avatar when needed, then returns object metadata and a signed URL. Standard
-avatar responses do not expose signed-link metadata in response headers.
+avatar when needed, then returns object metadata, a signed URL, and a hashed
+cache key. Standard avatar responses do not expose signed-link metadata in
+response headers.
 
 ## Limits
 
@@ -130,7 +131,7 @@ avatar responses do not expose signed-link metadata in response headers.
 | Maximum namespace tenant | `64` ASCII path-safe bytes |
 | Maximum namespace style version | `64` ASCII path-safe bytes |
 | Maximum renderer identity input | `1024` bytes |
-| Rate-limit buckets | `16,384` |
+| Rate-limit buckets | `65,536` |
 | Avatar render timeout | `3s` |
 | Storage operation timeout | `5s` |
 

README.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes are expected for the latest published `0.13.x` release.
+Security fixes are expected for the latest published `1.0.x` release.
 
 ## Reporting a Vulnerability
 

SECURITY.md

@@ -15,6 +15,10 @@ sets `HASHAVATAR_TRUSTED_PROXIES=10.89.42.0/24` and pins the private network to
 that subnet so the app only honors `X-Forwarded-For` style headers from the
 Fluxheim network. Do not expose the app container port directly to the internet.
 
+The app container is hardened for the expected runtime shape: read-only root
+filesystem, no new privileges, all Linux capabilities dropped, and a small
+`/tmp` tmpfs for temporary runtime files.
+
 ## Files
 
 - `podman-compose.yml`: starts the app and Fluxheim gateway.

deploy/README.md

@@ -11,6 +11,13 @@ services:
       PORT: "8080"
       PUBLIC_WEBSITE_HOST: "0.0.0.0"
       HASHAVATAR_TRUSTED_PROXIES: "10.89.42.0/24"
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    tmpfs:
+      - /tmp:size=64m,mode=1777
     restart: unless-stopped
     networks:
       - hashavatar
@@ -21,6 +28,8 @@ services:
     restart: unless-stopped
     stop_signal: SIGTERM
     stop_grace_period: 15s
+    security_opt:
+      - no-new-privileges:true
     depends_on:
       - hashavatar
     ports:

deploy/podman-compose.yml

@@ -7,12 +7,12 @@ local test and release gates.
 
 | Risk | Control |
 | --- | --- |
-| Unbounded or expensive rate-limit state | The rate limiter uses bounded `LruCache` storage for O(1) LRU updates, 65,536 buckets, and regression tests for unique attacker keys. Avatar generation routes, including `/og.png`, pass through origin-side rate limits. |
+| Unbounded or expensive rate-limit state | The rate limiter uses bounded `LruCache` storage for O(1) LRU updates, 65,536 buckets, and regression tests for unique attacker keys. CPU-bound avatar and Open Graph rendering run through `spawn_blocking` with timeouts, and all avatar generation routes pass through origin-side rate limits. |
 | Forwarded-header spoofing | `X-Forwarded-For`, `X-Real-IP`, and `CF-Connecting-IP` are honored only when the direct peer is a configured trusted proxy; `X-Forwarded-For` chains are resolved from the rightmost untrusted address. |
 | Verbose internal errors | Internal errors are logged with `tracing`; clients receive a generic static 500 body. |
-| Browser-side content confusion | Responses receive CSP, `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, `Cross-Origin-Resource-Policy`, and HTML-only `Cross-Origin-Opener-Policy` and `Strict-Transport-Security` headers. |
+| Browser-side content confusion | Responses receive CSP, `Strict-Transport-Security`, `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Cross-Origin-Resource-Policy`; HTML responses also receive `Cross-Origin-Opener-Policy`. |
 | Operational intelligence disclosure | `/metrics` is loopback-only and returns `404` to non-local peers; `/healthz` remains public for load balancers and uptime checks but only returns liveness status. |
-| Object-storage metadata disclosure | Standard avatar responses do not expose presigned URLs or object keys in headers. `/v1/avatar/link` is the explicit JSON endpoint for signed-link metadata. |
+| Object-storage metadata disclosure | Standard avatar responses do not expose presigned URLs or object keys in headers. `/v1/avatar/link` is the explicit JSON endpoint for signed-link metadata and returns a hashed cache key rather than the raw identity-bearing cache key. Direct avatar requests with `persist=true` use the same stricter storage rate limit as signed-link requests. |
 | S3 prefix escaping | Tenant and style-version namespaces are limited to ASCII letters, digits, hyphens, and underscores before object keys are built. |
 | Oversized avatar namespace or identity input | The service caps identities at 512 bytes and namespace components at 64 bytes before rendering. |
 | Reflected error content | Client-facing `400` responses use static validation messages for parser and renderer errors instead of forwarding raw library error strings. |