Harden API before 0.8.0 release

Author: eldryoth

.github/workflows/images.yml

@@ -0,0 +1,93 @@
+name: Container Images
+
+on:
+  workflow_dispatch:
+    inputs:
+      platforms:
+        description: OCI platforms to build.
+        required: true
+        default: linux/amd64
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  wolfi:
+    name: Build and publish Wolfi image
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare tags
+        id: tags
+        shell: bash
+        run: |
+          set -euo pipefail
+          short_sha="${GITHUB_SHA::12}"
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            version="${GITHUB_REF_NAME}"
+          else
+            version="dev"
+          fi
+
+          tags=(
+            "ghcr.io/${GITHUB_REPOSITORY}:${version}"
+            "ghcr.io/${GITHUB_REPOSITORY}:${version}-wolfi"
+            "ghcr.io/${GITHUB_REPOSITORY}:sha-${short_sha}-wolfi"
+          )
+
+          if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
+            tags+=(
+              "ghcr.io/${GITHUB_REPOSITORY}:latest"
+              "ghcr.io/${GITHUB_REPOSITORY}:latest-wolfi"
+            )
+          fi
+
+          {
+            echo "tags<<EOF"
+            printf '%s\n' "${tags[@]}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Build and publish Wolfi image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile
+          platforms: ${{ inputs.platforms || 'linux/amd64' }}
+          push: true
+          cache-from: type=gha,scope=wolfi
+          cache-to: type=gha,mode=max,scope=wolfi
+          labels: |
+            org.opencontainers.image.title=hashavatar-api
+            org.opencontainers.image.description=Public avatar API and demo website for hashavatar
+            org.opencontainers.image.licenses=EUPL-1.2
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ github.ref_name }}
+          tags: ${{ steps.tags.outputs.tags }}

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -12,11 +12,11 @@ documentation = "https://github.com/valkyoth/hashavatar-api"
 [dependencies]
 aws-config = { version = "1.8.16", default-features = false, features = ["rt-tokio"] }
 aws-sdk-s3 = { version = "1.131.0", default-features = false, features = ["rt-tokio", "sigv4a"] }
-hashavatar = { version = "0.7.0", features = ["blake3", "xxh3"] }
+hashavatar = { version = "0.8.0", features = ["blake3", "xxh3"] }
 image = { version = "0.25.10", default-features = false, features = ["png"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
+getrandom = { version = "0.4.2", default-features = false }
 ipnet = { version = "2.12.0", default-features = false }
-lru = { version = "0.18.0", default-features = false }
 serde = { version = "1.0.228", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["std"] }
 sha2 = { version = "0.11.0", default-features = false, features = ["alloc"] }

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hashavatar-api"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2024"
 rust-version = "1.95"
 description = "Public avatar API and landing page for hashavatar"
@@ -10,10 +10,10 @@ homepage = "https://github.com/valkyoth/hashavatar-api"
 documentation = "https://github.com/valkyoth/hashavatar-api"
 
 [dependencies]
-hashavatar = { version = "0.7.0", features = ["blake3", "xxh3"] }
+hashavatar = { version = "0.8.0", features = ["blake3", "xxh3"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "query", "json"] }
+getrandom = { version = "0.4.2", default-features = false }
 ipnet = { version = "2.12.0", default-features = false }
-lru = { version = "0.18.0", default-features = false }
 serde = { version = "1.0.228", default-features = false, features = ["derive"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["std"] }
 sha2 = { version = "0.11.0", default-features = false, features = ["alloc"] }

Cargo.toml.split-template

@@ -11,7 +11,7 @@ audit, SBOM, reproducibility, smoke, and GitHub CodeQL default setup checks.
 
 ## Current Status
 
-The current service version is `0.7.0`.
+The current service version is `0.8.0`.
 
 Implemented now:
 
@@ -25,7 +25,7 @@ Implemented now:
 - Namespace-aware tenant and style-version parameters.
 - Selectable identity hash algorithms: `SHA-512`, `BLAKE3`, and `XXH3`.
 - `WebP`, `PNG`, `JPEG`, `GIF`, and `SVG` responses.
-- Avatar families from `hashavatar 0.7.0`: `cat`, `dog`, `robot`, `fox`,
+- Avatar families from `hashavatar 0.8.0`: `cat`, `dog`, `robot`, `fox`,
   `alien`, `monster`, `ghost`, `slime`, `bird`, `wizard`, `skull`, `paws`,
   `planet`, `rocket`, `mushroom`, `cactus`, `frog`, `panda`, `cupcake`,
   `pizza`, `icecream`, `octopus`, and `knight`.
@@ -55,7 +55,7 @@ Intentionally external:
 | Area | Status |
 | --- | --- |
 | Service license | `EUPL-1.2` |
-| Renderer crate | `hashavatar 0.7.0` |
+| Renderer crate | `hashavatar 0.8.0` |
 | MSRV | Rust `1.95.0` |
 | Runtime container | Wolfi |
 | HTTP framework | `axum` |
@@ -234,6 +234,8 @@ The repository includes:
   and internal error disclosure behavior
 - local HTTP smoke tests for health, SVG/PNG rendering, security headers, and
   invalid namespace rejection
+- local Podman smoke tests for the Wolfi image when
+  `HASHAVATAR_API_GATE_PODMAN=1` is set
 - `cargo deny` dependency and license policy
 - RustSec advisory scanning
 - SPDX and CycloneDX SBOM generation
@@ -252,6 +254,16 @@ For self-hosting with Podman and Fluxheim, see:
 The compose example builds this service with the Wolfi runtime image and places
 Fluxheim in front of it as the public TLS reverse proxy.
 
+Release tags publish a Wolfi runtime image to GitHub Container Registry:
+
+```text
+ghcr.io/valkyoth/hashavatar-api:<version>
+ghcr.io/valkyoth/hashavatar-api:<version>-wolfi
+```
+
+Manual workflow runs from the default branch also publish `dev`, `dev-wolfi`,
+`latest`, and `latest-wolfi` tags.
+
 ## Related Projects
 
 - [`hashavatar`](https://crates.io/crates/hashavatar)

README.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes are expected for the latest published `0.7.x` release.
+Security fixes are expected for the latest published `0.8.x` release.
 
 ## Reporting a Vulnerability
 

SECURITY.md

@@ -0,0 +1,92 @@
+#!/usr/bin/env sh
+set -eu
+
+ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/hashavatar-api-podman.XXXXXX")
+IMAGE="${HASHAVATAR_API_IMAGE:-hashavatar-api:local-wolfi}"
+CONTAINER_NAME="hashavatar-api-smoke-$$"
+EXPECTED_UID="${HASHAVATAR_API_EXPECTED_UID:-10001}"
+KEEP_LOGS="${HASHAVATAR_API_PODMAN_KEEP_LOGS:-0}"
+
+cleanup() {
+    status=$?
+    podman rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+    if [ "$KEEP_LOGS" = "1" ] || [ "$status" -ne 0 ]; then
+        echo "podman smoke artifacts kept in $TMP_DIR" >&2
+    else
+        rm -rf "$TMP_DIR"
+    fi
+}
+trap cleanup EXIT INT TERM
+
+if [ -z "${CONTAINER_HOST:-}" ] && [ -n "${XDG_RUNTIME_DIR:-}" ] && [ -S "$XDG_RUNTIME_DIR/podman/podman.sock" ]; then
+    CONTAINER_HOST="unix://$XDG_RUNTIME_DIR/podman/podman.sock"
+    export CONTAINER_HOST
+fi
+
+port=$(python3 - <<'PY'
+import socket
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+try:
+    sock.bind(("127.0.0.1", 0))
+    print(sock.getsockname()[1])
+finally:
+    sock.close()
+PY
+)
+
+echo "podman smoke: image=$IMAGE port=$port"
+if [ -n "${CONTAINER_HOST:-}" ]; then
+    echo "podman smoke: CONTAINER_HOST=$CONTAINER_HOST"
+fi
+
+podman build -t "$IMAGE" -f "$ROOT_DIR/Dockerfile" "$ROOT_DIR"
+
+podman run -d \
+    --name "$CONTAINER_NAME" \
+    -e PORT=8080 \
+    -p "127.0.0.1:$port:8080" \
+    "$IMAGE" >/dev/null
+
+for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
+    status="$(curl -sS -o "$TMP_DIR/health.json" -w '%{http_code}' "http://127.0.0.1:$port/healthz" 2>/dev/null || true)"
+    if [ "$status" = "200" ]; then
+        break
+    fi
+    sleep 0.3
+done
+
+if [ "${status:-}" != "200" ]; then
+    echo "podman smoke failed: healthz returned ${status:-no response}" >&2
+    podman logs "$CONTAINER_NAME" >&2 || true
+    exit 1
+fi
+
+grep -q '"status":"ok"' "$TMP_DIR/health.json"
+grep -q '"service":"hashavatar-api"' "$TMP_DIR/health.json"
+
+curl -sSf -D "$TMP_DIR/svg.headers" \
+    "http://127.0.0.1:$port/v1/avatar?id=cat@hashavatar.app&algorithm=sha512&kind=cat&background=themed&format=svg&size=256" \
+    -o "$TMP_DIR/avatar.svg"
+grep -q '^<svg ' "$TMP_DIR/avatar.svg"
+grep -qi '^content-type: image/svg+xml' "$TMP_DIR/svg.headers"
+grep -qi '^x-content-type-options: nosniff' "$TMP_DIR/svg.headers"
+
+curl -sSf -D "$TMP_DIR/png.headers" \
+    "http://127.0.0.1:$port/v1/avatar?id=robot@hashavatar.app&algorithm=blake3&kind=robot&background=white&format=png&size=128" \
+    -o "$TMP_DIR/avatar.png"
+grep -qi '^content-type: image/png' "$TMP_DIR/png.headers"
+test -s "$TMP_DIR/avatar.png"
+
+USER_LINE="$(podman run --rm --entrypoint /bin/sh "$IMAGE" -c id)"
+case "$USER_LINE" in
+    *"uid=$EXPECTED_UID"* )
+        ;;
+    * )
+        echo "podman smoke failed: expected runtime uid=$EXPECTED_UID, got: $USER_LINE" >&2
+        exit 1
+        ;;
+esac
+
+echo "podman smoke: ok"

scripts/podman_smoke.sh

@@ -8,8 +8,12 @@ fail() {
 
 grep -q 'MAX_RATE_LIMIT_BUCKETS' src/main.rs \
     || fail "rate limiter capacity constant is missing"
-grep -q 'LruCache' src/main.rs \
-    || fail "rate limiter must use bounded LRU storage"
+grep -q 'struct RateLimiterState' src/main.rs \
+    || fail "rate limiter bounded state is missing"
+grep -q 'evict_oldest_if_full' src/main.rs \
+    || fail "rate limiter must evict when the bucket bound is reached"
+grep -q 'VecDeque<String>' src/main.rs \
+    || fail "rate limiter must track oldest buckets for eviction"
 grep -q 'into_make_service_with_connect_info::<SocketAddr>' src/main.rs \
     || fail "server must expose peer socket addresses to handlers"
 grep -q 'TRUSTED_PROXIES_ENV' src/main.rs \
@@ -53,6 +57,14 @@ grep -q 'build_avatar_asset_rejects_oversized_namespace' src/main.rs \
     || fail "hashavatar namespace validation regression test is missing"
 grep -q 'object_key_uses_full_sha256_digest' src/main.rs \
     || fail "full object-key digest regression test is missing"
+grep -q 'content_security_policy_uses_nonce_without_unsafe_inline' src/main.rs \
+    || fail "CSP nonce regression test is missing"
+grep -q 'render_json_ld_escapes_script_end_tags' src/main.rs \
+    || fail "JSON-LD script breakout regression test is missing"
+grep -q 'escape_html_attribute_handles_single_quotes' src/main.rs \
+    || fail "attribute escaping regression test is missing"
+grep -q 'etag_uses_full_sha256_digest' src/main.rs \
+    || fail "full ETag digest regression test is missing"
 
 if [ -e .github/workflows/codeql.yml ] || [ -e .github/codeql/codeql-config.yml ]; then
     fail "CodeQL default setup is enabled in GitHub; remove repo-level advanced CodeQL configuration"