Andrew Phillips
b166477202
Security: - Use constant-time password comparison (subtle crate) to prevent timing attacks - Replace permissive CORS with configurable origin-restricted CORS - Add TLS warning when password auth is used without HTTPS Bug fixes: - Convert MetaPlugin panics to anyhow::Result (get_meta_plugin, outputs_mut, options_mut) - Replace item.id.unwrap() with proper error handling across 15 call sites - Fix panic on unknown column type in list mode - Fix conflicting PIPESIZE constant (was 8192 vs 65536, now unified to 8192) - Add 256MB filter chain buffer limit to prevent OOM - Gracefully skip unregistered plugins instead of panicking Dead code removal: - Delete unused filter parser files (filter_parser.rs, filter.pest, parser/ module) - ~260 lines of dead PEG parser code removed Code consolidation: - Add is_content_binary_from_metadata() helper (was duplicated in 4 places) - Simplify save_item_raw() to delegate to save_item_raw_streaming() (~90 lines removed) Incomplete features: - Populate filter_plugins in status output from global registry - Add FallbackMagicFileMetaPlugin (was referenced but never implemented) - Document init_plugins() as intentional no-op Infrastructure: - Add Dockerfile (static musl binary on scratch, 4.8MB) - Add .dockerignore - Add cors_origin to ServerConfig and config.rs
37 lines
985 B
Docker
37 lines
985 B
Docker
# Build stage
|
|
FROM rust:1.88-slim AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
cmake \
|
|
make \
|
|
gcc \
|
|
musl-tools \
|
|
pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN rustup target add x86_64-unknown-linux-musl
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy manifests and fetch dependencies (cached layer)
|
|
COPY Cargo.toml Cargo.lock ./
|
|
RUN mkdir src && echo 'fn main() {}' > src/main.rs && echo '' > src/lib.rs
|
|
|
|
RUN cargo fetch --target x86_64-unknown-linux-musl
|
|
|
|
# Copy real source and build static binary
|
|
# magic feature excluded (requires shared libmagic; fallback uses `file` command)
|
|
COPY src/ src/
|
|
RUN cargo build --release --target x86_64-unknown-linux-musl \
|
|
--no-default-features --features lz4,gzip \
|
|
&& strip target/x86_64-unknown-linux-musl/release/keep
|
|
|
|
# Runtime stage - scratch since binary is fully static
|
|
FROM scratch
|
|
|
|
COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/keep /keep
|
|
|
|
EXPOSE 21080
|
|
|
|
ENTRYPOINT ["/keep"]
|