v0.24.9

scripts/check_source.py

@@ -16,7 +16,7 @@ def read_cache_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.24.8"
+assert manifest["package"]["version"] == "0.24.9"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -24,14 +24,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.24.8"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.24.9"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.24.8",
-    "CHANGELOG.md": "## 0.24.8",
-    "ROADMAP.md": "## 0.24.8",
-    "AGENTS.md": "Current source version: 0.24.8.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.8",
+    "README.md": "# RustProxy 0.24.9",
+    "CHANGELOG.md": "## 0.24.9",
+    "ROADMAP.md": "## 0.24.9",
+    "AGENTS.md": "Current source version: 0.24.9.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.9",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -53,6 +53,18 @@ for marker in [
     assert marker in update_check_source, marker
 assert 'update version document is too large or incomplete: {error}' in update_check_source
 assert '.context("update version document is too large or incomplete")' not in update_check_source
+for marker in [
+    'tracing::error!(',
+    'MAX_REDIRECTS: usize = 5',
+    'SSL_CERT_FILE',
+    'CURL_CA_BUNDLE',
+    '/usr/local/share/certs/ca-root-nss.crt',
+    'response.status().is_redirection()',
+    'redirect_target(&current, location)',
+    'update version redirect must not downgrade HTTPS to HTTP',
+]:
+    assert marker in update_check_source, marker
+assert 'pub last_error:' not in update_check_source, "update-check errors must not change dashboard/API state"
 for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.8_AUDIT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
     assert (root / name).is_file(), name
 for path in (root / "examples").glob("*.json"):
@@ -200,7 +212,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.24.8"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.24.9"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -486,6 +498,28 @@ db_source = (root / "src/db.rs").read_text()
 acme_source = (root / "src/acme.rs").read_text()
 main_source = (root / "src/main.rs").read_text()
 logging_source = (root / "src/logging.rs").read_text()
+secret_store_source = (root / "src/secret_store.rs").read_text()
+backup_source = (root / "src/backup.rs").read_text()
+config_source = (root / "src/config.rs").read_text()
+acme_worker_source = (root / "scripts/acme_provider.py").read_text()
+for feature_marker in [
+    "AES_256_GCM", "master.key", "O_NOFOLLOW", "migrate_acme_credentials",
+    "secret_store", "SecretMetadata",
+]:
+    assert feature_marker in secret_store_source or feature_marker in db_source, feature_marker
+for feature_marker in [
+    "Argon2", "RPROXYB1", "RPROXYA1", "backup create", "secret-store-key.enc",
+    "validate_backup_version", "stage",
+]:
+    assert feature_marker in backup_source or feature_marker in main_source, feature_marker
+for feature_marker in [
+    "ErrorLogSettings", "ERROR_LOG_QUEUE", "RedactingStderr", "open_error_file",
+    "ErrorLogLayer", "ERROR",
+]:
+    assert feature_marker in logging_source, feature_marker
+assert "pub error_log: crate::logging::ErrorLogSettings" in config_source
+assert "credential_ini_b64" in acme_source and "credential_ini_b64" in acme_worker_source
+assert "finally:" in acme_worker_source and "credential_file.unlink" in acme_worker_source
 for marker in ['certificate_api_credentials', 'upsert_certificate_api_credential', 'revoke_certificate_api_credential', 'verify_certificate_api_credential', '0005_certificate_api.sql', '0006_certificate_api_credentials.sql']:
     assert marker in db_source, marker
 for marker in ['/api/certificate-api', 'certificate_api_credentials', 'certificate_api_operation', '/api/live-logs', 'CertificateApiBearer']:
@@ -509,7 +543,7 @@ assert 'Ok(line) if command_tx.send(line).is_ok()' not in main_source, 'do not m
 assert 'Ok(line) => {' in main_source and 'command_tx.send(line).is_err()' in main_source
 for marker in ['LIVE_STREAM_CAPACITY', 'broadcast::Sender<LogEntry>', 'pub fn subscribe']:
     assert marker in logging_source, marker
-assert 'SCHEMA_VERSION: i64 = 6' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source
+assert 'SCHEMA_VERSION: i64 = 7' in db_source and 'certificate_renewals' in db_source and '0004_admin_preferences.sql' in db_source and '0005_certificate_api.sql' in db_source and '0006_certificate_api_credentials.sql' in db_source and '0007_secret_store.sql' in db_source
 assert 'load_renewal_observations' not in acme_source and 'renewals.json' not in acme_source
 for marker in ['pub kind: &\'static str', 'pub log_directory: String', 'pub(crate) fn certbot_log_directory', 'kind: "issue"', '"renewal-dry-run"']:
     assert marker in acme_source, marker
@@ -1002,12 +1036,13 @@ connection.executescript((root / "migrations/0003_certificate_renewals.sql").rea
 connection.executescript((root / "migrations/0004_admin_preferences.sql").read_text())
 connection.executescript((root / "migrations/0005_certificate_api.sql").read_text())
 connection.executescript((root / "migrations/0006_certificate_api_credentials.sql").read_text())
-connection.execute("PRAGMA user_version = 6")
+connection.executescript((root / "migrations/0007_secret_store.sql").read_text())
+connection.execute("PRAGMA user_version = 7")
 assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
 assert connection.execute("SELECT COUNT(*) FROM auth_throttle WHERE id=1").fetchone()[0] == 1
 assert connection.execute("SELECT COUNT(*) FROM certificate_renewals").fetchone()[0] == 0
 assert connection.execute("SELECT COUNT(*) FROM admin_preferences").fetchone()[0] == 0
-assert connection.execute("PRAGMA user_version").fetchone()[0] == 6
+assert connection.execute("PRAGMA user_version").fetchone()[0] == 7
 connection.close()
 for marker_0223 in [
     '"/api/certificates/reload"', 'certificate_reload',
@@ -1083,7 +1118,7 @@ assert 'id="process-platform"' in html and 'd.platform' in app_js
 assert 'id="panel-logging"' not in html
 assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.24.8"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.24.9"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = (root / "src/tls.rs").read_text()
@@ -1128,5 +1163,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.24.8 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
+print("PASS: 0.24.9 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v7 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")